Public information can help an impersonator build a believable story. A job title, supplier announcement and travel photo may reveal enough context to make a request feel familiar. The risk comes from combining details, so review both what you publish and how your team verifies sensitive instructions from apparently known people.
01
Look at combinations rather than isolated facts
One public fact may be necessary for business, while several together reveal relationships or timing. A staff directory identifies roles; a conference post identifies absence; a vendor announcement identifies a plausible sender. Review these combinations from a defensive perspective without collecting unnecessary personal dossiers about employees or their families.
02
Keep verification independent of public knowledge
NIST's phishing guidance encourages checking suspicious communications through trusted methods. Do not use public biographical facts as the only test of identity. If a request changes account access, payment instructions or confidential distribution, confirm it through an established channel that the message itself did not supply. Accurate context is not the same as authorization.
- Delay public travel details when real-time timing is unnecessary.
- Remove personal contact data from business pages when avoidable.
- Review staff posts for unintended schedule or document exposure.
- Teach teams to verify actions, not merely recognize names.
03
Example of a convincing supplier message
A company announces a new supplier. Soon afterward, finance receives a message requesting revised payment instructions and mentioning the announcement. The details are plausible because they are public. Finance should use the existing vendor-verification procedure rather than treating knowledge of the relationship as proof that the request is genuine.
Frequently asked questions
Should we remove every staff biography?
Not necessarily. Public expertise can serve a legitimate purpose. Keep useful professional facts while reducing unnecessary personal details and ensuring sensitive requests still require proper verification.
Can privacy settings replace staff training?
No. Settings can limit some exposure, but public records, legitimate announcements and compromised accounts may still provide context. Combine sensible sharing boundaries with a repeatable process for checking unusual instructions.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.