Protecting Personal Information: Social Media, Passwords and Two-Factor Authentication

Why Does Personal Information Need Protecting?

Your name, home address, phone number, date of birth, identity document numbers, and bank details are the raw material scammers use to impersonate you, apply for loans, open accounts, or carry out further fraud. Once these details are in the wrong hands, you may find — without knowing it — that someone has applied for credit, borrowed money, or accumulated debt in your name.

Personal information doesn't only leak through large data breaches. Scammers often piece together enough detail through public social media posts, phishing messages, phone scams, or even searching through discarded mail.

Social Media Safety

• Do not publicly post your home address, phone number, identity document numbers, bank details, or date of birth.
• Limit what you share about family members — such as your children's school name, daily routines, or holiday plans.
• Set your social media profiles to "friends only" visibility, and only accept friend requests from people you actually know.
• Watch out for fake accounts and duplicate profiles. If someone you already know sends you a new friend request, verify it through another channel before accepting.
• Be cautious of strangers who reach out uninvited and ask a lot of questions about your daily life, work, or finances.

Password Safety

• Use a different password for each important account. If one account is compromised, reusing the same password puts all your other accounts at risk too.
• Make passwords long enough and mix upper and lower case letters, numbers, and special characters. Avoid using birthdays, names, or common words.
• Consider using a password manager to help you create and store different passwords securely.
• Never share your password with anyone — including people who claim to be from your bank, the police, or a government agency.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step after your password — usually a one-time code sent to your phone, a code from an authenticator app, or biometric verification (fingerprint or face recognition). Even if a scammer steals your password, they still cannot access your account without this second step.

• Enable two-factor authentication on important accounts including online banking, email, and social media.
• Never share a verification code with anyone — not even someone claiming to be from your bank or a government agency. Legitimate organisations will never ask you for your code.

App Safety

• Before installing an app, check where it comes from (use official app stores only) and what permissions it requests — a torch app has no reason to access your contacts or location.
• Periodically review the apps installed on your phone and remove any that you no longer use or that seem suspicious.
• Pay attention to changes in privacy policies when apps update, and make sure you understand how your data is being handled.

If You Suspect Your Information Has Been Leaked

1. If bank or credit card details may be involved, contact your bank immediately and ask them to protect your account.
2. Change the passwords for relevant accounts and review your login history for any unfamiliar activity.
3. If your passport, driver licence, or other identity documents may have been compromised, contact the relevant agency — for example, apply to NZTA for a replacement licence, which will cancel the compromised number.
4. Contact IDCARE (https://www.idcare.org/) for free specialist identity theft support. They will provide personalised advice based on what information was exposed.