Keleigh Berenger, Research and Development Engineer, Surrey Centre for Cyber Security & Member of the UK Cyber Security Council's Expert Volunteer Panel

Let’s start with a story, a true one.

There was someone I knew, let’s call them X. (Because really, why would I tell you their real name or relation?)

X had just stepped into a whole new world, new job, shiny office, surrounded by some very high‑profile people. Life was good. There was even an inheritance and a bit of land involved. Everything looked picture‑perfect, which is exactly what X loved to share, through pictures. Lots of them. Mainly on Facebook. (If that platform hint gives you an idea about age… have you guessed?)

X wanted to show the world, or at least family and friends, how brilliantly things were going. But behind all the gloss, X was lonely. There’s no filter for that kind of feeling.

Then one day, A appeared, a friendly message request through Messenger. Polite conversation turned into nightly chats, laughter, and companionship. Connection blossomed. Within months, X was smitten and a year later, X was in love.

A lived in another country and wanted to send a gift, a token of love. Fancy, right? Photos of luxurious gifts flooded in. It felt exciting, flattering, real. Until a call came in from “customs.” Apparently, the package had been caught, and X needed to pay to release it.

Not knowing international trade laws or customs policies, X paid. But the amount kept growing. Every time X thought it was over, another bill appeared, always just one more.

Then came the heartbreaking moment, to keep the process going, X sold part of the inheritance. Yes, you read that right. A piece of legacy gone, all to set free these phantom gifts of love.

The cycle continued until suspicion crept in. The bank traced the accounts. The truth surfaced. A was a scammer, the “customs” calls fake, those luxury items: stolen stock images.

A year of trust and love shattered in seconds. And through it all, X had never seen A’s face on a live video, only still photos.

Love might be blind, but maybe, just maybe, we’re not blind, just digitally unaware.

Are you sharing too much?

X’s experience serves as a reality check. This wasn’t wizardry, no sophisticated malware, no data breaches. Just human emotion and social engineering, powered by oversharing.

A pieced together X’s life through posts: lifestyle, interests, emotional vulnerabilities, and that subtle air of new wealth. We call it sharing happiness. Scammers call it free intelligence.

So, let’s break this down. What really happened

Attackers understand that people rarely make decisions from logic alone, they play on emotion. In X’s case, it was love and loneliness. But others fall victim through pride (“I’d never be fooled”), frustration (“I just want this fixed”), sympathy (“they sounded genuine”), or even curiosity. During my university’s freshers fair, our cybersecurity society ran a simple experiment: a poster that read “Scan to win a prize.” That’s it. No brand name, no context. Yet plenty of students scanned without hesitation. It wasn’t about greed; it was about curiosity and impulse.

Social engineers thrive on that, they know people because they are people. They observe, predict, and personalise every move. And the more you reveal online, the easier it gets for them to figure out how you tick. That’s how harmless sharing turns into a detailed psychological dossier.

Oversharing isn’t only about posting too many selfies or status updates; it’s about unconsciously exposing patterns, emotions, and decision triggers. Each comment, like, or post adds to your digital footprint. The trail you leave behind online that quietly tells strangers who you are, what you value, and, worse, how to reach you.

What Does Oversharing Look Like?

Let’s break it down:

Active Digital Footprint: This is the stuff you choose to share. Every post, comment, review, or photo upload adds another piece to your online puzzle. Even when you believe you’re being cautious, you may be giving away more than you think.
Passive Digital Footprint: This one’s stealthier. Websites and apps quietly track your browsing habits, device details, and location, building a behavioural profile behind the scenes. Cookies, trackers, and device IDs work like invisible scribes, recording your every digital move while you scroll, shop, or stream.

When these two sides combine, attackers gain a near‑complete picture of your habits, lifestyle, and routines. Add a few public clues, like your birthday or favourite pet’s name, and they’re halfway to breaking into your accounts.

