How much of you is online? A 30-minute self-check

Before a targeted scam lands in your inbox, someone does homework. Who approves payments? Who just joined? Who reports to whom, and what does the boss sound like on a podcast? That research used to take an attacker real time and effort for each person, and AI is shrinking it.

The evidence comes from several directions. In January 2025, Google's threat intelligence team reported that government-backed groups had used its Gemini model for reconnaissance on individual experts and organizations they wanted to target, and that financially motivated criminals were using language models to support business email compromise. ENISA, the EU cybersecurity agency, reported in October 2025 that large language models are being used to automate social engineering. The UK National Cyber Security Centre said in May 2025 that threat actors already use AI for victim reconnaissance. In a 2024 academic study, a custom AI tool automated the research on each participant and built profiles that were accurate and useful in 88% of cases.

None of this means you should disappear from the internet. Most of us need a public presence for work. The aim is simpler: know what is out there, trim what helps an attacker more than it helps you, and put a check in place for the rest.

Before you start (2 minutes)

Open a private or incognito browser window so search results aren't shaped by your own accounts. Open a blank note for findings. Set a timer for 30 minutes. Each step below has a time box: when it is up, move on even if you didn't finish. You can always come back.

As you go, sort what you find into three columns: remove, limit (keep it, but fewer people see it) and keep and verify (it stays public, so you need a habit that makes it useless to a scammer).

Part 1: you (15 minutes)

1. Search yourself (minutes 2 to 6). Try your full name with your employer, your name with your city, your work email address and your mobile number. Check the image results too. Write down what a stranger learns in the first page of results.

2. Read your work profile like an attacker (minutes 6 to 10). On LinkedIn and similar sites, look at your job title, your manager, recent "starting a new role" posts and anything that says you approve invoices, manage payroll or administer a system. Those details tell a scammer exactly who to impersonate when they contact you. Note your company's email format if it's easy to guess from public posts.

3. Find your voice and face (minutes 10 to 13). List public videos, talks, podcasts and voice notes where you speak for more than a few seconds. The FTC has warned that a scammer can clone a voice from a short audio clip posted online. The FBI suggests limiting public images and recordings of your voice and making social accounts private where you can. You may decide a conference talk stays up. That's fine: put it in "keep and verify."

4. Check your personal accounts (minutes 13 to 17). Open the privacy settings on each social account. The NCSC recommends knowing who can see what you post and asking what detail is unnecessary but useful to criminals. Common ones: birthday, children's school, real-time travel posts, a public friends list and pet names that double as security answers.

Part 2: your team (13 minutes)

Do this part with a colleague if you can. Two people spot more than one.

1. Read your own website (minutes 17 to 21). Look at team pages, employee bios and contact pages. The NCSC notes that attackers use what is freely available on your website and social media to make spear phishing more convincing, and it suggests paying particular attention to what you reveal about senior people. A shared mailbox such as accounts@ often works better than a named finance person's direct address.

2. Check job ads and announcements (minutes 21 to 24). Job posts and press releases can reveal reporting lines, new hires, the software you use and who handles payments. A "welcome our new finance director" post is useful to a scammer for months.

3. Map your most visible people (minutes 24 to 27). List the five or so people an outsider could most easily identify and imitate: leaders, finance, HR and whoever runs IT support. For each, note how a stranger would reach them and what a fake request in their name might look like. CISA advises being wary of unsolicited calls or messages from people asking about employees or your organization's structure.

4. Decide (minutes 27 to 30). Pick three changes to make this week and one verification habit to agree on as a team. Write them down with a name next to each.

What to do with what you found

Most findings fall into "limit" or "keep and verify." That's normal. You can't remove your job title from the world, and you don't need to. What you can do is make sure the public version of you can't be used against you.

For "remove" and "limit":

• Delete old posts that reveal travel plans, family details or answers to security questions.

• Tighten audience settings on personal accounts.

• Replace named contact addresses on your website with role-based ones where it makes sense.

• Ask colleagues before tagging them in event photos or posting org charts.

For "keep and verify," habits do the work:

• Call back on a known number. Any request to pay, change bank details or share a login gets checked on a number you already have, never the one in the message.

• Agree on a code word. The FBI recommends families agree on a secret word or phrase. Teams can do the same for urgent payment requests.

• Write a short footprint guide. The NCSC suggests organizations develop a digital footprint policy. For a small team, half a page is enough: what roles and details are fine to post, what isn't, and who to ask.

A checklist to copy

• Searched my name with employer, city, email and phone

• Reviewed my work profile for payment, payroll or admin details

• Listed public clips of my voice and face

• Checked privacy settings on every personal account

• Reviewed our website's team and contact pages

• Checked recent job ads and announcements

• Listed our five most visible people and how they're reached

• Chose three changes, each with an owner

• Agreed one verification habit (call-back rule or code word)

• Set a reminder to repeat this in six months

Do this once with a friend or family member too. It's a calm, practical way to talk about scams without scaring anyone, and people usually find something they want to fix.

Sources

• Google Threat Intelligence Group, "Adversarial Misuse of Generative AI," Jan. 29, 2025: cloud.google.com

• ENISA, "EU consistently targeted by diverse yet convergent threat groups" (ENISA Threat Landscape 2025), Oct. 1, 2025: enisa.europa.eu

• UK National Cyber Security Centre, "Impact of AI on cyber threat from now to 2027," May 7, 2025: ncsc.gov.uk

• Heiding, Lermen, Kao, Schneier and Vishwanath (arXiv), "Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects," Nov. 30, 2024: arxiv.org

• Federal Trade Commission, "Scammers use AI to enhance their family emergency schemes," March 20, 2023: consumer.ftc.gov

• FBI Internet Crime Complaint Center, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud," Dec. 3, 2024: ic3.gov

• UK National Cyber Security Centre, "Social Media: how to use it safely," reviewed Sept. 5, 2022: ncsc.gov.uk

• UK National Cyber Security Centre, "Phishing attacks: defending your organisation," reviewed Feb. 13, 2024: ncsc.gov.uk

• CISA, "Avoiding Social Engineering and Phishing Attacks," Feb. 1, 2021: cisa.gov

Or let NimBot handle it

A footprint check is a good team habit to repeat twice a year. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.