What Is Doxxing? How It Works and How To Prevent It

Even if you are careful about what you share online, your private information can often be found on other websites or learned by a hacker with a socially engineered phishing email. Doxxers take this personal data and share it online without your permission.

Doxxing can happen to anyone, but there are steps you can take to protect yourself against this threat.

 

What is doxxing?

Doxxing (also spelled "doxing") occurs when someone publicly shares your personal information on the internet. People can acquire these pieces of information with the following tactics:

• Searching public records and databases
• Looking at your social media profiles
• Hacking accounts
• Purchasing data like contact information on the dark web
• Sending a phishing email

Doxxers may target you or even your family members to learn and share your IP address, home address, phone numbers, financial information, Social Security number (SSN), or other details. A doxxing attack is designed to harass, intimidate, or embarrass the victims.

Many people use usernames to cover their real identity for privacy reasons. Doxxing is often a form of online harassment since it works to reveal a person's identity and expose them to further cyberbullying.

What is swatting?

Swatting is a type of doxxing and happens when someone makes a false report to trick law enforcement into going to an innocent person's house. The harassers sometimes make elaborate falsehoods, e.g., a hostage situation or gunfire, to try to send heavily armed Special Weapons and Tactics (SWAT) teams, hence the term "swatting." 

This type of harassment is a crime since it wastes law enforcement resources and creates an environment of fear.

How doxxing works

We put a lot of information on the internet — social media posts, selfies, and public comments are just a couple of examples. But people are often unaware of data brokers and people search sites that collect publicly available and personal information about people and then share it on their websites. 

Anyone can learn your personal information if they take the time to do the research or if they use a handy AI scraping tool to aggregate your data profile. If they are tech-savvy, they might even create sophisticated cyberattacks to glean more information from you.

Here are a few ways doxxers can gather personal information:

• Tracking the same username across multiple social media accounts
• Running a WHOIS search on a domain name
• Sending a phishing email to learn the login credentials of your email account
• Looking through government documents, e.g., voter registration
• Tracking IP addresses to learn your geographical location
• Searching for information on data broker sites
• Intercepting data sent over a public network

Is doxxing illegal?

It depends. Sometimes doxxing uses legal methods to learn personal information, but if it was obtained through illegal methods like hacking, then it could be a crime. 

Doxxing may be considered harassment, stalking, or threatening, which could mean police involvement. It will depend on your local jurisdiction's laws.

How to prevent doxxing

Doxxing attacks are stressful, but there are plenty of techniques to minimize the chance of someone exposing your data online.

1. Be careful what you share online

In the age of social media, people are used to posting about their big life events or what they had for breakfast. If you allow people outside your network to see your posts, it can increase the risk of getting doxxed.

For example, if a security question for one of your accounts is "Where did you go to high school?" and you have publicly posted online about where you went to school, this makes it easier for a hacker to access your account.

2. Update your privacy settings

Doxxing often uses what you have posted online. Take a look at all of your social media profiles, including those you no longer use (like that personal blog from eight years ago). Then evaluate what content you share and if it needs to be publicly available.

For example, you may use Twitter for personal branding and interacting with your colleagues. In this case, you may want to keep your profile public and ensure your content is professional. Personal content, like the photos of your latest family vacation, may be better off on a private Instagram account. 

Every person's needs vary, so take the time to consider what you want, then change your privacy settings accordingly.

3. Use different usernames and passwords

Good password habits include using strong passwords for all accounts. If you consistently use the same password, it opens the door for a hacker to access all your accounts. You may want to consider using a password manager to store your passwords securely, so you don't have to remember them all.

Like passwords, we often use the same username across multiple accounts. Usernames are often publicly shown, making it easier for a doxxer to track you across multiple platforms. You may want to consider using different usernames and avoid using your real name to make it harder to track you.

4. Use a VPN on public Wi-Fi

A virtual private network (VPN) creates a private internet connection. It's useful for masking your IP address and geographic location. It's especially valuable if you are connected to a public Wi-Fi network. Hackers can easily hijack the connection and view your online activity. A VPN prevents this by encrypting your online traffic.

5. Use an identity theft protection service

An identity theft protection service can monitor databases to see if they contain new or inaccurate information about you. Before investing in a service, you may want to check whether your credit card provider, bank, or insurance offers identity protection. They may be able to alert you to suspicious activity. 