When Sharing Turns into a Security Risk

People rarely realise how much someone can learn from “innocent” posts. A simple photo of your boarding pass can reveal personal identifiers. A “can’t wait for my trip!” story tells criminals your house is empty. Your profile’s “year in review” might quietly display your location, job transitions, or spending capacity.

Consider those with a large following trying to maintain engagement. Success on social media often depends on openness: sharing travel destinations in real time, showing off new purchases, posting “inside my home” videos, or documenting daily routines. It builds trust and audience closeness, yes, but it also attracts organized criminal groups who mine these details for intelligence. Specifically, young creators can accidentally expose private information, school locations, or family travel updates in real time, effectively advertising when a home is unoccupied.

The Real‑World Consequences: Just the Tip of the Iceberg

Oversharing can expose you to far more than phishing attempts. Those are just the entry points. The deeper risks include:

Privacy breaches: Your birthday, address, or travel itinerary can be stitched together for identity verification scams.
Identity theft: Sharing financial milestones, employment changes, or official IDs gives fraudsters building blocks to impersonate you or open credit accounts in your name.
Physical threats: Real‑time location updates can signal to burglars or stalkers when the coast is clear.
Reputation damage: A tweet or post meant for friends can resurface years later, taken out of context, damaging careers or relationships.
Corporate espionage: For professionals, posting details about work projects or office environments can reveal confidential data to competitors or social engineers.
Emotional manipulation: Scammers use your online persona to mirror your values or beliefs, tightening emotional bonds that lead to targeted fraud (like what happened to X).
Targeted harassment or doxxing: Visible personal details help bad actors connect usernames, addresses, and contact info for public exposure or bullying.
Data commodification: Even harmless posts feed advertisers and data brokers who sell micro‑targeted profiles, monetising your behaviour without consent.

Now, let’s be honest, social media isn’t going anywhere. It’s how we connect, learn, and express ourselves. But as with any public space, awareness is the best defence. Your online activity tells a story. The question is, who’s reading it? And what can you do to minimize you and your loved ones becoming targets?

Staying Aware: Taking Back Control of Your Digital Life

After diving into how oversharing works, it’s clear that online safety isn’t about fear, it’s about intention. You can’t erase the internet, but you can own your corner of it. Protecting your digital footprint starts with awareness, and awareness begins with asking why.

Start with the “why.”

Before setting any privacy rule, ask yourself and your family a few grounding questions:

What values matter most to us?
Why is managing our digital footprint important?
How do we want to use social media? Connection, creativity, or validation?
How much time online actually makes us happier instead of distracted?
What kind of posts reflect who we are versus what algorithms reward?

These questions shape the “how.” Once you know your reason, here are the practical steps that follow:

1. Search yourself. Use search engines or tools to see what’s publicly visible and remove old data or forgotten accounts.

2. Audit your apps. Check which apps have access to your data using tools like ESET’s Application Audit. Delete apps you no longer use.

3. Adjust privacy settings. Review social media and browser settings regularly. Turn off location sharing and limit what third‑party services can view.

4. Post mindfully. Before posting, ask: Does this share too much? Would I say it in person? If not, maybe skip it.

5. Use security tools. Protect your data with a VPN, password manager, and MFA. Encrypt chats and prefer privacy‑focused browsers.

6. Minimize data sharing. Use masked emails and avoid signing in with social‑media accounts. Never enter credentials on public Wi‑Fi.

7. Set clear boundaries. Specifically for children. Agree within your family who to interact with online, and always verify new friend requests or followers.

8. Be a mindful user. Limit screen time and replace doomscrolling with real‑world activities. You control the feed, not the other way around.

9. Keep learning. Stay updated on cybersecurity tools and new scams. Awareness keeps you ahead of manipulation.

The Web Remembers. So Should You

Oversharing is rarely about recklessness; it’s about habit. We’ve built an online culture that rewards exposure and constant sharing. But awareness is power: every post, click, and tag becomes a choice. By balancing openness with caution, by teaching our families that privacy is an act of self‑respect, we make the digital world a little safer for everyone.

Because the truth is, the web never forgets, but that doesn’t mean you can’t decide what it remembers.