Swatting
Threat level: life-threatening
Swatting is a false report of a serious emergency - such as a hostage situation, shooting or bomb threat - made to
trigger an armed police response at a victim's address. The caller hides behind spoofed numbers or online calling
services. The goal is to frighten, humiliate or harm the target, often live on stream.
1Real risks
- Physical danger. Officers arrive expecting an armed threat. Misunderstandings in those first seconds have led to serious injuries and deaths.
- Trauma. Victims and families - including children and neighbours - often experience lasting fear and anxiety.
- Wasted emergency resources that real emergencies in the area may be missing.
2Who is targeted
- Streamers, gamers and content creators with a public audience.
- Journalists, politicians, judges and activists.
- Schools, universities, hospitals and places of worship.
3Warning signs
- Your home address, family names or photos of your house are posted online.
- Threats like "watch what happens next" or mentions of police after a dispute.
- Fake food deliveries, taxis or service visits you never ordered - often a test run.
4How to protect yourself
- Hide your location. Never show mail, windows, landmarks or your street on stream or in photos. Strip location data from images.
- Remove your address from people-search sites, data brokers and public domain (WHOIS) records.
- Talk to your local police. Use the non-emergency line to explain that you could be a target. Some areas offer registries or premise notes for exactly this.
5If police arrive at your door
- Stay calm and visible. Keep your hands empty and where officers can see them.
- Follow every instruction. Move slowly. Do not run, reach for pockets or argue in the moment.
- Say it simply. Once it's safe, explain calmly that you believe this is a false report.
- Take care of others. Secure pets and calmly guide children and other residents.
6Who to contact
- Immediate danger: contact your local emergency services right away.
- After the incident: file a report with your local police and ask for the case to be investigated as a false emergency report.
- United States: report to the FBI at tips.fbi.gov or the Internet Crime Complaint Center (IC3).
Doxing
Threat level: high
Doxing means collecting and publishing a person's private information - real name, home address, phone number,
workplace, family members - without consent. It is often used to intimidate, to encourage harassment by others, or
as a first step towards swatting and stalking.
1Real risks
- Harassment moving from online spaces to your doorstep, workplace or school.
- Threats against family members, employers or neighbours.
- Increased risk of swatting, stalking and identity fraud.
2Warning signs
- Strangers mentioning details about you they shouldn't know.
- Your name appearing in forums, paste sites or group chats.
- Sudden contact from unknown people on several platforms at once.
3How to protect yourself
- Search yourself regularly - name, usernames, phone and address.
- Opt out of data brokers and people-search sites, and repeat every few months.
- Use different usernames for gaming, social media and professional profiles.
4If you are doxed
- Document first: screenshot posts with URL, date and username before reporting.
- Report to the platform - almost all ban sharing private information.
- Tell people close to you to ignore unexpected requests about you.
Phishing
Threat level: most common
Phishing uses fake e-mails, texts (smishing), calls (vishing) or websites that imitate banks, delivery services,
employers or friends. The aim is to make you click a link, open a file, share a code or send money. Modern phishing
is often personalised with data from earlier breaches - and increasingly with AI-generated text and voices.
1Real risks
- Stolen passwords and full account takeover.
- Direct financial loss through fake invoices or "bank" transfers.
- Malware or ransomware on your device.
2Warning signs
- Urgency or fear: "account suspended", "final notice", "act within 24 hours".
- Sender addresses or links that are slightly off (rn instead of m, extra words, odd domains).
- Requests for passwords, one-time codes, gift cards or crypto.
3How to protect yourself
- Never use links in unexpected messages. Open the app or type the address yourself.
- Use a password manager - it won't autofill on a fake domain.
- Prefer passkeys or authenticator apps over SMS codes.
4If you clicked or replied
- Change the password of the affected account immediately - and anywhere you reused it.
- Call your bank right away if you shared payment details or sent money.
- Sign out of all sessions and check recovery settings and mail forwarding rules.
Identity theft
Threat level: high
Identity theft happens when someone uses your personal information - name, date of birth, ID numbers, bank or tax
details - to pretend to be you. It is often discovered late, when a bill, debt collector or credit refusal arrives.
1Real risks
- Loans, credit cards or phone contracts opened in your name.
- Damaged credit score that blocks mortgages or rentals.
- Fraudulent tax returns, benefits claims or medical records.
2Warning signs
- Bills, parcels or letters for accounts you never opened.
- Unknown entries on your credit report.
- Your phone suddenly losing signal (possible SIM swap).
3How to protect yourself
- Check your credit file. In Germany request your free SCHUFA data copy (Art. 15 GDPR) once a year; in the US freeze your credit at Equifax, Experian and TransUnion - free and reversible.
- Add a carrier PIN to stop SIM swapping.
- Share ID scans only when legally required, and watermark them with the purpose and date.
4If it happens
- Contact the affected companies and dispute the fraudulent accounts in writing.
- Report to police and keep the reference number - banks and bureaus often need it.
- United States: create a recovery plan at IdentityTheft.gov.
Cyberstalking
Threat level: high
Cyberstalking is repeated, unwanted contact, monitoring or intimidation through digital means. It is frequently
carried out by someone the victim knows - such as a former partner - and may involve hidden tracking apps,
location tags or access to shared accounts.
1Real risks
- Constant fear and loss of privacy, affecting work, health and relationships.
- Escalation to offline stalking or physical violence.
- Sharing of intimate images or private messages.
2Warning signs
- Someone knows where you are or what you said in private.
- Unknown Bluetooth trackers detected near you or on your car.
- Unfamiliar apps, fast battery drain or settings you didn't change.
3How to protect yourself
- Review shared access: location sharing, family plans, cloud accounts and linked devices.
- Change passwords from a device the other person never had access to.
- Use your phone's built-in safety check and unknown-tracker alerts.
4If it is happening to you
- Keep a log of every incident with date, time, platform and screenshots.
- Plan for safety first: removing a tracker can alert the stalker - talk to a support service before acting.
- Report to the platform and to police; ask about protection orders.
Data breaches
Threat level: widespread
A data breach occurs when an organisation's systems are compromised and customer data is exposed. Stolen records are
sold, traded and combined - and then used for credential stuffing, phishing, doxing and identity theft. You can't
prevent a company from being hacked, but you can limit the damage.
1Real risks
- Credential stuffing: leaked passwords are automatically tried on hundreds of other sites.
- Highly convincing phishing that quotes your real data.
- Exposure of addresses and phone numbers that enables doxing.
2Warning signs
- Breach notification e-mails from a service you use.
- Login alerts from unknown locations or devices.
- A sudden rise in spam or targeted scam messages.
3How to protect yourself
- Unique password for every account - a breach then stays contained.
- 2FA everywhere, starting with your main e-mail.
- Use e-mail aliases for shops and newsletters.
4Check & respond
- Run our breach check to see which leaks include your address.
- Change passwords for every affected service and anywhere you reused them.
- Follow the tailored steps shown with your results.