Your Identity & Personal Information
Your identity is not just your name. It is every detail that, when combined, lets someone pretend to be you - online, on the phone, or in person.
The Messages She Never Sent
Neha was a teacher in her mid-thirties. She had a modest social media presence and was careful about what she shared.
One Monday morning, three colleagues messaged her asking if she was okay. She had no idea what they meant.
Someone had created a profile using her name, her photo from a public post, and her school's name from her bio. They had contacted her colleagues, her students' parents, and two of her closest friends - asking for urgent help and small transfers of money.
Neha had not been hacked. No one had broken into her accounts. Her phone was with her the entire time.
All it took was a name, a photo, a workplace, and a phone number. Everything was already visible.
It took her three weeks to have the fake accounts removed. Several people had already sent money. One parent never spoke to her again.
What Is Actually Happening: Your Identity Has a Market Value
Your personal data is already being bought and sold. The market is larger and more organised than most people imagine.
1 in 3
people have had their personal information misused without knowing how it was obtained.
You do not have to do anything wrong for your identity to be exploited. The data is collected, combined, and sold long before anyone targets you.
Source: Identity Theft Resource Center Annual Report, 2025Your Name and Photo Are Enough
A name, a profile photo, and a workplace are enough to create a convincing fake account. Over 60% of impersonation victims say the attacker used only publicly available information - nothing hacked, nothing stolen.
Email Is the Master Key
Your email address is the recovery route for almost every account you own. Once someone controls your inbox, they can reset passwords for your social media, shopping, and communication accounts without needing any of your other details.
A Complete Profile Sells for ₹20,000+
Name, phone number, national ID, email, and address together form a "fullz" profile. On dark web markets, this sells for ₹2,000 to ₹20,000+. It can be used to register SIM cards, create fake accounts, or impersonate you to government services.
Three Groups, One Target
Modern identity misuse runs like a business. One group collects the data. Another packages and sells it. A third uses it. Your information passes through multiple hands before anyone targets you - often long after the original source was breached.
Now Try It From the Other Side
This simulation shows how someone builds a profile from your personal data, what that profile is worth, and how a fake identity gets constructed from the pieces you leave online.
Work through all four steps to see your protection score.
What That Just Showed You
1. What makes you identifiable is five things, not one.
Your full name, phone number, national ID (Aadhaar, PAN, or passport), email address, and home address are the five pieces that define you digitally. None of them is a secret. All of them are findable. The risk is not in any single piece - it is in what becomes possible when three or four are combined. That combination is enough to impersonate you on social media, register a SIM card in your name, or pass identity checks on most online platforms.
2. Your data is already for sale, and it is not just used for financial fraud.
Stolen identity data is used to create fake social profiles, register phone numbers, access government services, and target your contacts in your name. The person using your data may never go near your bank account. The damage can be to your reputation, your relationships, or your ability to prove who you are when it matters.
3. Identity theft at scale is automated and not personal.
Neha was not chosen. She was a match in a dataset. Automated tools scrape publicly visible information, cross-reference it across platforms, and build profiles of real people without any human choosing to target a specific individual. The harm feels personal when it happens. The process that created it was mechanical.
4. Synthetic fraud can involve you without anyone taking your full identity.
An attacker takes one real piece of your information - your national ID number or date of birth - and builds a fictional person around it with an invented name, address, and contact details. That fake person can be used to register accounts, receive deliveries, or bypass verification checks. You may not discover it until something unexpectedly surfaces - a message from a platform you never joined, or a record linked to your ID that you did not create.
5. Recovery is possible and it has a clear path.
If you find accounts, profiles, or registrations in your name that you did not create, act the same day. Document everything with screenshots and dates. Report the fake account or misuse to the platform directly. File a complaint at cybercrime.gov.in or call 1930. If your national ID has been misused, file an FIR at your local police station - this creates a formal record that you can use to dispute any consequences. Notify the people who may have been contacted in your name.
Five Things Worth Doing
Pick one and do it this week.
1. Search for yourself online.
Type your full name into a search engine and look at what comes up. Check whether your phone number, address, or workplace appears on people-search sites. Look up your email address on haveibeenpwned.com to see if it has been part of any known breach. Most people find something they did not know was visible.
2. Lock your national ID when you are not using it.
If you are in India, visit myaadhaar.uidai.gov.in and enable the biometric lock. This prevents anyone from using your Aadhaar for authentication at a telecom outlet, service centre, or verification kiosk without your knowledge. You can unlock it temporarily whenever you need it yourself.
3. Tighten what your social media reveals.
Go through your public profiles and check what a stranger can see. Your workplace, city, phone number, and photos are the raw material for impersonation. Set personal details to visible only to people you know. Think carefully before tagging your location or your workplace in posts.
4. If something looks wrong, act the same day.
If you find a profile, account, or registration in your name that you did not create, do not wait. Report it to the platform, file a complaint at cybercrime.gov.in or call 1930, and let people in your contact list know so they are not targeted in your name. Speed matters - the longer a fake identity operates, the more damage it can do.
5. Use a different password for every account that matters.
Your email, your social media, your phone account - each one should have a unique password that is not shared with anything else. If one platform is breached, the compromise stays contained. A password manager means you only have to remember one master password and it handles the rest.
One Question Before You Continue
Someone creates a fake social media profile using your name, photo, and workplace, then contacts your friends pretending to be you. What made this possible?