Why you should not store in the memory of the phone intimate photos and a copy of the passport

Images of passport, SNILS, TIN and driver’s license – these data can be used to access accounts, create fakes and fraud. Such documents are best stored in secure cloud services with two-factor authentication.

Intimate photos are also dangerous when leaked – they can become a tool of blackmail and extortion. They are recommended to be stored in closed cloud folders with a password or removed from the phone.

You should not send passwords from social networks, mail and banking applications to messengers, store them in notes or a browser: if you steal a phone, attackers will have access to important services. For passwords, it is better to use special managers or store them offline.

Also, you should not save card numbers, PINs and addresses in personal and business correspondence – attackers study them first. Such messages should be deleted immediately.

It is also necessary to clean up bank messages about cash receipts, transfers and balance sheets, as they reveal financial habits and income levels.

It is recommended to remove unnecessary contacts, the most important of them to transfer to a secure backup. Do not store personal information in contact notes – otherwise, if you lose your phone or access it, attackers will be able to use this data for phishing and social engineering.

More about this “MK” told the expert on cybersecurity Igor Bederov:

Contrary to popular belief, hacking a phone remotely, as in Hollywood movies, is a non-trivial task and requires either unique zero-day vulnerabilities (unremedyed vulnerabilities or malware against which defense mechanisms have not yet been developed), or targeted work of special services. Mass fraud works differently. Physical access is the simplest and most common scenario. Left the phone on the table in a cafe, in the office, let a stranger or even a friend see the photo - and the gallery becomes an open book. The unlock password is often either missing or selected by obvious combinations. Social engineering is a more dangerous and sophisticated method. An attacker can call, introduce himself as an employee of a bank or police and, under plausible pretext, ask to send a passport photo “for verification” or dictate a code from an SMS. Or create a fake page in the social network, where under the pretext of participating in the competition, you are asked to upload a photo of a document. As for malware and phishing applications. Here the user downloads a seemingly harmless flashlight or photo editor, and with it - a Trojan that receives wide permissions to access the file system and gallery. This is especially true for applications downloaded from third-party sources, not from official stores. Finally, cloud vulnerabilities. If the cloud is protected by a weak password, which is used on other services, or if two-factor authentication is not connected to it (confirmation of login via SMS or an authenticator application), an attacker will get access to the entire synchronized gallery.