Consumers are being advised to exercise caution when sharing their date of birth (DOB) online, as cybersecurity experts warn that this information can be exploited by criminals to facilitate identity fraud and scams. Personal details, including DOBs, are often collected during online sign-ups for retailers, loyalty programs, newsletters, or contests. These data points can be stolen during cyberattacks and used in combination with other information to convincingly impersonate individuals.

In a recent incident involving the online retailer Asos, customer data—including dates of birth—was compromised and obtained by scammers. Cybersecurity professionals say such breaches contribute to the growing availability of personal information on the dark web, where it can be aggregated to create detailed identity profiles.

Jake Moore, cybersecurity adviser for ESET, emphasized that while a date of birth alone may not hold significant value for criminals, when paired with names, phone numbers, and other details, it becomes a useful tool for identity theft. “A date of birth alone is not particularly valuable, but combined with other information, it can help criminals commit identity fraud,” Moore said.

An investigation by Alexandre François of the intelligence company WhoisXML API found that nationally, eight out of 14 major retailers request customers’ dates of birth upon signup. François noted that retailers may have limited motivation to remove this requirement since the data helps them target marketing efforts based on customer age.

Experts describe how compromised information can be used after breaches. Serpil Hall, security expert at Datos Insights, explained that stolen data helps make phishing emails more convincing and enables hackers to deceive customer support representatives by posing as victims. Such scams may not surface immediately after a breach; instead, criminals often compile multiple data sources—including social media profiles, employment history, and relatives’ information—to enrich stolen identities, boosting their confidence when impersonating individuals.

To protect themselves, consumers are encouraged to be skeptical of unsolicited contacts, even if the caller appears to have personal information. Moore advises limiting the submission of optional personal details on low-risk websites, including using fictitious dates of birth or avoiding entering them altogether. He also recommends maintaining a separate email address for online shopping to minimize exposure if that account is compromised.

François stressed that genuine verification of identity requiring a real date of birth should mainly occur with official institutions such as banks, tax authorities, and government agencies. Retailers generally need only payment and delivery details, except when purchasing age-restricted items. He suggested using a consistent non-real date of birth—such as the first day of one’s birth month—at retailers, or leaving the field blank if possible, to reduce risks without complicating the ordering process.

Overall, experts agree that minimizing the amount of personal information shared with online retailers can reduce the threat posed by data breaches and subsequent scams. Consumers should consider carefully what details are truly necessary to provide and take steps to limit the digital footprint exposed during everyday online transactions.