Social Media and Digital IdentityUpdated: 2026
Understand the risks of digital overexposure and protect your online identity without giving up social media.
By the end of this module, you'll be able to…
- Identify information you shouldn't post on social media
- Understand how attackers exploit public information (OSINT)
- Protect your account against identity theft
- Configure the essential privacy settings
Why social media interests attackers
An attacker spends 20 minutes on Pascal's LinkedIn, a finance director. He learns: his employer, his exact title, his coworkers, his recent trips, his interests. With that, he crafts a spear-phishing email so targeted that Pascal doesn't spot the fraud.
Social media is the largest publicly accessible database of personal information in the world. For social engineers, it's a goldmine: names, employers, coworkers, trips, interests, opinions — everything they need to personalize an attack.
This gathering of public information is called OSINT (Open Source Intelligence). It's legal, simple, and attackers do it systematically before a targeted attack.
Overexposure and information gathering
✗ Risky information to post
- Your exact address or neighborhood
- Your work schedule or times you're away from home
- Photos revealing documents (license plates, badges, screens)
- Real-time vacation updates (announcing your home is empty)
- Details about your kids: school, first name, activities, schedule
- Financial information: recent purchases, income, hardship
- Answers to your accounts' security questions: mother's maiden name, first pet...
Identity impersonation and fraud
Impersonation on social media takes several forms. The most common: creating a fake profile in your name to deceive your contacts or damage your reputation.
✓ Detecting and responding to impersonation
- Regularly search your name on Google to check what's public
- Set up Google alerts on your name (alerts.google.com)
- If you find a fake profile, report it to the platform immediately
- Warn your contacts that a fake profile exists in your name
Identity theft — mechanisms and prevention
Full identity theft (social insurance number, birth date, address, financial information) lets a criminal open accounts in your name, take out loans, or commit fraud using your identity.
✓ Protecting your identity
- Never post your full birth date (day + month + year) publicly
- Never share your SIN, passport number, or driver's license online
- Be wary of Facebook quizzes like "What's your superhero name?" — they often collect information used as security questions
- Check your credit report regularly (Equifax, TransUnion) to spot fraudulent account openings
Digital reputation and security
Your digital reputation is the sum of everything associated with your name online — posts, photos, comments, mentions. It's nearly permanent and visible to employers, clients, family.
✓ Managing your digital footprint
- Think before posting: "Would I be comfortable if my employer saw this?"
- Delete old posts that no longer represent you
- Check your tags — you can be mentioned in posts without asking
- Google yourself regularly: name + city, name + employer
Safe posting practices
✓ Secure posting rules
- Wait until you're back from vacation to post your photos (not in real time)
- Avoid photos that reveal your address (house numbers, signs) or exact neighborhood
- Blur documents, badges, and screens visible in your photos
- Check your photos' metadata — it may contain your GPS location
- Think of others: don't post photos of people without their consent
Privacy settings and vigilance
✓ Essential settings to check
- Facebook: Settings → Privacy → Who can see your posts? → Friends only (not Public)
- Instagram: Account → Account privacy → Private account
- LinkedIn: Profile visibility → Who can see your connections? → Your connections only
- All platforms: Disable automatic geotagging of posts
- Review your settings every 6 months — platforms often reset them after updates
Building safer digital habits
Social media security isn't about paranoia — it's about being conscious of what you share and with whom.
✓ 5 habits to adopt
- Before posting: "Who can see this? Is it useful to post?"
- Every month: check your privacy settings
- Every quarter: google your name to see your footprint
- Enable MFA on all your social media accounts
- Check third-party apps connected to your accounts (Settings → Authorized apps) — revoke what you no longer use
What your profile reveals
Explore this fictional LinkedIn profile. Click each zone to see what an attacker can infer from it.
Module quiz
Test what you've learned with 4 questions.
See also