What can a person find about you in an hour?

You already know you have a digital footprint. But until you actually try to follow it, it’s hard to appreciate how quickly a stranger can turn a few scraps of public information into a fairly detailed picture of your life.

It’s a technique that investigative organisations like Bellingcat have used to great effect in trying to uncover how the Russian state operates – and that journalists like myself use regularly.

But what happens if you spend an hour trying to investigate yourself using only information available on the open web? It turns out you can find out quite a lot.

My personal website gives away my email address. Search my name and you can quickly establish broadly where I live, where I work, what I do for a living, and a host of social media accounts stretching back years. Past biographies also help to fill in some of the gaps.

Public databases reveal a correspondence address – if not my home address – and more personal details, while LinkedIn gives away chunks of my education and work history. Other profiles expose usernames I have reused elsewhere. Recent social media posts make it possible to work out that I recently got married, went to Japan on honeymoon, and had an argument with an airline about my flight home.

None of that is especially secret. Much of it is information I deliberately published. But put it together and you have much of the raw material needed to conduct any number of scams.

A basic search and digital footprint investigation can reveal the following data points:

• Email address: Often found via personal websites or public profiles.
• Location and residence: Broad information on where a person lives, along with correspondence or home addresses found in public databases.
• Employment and career: Where someone works, what they do for a living, and details from their work history and past biographies (such as via LinkedIn).
• Education history: Details regarding education and academic background.
• Social media footprint: A host of active and historical social media accounts, as well as usernames reused across different platforms.
• Personal and family milestones: Recent life events such as getting married, going on honeymoon, or details about family.
• Travel and consumer interactions: Information about recent trips (like travel destinations) and consumer disputes (such as arguments with airlines over flights).

Connecting the dots

Unlike in the early days of the internet, an attacker doesn’t need to send me a badly spelled message from a supposed Nigerian prince to try and fool me.

They could email my publicly listed address pretending to be the airline I had just complained about, mention my journey home, perhaps throw in my job or location, and have a far better chance of convincing me to click. It’s a technique that many cybercriminals use on social media, pretending to be airlines and replying to real, frustrated customers.

People unfortunately fall for these convincing scams. The US Federal Trade Commission says people reported losing $3.5 billion to imposter scams in 2025, while nearly one in three fraud reports related to impersonation.

The UK’s National Cyber Security Centre warns criminals use information available online, including social media posts, to make phishing messages more convincing.

Cybercriminals do this on an industrial scale, but similar data collection also happens legitimately. Data brokers collect information from different sources, combine it, and sell or rent the resulting profiles for profit. At the same time, people-search websites can make names, addresses, phone numbers, and other personal details much easier to find.

Try it yourself

I’m an unusual case as a journalist with a public profile. But the same is true for all of us who spend any time online – you can try the experiment yourself. Search for your full name in quotation marks, along with old usernames and email addresses. Look at your social profiles and check what public records reveal.

Then start fixing the issues you’ve identified. Take care to lock down social accounts that don’t need to be public. Remove unnecessary biographical details, particularly birthdays, locations, and family information. Ask data brokers to delete profiles where you can. People can also ask search engines to delist some results containing their personal information where their privacy rights are significantly affected.

Then work on securing your public profiles to avoid falling victim to any major scams before it’s too late.