🎭
There is already a version of you being assembled. It is built from pieces you gave away one innocent post at a time. This list takes the pieces back, and gives the people who know you a way to tell the difference.
👥 Knowing the Real YouTechnology did not catch the fake Corey. His team did, because they knew how he actually writes. The people in your life need the same thing: a way to check, that does not depend on recognizing a voice.
Agree a family code word, and never send it by text or emailA word only your family knows, used to confirm that an urgent call really is who it claims to be. Three seconds of audio is enough to clone a voice, and about seven out of ten people cannot tell a clone from the real thing. The code word is what settles it. Make one rule: any urgent request for money gets a callback on a number you already haveNot the number that called you, and not the one in the message. Hang up and dial the number already in your phone. Every version of this needs you to act before you check. Tell the people who would be targeted what you would never doYour parents, your children, your assistant, your bookkeeper. "I will never call you needing money urgently" has to be a sentence that already exists before the call comes. Treat a video call as no proof of identityA finance employee at the engineering firm Arup joined a video call, recognized his chief financial officer and colleagues, and made fifteen transfers totaling 25 million dollars. He was the only real person on the call. Agree a challenge question with an answer no database holdsSomething only the two of you lived through. Not your mother's maiden name, which sits on a genealogy site, and not your first street, which sits in a data broker record. Do not wait for software to catch this for youDeepfake detectors that score 94 to 96 percent in a laboratory drop below 50 percent against real-world video, because compression and re-recording strip out the traces they look for. You are the detector.
🎤 Your Voice and Your FaceA clone needs raw material, and most people publish it for free. You cannot stop someone copying you. You can make the copy harder to build and easier to catch.
Assume every public video or recording of you is training dataA video in the car, a podcast appearance, a conference talk, a story with sound. Three seconds is the whole requirement. Decide what stays public knowing that. Replace your voicemail greeting with the automated oneA personal greeting is your own voice, saying your own name, available to anyone who dials your number and waits. Your carrier's default recording gives away nothing. Set personal accounts to private, then read the follower listPrivate is not private if the list has grown for ten years. Remove the accounts you do not recognize. Stop posting your children's faces, full names and school publiclyA single school photo gives a stranger their name, their age, where they go and what they look like. Criminals can now build abuse imagery from one ordinary picture, with no contact with the child at all. Search your own name and handle once a monthLook for accounts using your photo and a near-identical handle. Find each platform's impersonation report form now, while you are calm, rather than when you are angry and in a hurry.
🗂 Starve the Super ProfileYour identity is not in one place. It is scattered across data brokers, breached databases and your own posts, and a criminal with patience and about twenty dollars can assemble it in an hour.
Remove your date of birth from every public profileThe birthday fundraiser confirmed it. A date of birth is one of the most widely used identity verification points there is, and you are handing it over annually. Stop answering security questions honestlyYour mother's maiden name is on a genealogy site and your first car is in a quiz you took. Generate random answers and store them in your password manager like passwords, because that is what they are. Opt out of the major data broker sitesThis is where the address, the phone numbers and the family member names come from. Opting out is tedious and it works. Put a reminder in the calendar to check again in six months, because records come back. Post travel after you are homeThe holiday photo confirmed the house was empty for ten days, which airline you fly and roughly what you spend. It is the same photo a week later, and it tells a criminal nothing. Think before announcing a new job publiclyIt tells a criminal exactly who to impersonate when they message you as your new chief executive, and who to call at your old employer asking to "verify" your details. Find out which breaches already include youIn one 2024 incident a seller claimed to hold 2.9 billion records of names, addresses, social security numbers and family relationships. Knowing what is already out there tells you which accounts to fix first.
🧒 Your Child's IdentityYour child got a social security number within weeks of being born, and nobody is checking a seven-year-old's credit report. That is exactly why criminals use it.
Freeze your children's credit at all three bureaus, and at InnovisAbout an hour of your time, and it costs nothing. Without it, fraud in their name can run undetected until they apply for a student loan at eighteen and find the credit they never used is already wrecked. Check whether your child already has a credit fileA child should have none. If one exists, that is not a clerical error, it is fraud that has already started. Ask why, before giving a child's social security number to anyoneSchools, clubs, doctors and camps ask by habit. Most do not legally need it, and every copy is another database that can be breached.
🚨 When the Fake You Shows UpNot if. When. What you do in the first hour decides how far it travels.
Warn the people it will be aimed at, directlyYour parents, your team, your clients. Use a channel you control and they already trust. The impersonation works on the people who love you, so they are the ones who need to hear it from you first. Keep the evidence before you blockScreenshot the profile, the handle, the whole conversation and anything they asked for. Blocking is right. Deleting erases what an investigator would need. Report it, and type the address yourselfIC3.gov for the impersonation, and IdentityTheft.gov if your identity was used to open something. Type them rather than following a link somebody sent you. Never pay, and never negotiatePaying confirms you are reachable and willing, which puts you on a list that gets sold. Nobody charges you to take down a fake of you.
This checklist is from You're Already a Target by Corey White.
This is the full list. Most of it will not apply to you. Remi™ finds which of these actually matter for you, puts them in order, and walks you through them one at a time.
Get Your Personal Cyber Score →
Back to Master Checklist →