New research suggests scammers may be able to exploit something many people do with good intentions: posting online reviews.
Here's what to know
As Phys.org reported, researchers at UT Austin's McCombs School of Business found that public reviews can reveal clues about social connections, raising the cyberattack risk for both reviewers and others in their networks.
The paper examines spear phishing, an email scam that works by impersonating someone the recipient already knows and trusts. The aim is usually to get the target to send money or hand over confidential information, including passwords or bank account details.
What makes the findings notable is that the exposure can come from seemingly routine and helpful behavior. Reviews written to support businesses or to inform other customers may also provide attackers with details they can use to make scam messages appear believable.
Credibility is often what makes a scam effective. If a message appears tied to real relationships, habits, or preferences, it can be much harder to spot than a generic spam email.
More background
Spear phishing is more targeted than the average scam email. Rather than sending the same message to thousands of people, attackers craft emails around specific details that make a target feel familiar and safe.
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
Online reviews can add to that profile in subtle but significant ways. A post about a favorite business, a frequent visit, or a shared experience can suggest where someone spends time, what matters to them, and who they may be connected to online.
What can be done?
People do not necessarily need to stop supporting businesses online, but they may want to be more careful about what they share. Keeping reviews focused on the product or service, rather than including unnecessary personal details, can help limit what strangers can learn.
It can also help to avoid publicly naming friends, coworkers, or family members in reviews or related comments. The less social context a scammer can gather, the harder it becomes to impersonate a trusted contact convincingly.
Beyond reviews, basic digital security remains important. Be cautious with unexpected emails, especially those asking for money, login credentials, or urgent action. If a message appears to come from someone you know, verify it through a separate channel before responding.
Using unique passwords and enabling multifactor authentication can also reduce the damage if a scammer does break through.
Where can I learn more?
This risk is part of a bigger pattern. Scams often succeed by hijacking trust, whether that means using artificial intelligence to sound convincing, preying on people during a crisis, or leaning on messaging that makes something seem safer than it is.
• Experts warn that growing misuse of artificial intelligence is making online deception harder to spot.
• In California, a disturbing scam that plagued Eaton Fire victims showed how quickly fraud adapts.
• In one case, scammers allegedly targeted a widow after her husband died, using details tied to his obituary to pressure her into sending thousands of dollars.
Each of these stories shows that once trust is manipulated, people can be pushed into decisions they would not otherwise make. That is also what makes phishing built on everyday online behavior so effective.
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
