Buying and selling personal data: Public online, discreet in real life
Although the law does not allow the purchase and sale of personal data, this activity still takes place publicly on many social networking platforms. With just a few search operations, Lao Dong Newspaper reporters can easily access a series of groups specializing in advertising and selling customer data in cyberspace.
In these groups, many anonymous accounts offer to sell data files containing phone numbers, addresses, occupations, financial capabilities, needs to buy houses, buy cars, borrow capital... Even, the data is classified by age, income, living area and consumer needs.
In the role of the owner of a private clinic specializing in treating bone and joint diseases who is looking for customers to market services, a reporter from Lao Dong Newspaper contacted many intermediaries specializing in advertising personal data on social networks.
An anonymous Facebook account named "Shaco829" introduced itself as a data provider of elderly people to reporters. According to this person, customer files have been pre-classified by age, need and interest area.
For middle-aged and elderly customers who need health care, especially related to bone and joint diseases, data sources are always available to serve product and service marketing activities.
The offered price ranges from 400 - 800 VND for each personal data, depending on the update time. The seller affirmed that he can provide a list of customers aged 45 and over, which is mainly concentrated in the age group from 65 - 70 according to the buyer's requirements.
The exchange process shows the seller's high caution. With new customers, direct meetings are almost not accepted by the seller.
According to this person, only after many transactions and gaining trust, can the two sides exchange directly to limit the risk of being detected by functional agencies.
We sell data, which is a violation of the law. Now the police regularly disguise themselves and infiltrate to detect transactions of this type, so they don't dare to meet customers directly to finalize applications. Even sitting in public places to discuss data trading is already very risky. Just transact with each other a few times, if there is trust, you can meet directly later," the seller said and refused to meet because he was afraid of being detected by functional agencies.
When reporters expressed doubts about the data quality, this account immediately sent a series of images believed to be previously completed transactions, and offered to sell a package of 1,000 phone numbers with customer information for 500,000 VND.
The seller also admitted that the data quality is not completely uniform and there is no such thing as all information being absolutely accurate. According to this person's explanation, to assess the actual effectiveness of a data file, buyers need to contact the entire list instead of just checking random cases to achieve optimal results.
Continuing the recording process, reporters noticed a common point in the personal data trading points is high vigilance. Transactions almost do not take place directly. The owner of customer data files only appears when working with long-term partners or introduced by acquaintances, ensuring a certain level of trust.
Strictly control the recruitment of data analysis staff
Notably, not only is data trading carried out discreetly and without revealing identities, but even the recruitment of personnel to serve this field is also tightly controlled.
Candidates who need to find jobs related to processing and analyzing customer data are unlikely to have the opportunity to directly contact the recruiting unit if they have not gone through the personal profile verification process.
To clarify the recruitment method as well as the nature of the job behind the attractive invitations on social networks, a reporter in the role of a job seeker contacted a Facebook account named "Kim Thien", who regularly posts recruitment information for the position of "data analyst".
On data groups such as "Super-Quality Data", this account posts recruitment information with salaries ranging from 9 to 11 million VND per month. The job content is introduced quite professionally, including collecting, processing and analyzing financial - business data, and building reports according to business requirements.
However, through the exchange process, the actual work mainly revolves around processing existing customer information files, classifying data by target groups and behavioral characteristics to serve telesale, marketing and sales activities via telephone.
The recruitment representative said that candidates do not directly participate in data collection. Instead, the recruitment unit owns its own data source, and the employee's task is to analyze, screen and allocate customers to appropriate groups to serve commercial exploitation needs.
When reporters expressed their desire to come directly to the business to learn about the working environment and participate in interviews, the recruiting side did not accept immediately but requested to send personal applications first. Only candidates who passed the application screening round were contacted to arrange interview and meeting schedules.
Personal data is a dangerous link in online fraud
Faced with the reality of publicly trading personal data in cyberspace, Senior Lieutenant Colonel, Dr. Dao Trung Hieu - Member of the National Cyber Security Association - said that this is a particularly worrying issue, posing many risks to the security and safety of people.
According to Mr. Hieu, the danger is not only in the fact that personal data is collected and exchanged illegally, but also in the fact that a "underground market" has been formed with full links from collection, brokerage, valuation to data trading and use.
Personal data is associated with the identity, habits and important information of each person. When possessing these data, bad actors can easily research, analyze and build fraud scenarios suitable for each victim.
If in the past, fraudulent calls were mainly made randomly with a low success rate, now, thanks to personal data, subjects can reach the right people, the right needs, thereby building trust right from the first contacts. This makes fraudulent acts increasingly sophisticated and difficult to recognize.
Notably, personal data is not only traded in raw form but also classified and screened by customer groups and purposes of use. When these processed data sets fall into the hands of criminals, they can quickly build highly accurate fraudulent scenarios, significantly increasing the risk of success.
According to Dr. Dao Trung Hieu, the nature of this activity is not simply illegal data trading but also indirectly assisting in illegal acts. The consequences do not only stop at cases of fraud and appropriation of property but can also lead to impersonating individuals to open bank accounts, register phone SIMs, establish businesses or carry out other illegal transactions.
Mr. Hieu emphasized that many serious consequences in cyberspace today all stem from the fact that personal data is leaked and illegally exploited right from the first stage.
How are customer data exploited in the holiday contract fraud ring?
Regarding the case of fraudulently selling vacation contracts that caused public uproar recently, one of the issues that many people question is why the consulting team of travel companies clearly understands the information and financial capacity of each customer?
Regarding this case, the Investigation Police Agency of Ho Chi Minh City Police is expanding the investigation into the case of 11 tourism companies accused of hiding behind selling vacation contracts to defraud.
One of the key contents to be clarified is the origin of customer data that businesses use to access, filter and lure victims.
Notably, according to initial investigation results, customer data was collected from many different sources, mainly through sales activities on social networks and closed groups.
After having data, the telesale department of these businesses will classify customers according to their financial capacity, continuously calling to invite them to participate in gratitude programs, free travel or receive gifts to serve the purpose of fraudulently selling products for vacation ownership.