You may also want to request fraud alerts from national credit bureaus like Equifax, Experian, or TransUnion.

6. Use antivirus software

Sometimes, doxxers can gather your sensitive information through malware or phishing scams. Using up-to-date antivirus software can help block these types of cyberattacks. Some antivirus programs also include identity theft protection features, such as alerts when your online accounts are compromised.

7. Request the removal of your data

Many websites and companies have your data. Take data brokers, for example. They gather information about you and then sell it to companies for marketing purposes. 

People search sites can also contain your personal information. All you need to do is enter a name, and it will return the person's address, age, possible relatives, and other private data.

Fortunately, you can manually request the removal of your data. The downside is that it usually takes a lot of time and effort. You'll also need to repeat the process regularly to avoid data brokers from rebuilding a profile on you. Many people decide to enlist the help of the best data removal companies, which specialize in removing their personal information from data broker sites. 

Are you easy to dox?

It may be difficult at first to gauge how much you've shared on the internet over the years. Especially when you consider old social media profiles you may no longer use. Here is a step-by-step guide to researching how easy it is to dox you:

• Start with a Google search. Entering your name and location could reveal a trove of sites containing personal information you don't want on the internet.
• Do a reverse image search. This can help you find your photos online. Open images.google.com in your browser. Then click "Search by image" (the camera icon) to upload a picture. You could also drag and drop an image into the search bar.
• Start auditing your social media profiles and personal blogs. Some of these may contain information you don't want to share publicly, where the wrong person could use it to exploit you. You'll want to alter your privacy settings to what works for you.
• Check if your data has been breached. Sites like haveibeenpwned.com let people search recent data breaches and see if any personal information was leaked online. Your VPN provider or password manager may also have these types of services.
• Review your online resume. Many people have posted their resumes or CVs to their professional websites, Indeed, or on LinkedIn. Take a look at it and ensure information like your phone number or address is excluded. 

What to do if you’ve been doxxed

When someone unleashes a doxxing attack on you, it's understandable to feel overwhelmed and hurt. Taking steps to report the attack and protect yourself from further damage may help your recovery. Here are a few steps to consider taking:

1. Document the attack

Collecting evidence is crucial for law enforcement and other authorities to take action against the doxxing attack. You'll want to take screenshots of where your personal details were posted. Don't forget to put the date and time in your documentation. Do this as soon as possible before the evidence is removed.

2. Report the attack

You'll want to take immediate action to report the attack and prevent your information from spreading further. Each website, forum, or platform may have different policies for reporting doxxing attacks. You may want to review the community guidelines to determine how to report the attack and request the removal of your private data.

3. Contact your local police department

Depending on the circumstances, you may want to contact your local police department. Laws surrounding doxxing aren't always clear, but if you are being stalked, harassed, or threatened, the police may be able to help.

4. Let your bank know

If your financial information was exposed, you'll want to notify your bank, credit card issuers, and credit bureaus. You may need to cancel and replace your credit cards and monitor your credit to protect against unauthorized transactions.

5. Change your passwords

You may also want to change your usernames and passwords to fight against the doxxing attack. A password manager can create strong passwords and keep them safe for you. You can take this a step further by enabling two-factor authentication where possible. This means an attacker will need to authenticate an identity twice, making it more difficult to hack your account.

6. Invest in identity theft protection and monitoring

Even if you manage to get your personal information deleted, you probably don't know who saw it and what they intend to do with it. Investing in identity theft protection and monitoring can ease the burden of constantly checking your accounts for red flags. Services like Aura offer robust identity theft protection and data removal services.

Bottom line

Personal information is easily accessible online, and doxxers can track it and build a profile on you over time. They may also use techniques like phishing to gain even more access to your data and accounts. Then they share this information online in a way that is designed to make you feel less safe.

There isn't always a legal repercussion to doxxing, and you may find it worth the effort to guard your online privacy to prevent yourself from becoming a victim. Creating different usernames across profiles, changing the privacy settings on social media accounts, and using a top VPN are easy ways to protect your data and privacy.

If you have serious concerns about data privacy, we recommend investing in a service that offers comprehensive identity monitoring and data removal. 

FAQs