What Would a Cybercriminal Want From Me?

“Why Would Anyone Target Me?”

When we hear about cybercrime, we often hear about attacks against large corporations, hospitals, banks, government agencies, and wealthy individuals. That can create an understandable assumption: Why would a cybercriminal be interested in me?

Maybe you’re a server at a restaurant, a mechanic, a teacher, a firefighter, a hairdresser, an office worker, or a retiree. You don’t have access to millions of dollars or highly classified information. What could a cybercriminal possibly want from you?  The answer is surprisingly simple: quite a bit.

Cybercriminals don’t necessarily care about who you are. They care about what they can do with your money, identity, accounts, relationships, and access.

They Want Your Money

The most obvious motivation is financial. An attacker may want access to your bank or credit-card accounts, but stealing money directly isn’t the only option.

A criminal might convince you to make a payment, purchase gift cards, provide credit-card information, or send money to what appears to be a family member in trouble. Others may gain access to payment apps or online shopping accounts where payment information is already stored.

The amounts involved don’t have to be enormous. Cybercrime can be conducted at tremendous scale. Stealing a relatively small amount from thousands of people can be a very profitable business.

They Want Your Identity

Your personal information also has value. Your name, address, date of birth, Social Security number, driver’s license information, and other identifying information can potentially be combined to impersonate you.

A stolen identity may be used to apply for credit, establish fraudulent accounts, file false tax returns, obtain services, or support other criminal activity.  Even pieces of information that seem harmless can become valuable when combined with information obtained from data breaches, social media, and other sources.

They Want Your Accounts

One of the most valuable things you possess may be something you rarely think about: your email account.

Consider how many of your other accounts are connected to your email address. When you forget a password, where does the reset message go? When your bank detects unusual activity, how does it contact you? Where are your receipts, financial statements, travel confirmations, and personal conversations stored?  Access to one email account can potentially provide a path to many others.

Social-media and messaging accounts also have value. They can be stolen, sold, used to distribute scams, or used to impersonate the account owner.

They Want Your Relationships

An attacker doesn’t necessarily have to steal from you to make your account valuable.

If a criminal gains control of your email, social-media, or messaging account, that person also gains something extremely useful: the trust other people have in you.

A fraudulent message coming from a stranger may be ignored. The same message appearing to come from a friend, coworker, parent, child, or trusted business contact is much more convincing.

Your compromised account can therefore become a tool for attacking other people.

They May Want Your Access

Sometimes you aren’t the ultimate target at all.  Your employer may be.

An attacker who compromises an employee’s account may use that access to learn about the organization, send convincing phishing messages to coworkers, access business information, or look for opportunities to move deeper into company systems.

The same principle applies outside of work. Your relationships with family members, businesses, community organizations, and other people may provide opportunities that an attacker can exploit.

In other words, your value to an attacker isn’t necessarily determined by how much money or sensitive information you personally possess. Sometimes your value is simply that you provide a path to someone or something else.

You Don’t Have to Be Personally Targeted

There is one final misconception worth addressing. Being attacked doesn’t necessarily mean a cybercriminal specifically selected you.  Much of cybercrime is opportunistic.

Attackers can distribute enormous numbers of phishing emails and text messages, test stolen usernames and passwords against online services, create fraudulent websites, and distribute scams to thousands of people simultaneously.  They don’t necessarily need to know who you are beforehand. They simply need someone to respond.

What Can You Do?

You don’t need to become a cybersecurity expert to make yourself a more difficult target. Use unique passwords for important accounts, enable multi-factor authentication whenever possible, keep phones and computers updated, and be suspicious of unexpected requests involving money, passwords, or personal information.

Most importantly, slow down when something doesn’t seem right. Urgency is one of the attacker’s greatest tools. A phone call, text message, or email that pressures you to act immediately deserves additional scrutiny.

Final Thoughts

Cybersecurity isn’t just an issue for large companies, IT departments, or wealthy individuals. Nearly everyone has something of value to a cybercriminal.  Your money has value. Your identity has value. Your accounts have value. Your relationships have value. And your access has value.  You don’t have to be wealthy, famous, or important to attract a cybercriminal’s attention.

You don’t have to be important to a cybercriminal. You just have to be useful.