Free Online Tools to Alert You When Your Personal Information Appears Online
With the summer nearly past us, and many of you in back-to-school mode I thought I’d write about some cool and free online tools that will alert you when any of your personal information appear online. Plus, these are provided by Google. For you to benefit from these you’ll need to have a Google account (If you have a Gmail account then you have a Google account.)
Previously, I wrote about PII, or Personal Identifiable Information and the risk of being unaware of where your PII might find itself on the web or Dark Web for that matter.
I recently met with a client who had their email addresses spoofed. The bad actor had spoofed their names and sent emails on their behalf to all their friends and family to send them money. My client’s husband received an email on a Friday morning while they were both out shopping, so he knew it wasn’t her. Monday morning, I received a phone call asking if I could get to the bottom of this. I knew I probably couldn’t trace the email’s origin given it was from a Hotmail.com account. Hotmail accounts, now Outlook.com accounts, Gmail, and some others mask the sender’s original IP address for privacy purposes. Many bad actors use Gmail, Hotmail, and Outlook to send dangerous emails.
I immediately assisted her to activate her MFA (Multi Factor Authentication) security on her Hotmail.com account then proceeded to create a Google account for her, with an accompanying Gmail account. The Gmail account was created as a security back up email for her Hotmail account, and her Hotmail email address was used as the rescue contact for her Google account.
Now things were sinking in. She was getting it. She was feeling relieved knowing if anyone tried to access any of her accounts, she would get an SMS text message. She asked, “What do I do if I get a text message and I didn’t try to login? Does that mean someone is trying to hack me?” She got it. I responded, “If this happens, and you don’t feel good about it, then immediately change your password(s).”
Once she couldn’t think of any other questions. I walked her through the Gmail interface as well as a guided tour in her Google account. I spent more time in the Security and Devices sections than the others. Her Microsoft and Google accounts were now more secure than they had ever been. We repeated the security controls exercise with her husband. She’d write his and her new account names and passwords in a little book. She blurted, “I know what you think. If I lose my book, I’m screwed! But it’s under lock and key in my home office.”
“I have a bonus for you today”, I told her. Her expression turned from confused into enthusiastic. I proceeded to show her how she can stay proactive and monitor her accounts and personal information.
Have I been Pwned?
When someone calls me in panic, “Who did this to me? Who hacked my account? How do I know if my email address is safe again? How can I let my friends and family know I’ve taken back control of my account” I pay a quick visit to the Have I Been Pwned website (https://haveibeenpwned.com/) and I check if their email address has been involved in a breach. The client’s mood changes when they’re informed their email address and password was breached in 2019 and that they’ve since changed their password. “How did this happen?” Most of the time, users clicked trustingly on a phishing link in an email or an SMS text message (hence, smishing).
Another great feature on HIBP is the “Pwned Passwords” feature where you can enter one of your passwords to see if it appears on the Dark Web. I don’t recommend that you enter any passwords from a public computer (like at the library or the airport). If you only use one password for most of your accounts, seriously consider implementing a password manager or read more about why you should here.
Google Dark Web
I was pleasantly surprised to find this tool in a simple Google search. The Google “My Activity” tool. This tool is free and a hit for me. Visit your Google account, ensure you’re logged in, then go “my activity” here https://myactivity.google.com/ dark-web-report/dashboard
With 20+ years in tech and cybersecurity, Jason offers lectures and training sessions . For more information visit www.jasoncardinal.ca
