Your favorite Facebook quizzes may be stealing bank details

We’ve all seen these quizzes pop up in our Facebook and other social media: “Which 90s sitcom character are you?” or “Find out stripper your!” While these social media quizzes may seem like innocent fun, they actually operate as a massive phishing network. That’s the warning from Yegor Sak, the founder of Windscribe. According to Sak, these personality tests are carefully designed to collect the exact answers that financial institutions use to verify your identity.

The success of these quizzes is based on psychology , not advanced hacking techniques. The questions are cleverly disguised to disarm your natural distrust. “If a stranger approached you on the street and asked you your mother’s maiden name, your first pet, and the street you grew up on, you would walk away,” Sak explained. “But if those same questions were incorporated into a ‘What 90s sitcom character are you?’ quiz, people are typing the answers into a database belonging to someone they will never meet.”

See also: Facebook: New AI mode draws information from public posts

This phenomenon is not just a theoretical threat. In 2020, a major investigation by the UK’s Information Commissioner’s Office (ICO) confirmed that personality apps on social platforms were collecting data from tens of millions of users, many of whom had no idea their details were being collected. This shows that the threat is real and widespread, affecting millions of people who think they are just having fun on Facebook.

Sak describes each completed quiz as “a credential reset for a stranger.” Asking directly about their mother’s maiden name puts people on the defensive, but asking about a funny combination of their first pet and their father’s street name elicits laughter. “Same data. One feels like an interrogation. The other feels like a game. That gap isthe attack surface,” Sak said.

See also: Check Point VPN zero-day: How to protect your corporate VPN

Collecting this data is not only a privacy violation , but can have serious security implications for users. The information collected through these quizzes can be used to bypass knowledge-based identification processes , such as those used by banks and other organizations to protect their customers' accounts.

This means that attackers can gain access to sensitive information and carry out fraud, using the answers that users have innocently given in a seemingly harmless Facebook quiz.

So how can you spot a Facebook quiz trap?

Sak says the danger lies in the type of information being asked. “Any quiz that asks for a name plus a memory is a red flag,” he warned. “First pet, first car, first school, the street you grew up in, mother’s maiden name, favorite teacher. If a quiz collects four or five of those in one round, it’s not a personality test. It’s a security questionnaire.”

Sak's advice for dealing with this threat is simple but effective: lie. A compromised password can be changed in seconds, but the name of the street you grew up on cannot. Using false answers can protect users from having their personal data exploited. This way, users can continue to enjoy the social media experience without compromising the security of their personal information.

See also: Microsoft's new Xbox CEO rethinks exclusive games

If you've ever taken one of these quizzes, you should immediately update the security questions on your bank and email accounts. Treat the answers like a secondary password by using random, imaginary answers.

Raising awareness around these issues is critical. Users need to be aware of the risks posed by Facebook quizzes and take precautions to protect their data . Organizations, for their part, should strengthen security procedures and educate users about the threats posed by seemingly innocent activities on social media.

With proper information and caution, we can reduce the risk and protect the security of our personal data.