Soon-to-be parents want to share the excitement and joy they’re feeling with those they know and love. In the connected world we live in, that sharing now often takes place online. For a safer experience, think through and apply a few key safety principles before posting information about an upcoming birth in such baby registries as BabiesRUs, Amazon Baby Registry, and Walmart Baby Registry.
How criminals gather information from registries
Here is a simple walkthrough to show you how a criminal might collect information:
Note I’ve used Babies ‘R’ Us registry as the example because it exposes parents and babies to the most risk, primarily because it has more fields that can be filled out. That said, the problems illustrated below apply to any of the popular baby registry sites.
A search on “Taylor” yielded hundreds of full names of both parents, the baby’s due date, and the following useful information:
- The mother and father’s full names, mother’s maiden name, and the city and state where the family lives. Given this info and one lookup in an online directory, I found their address, phone numbers, cost of homes in their area, names of their neighbors, etc. in just 20 seconds. An additional click and I had a map with driving directions to their home.
- The baby’s due date tells anyone when the house will be most likely be empty—useful information for thieves who may want to steal the new baby equipment or other valuables. The information begins a lifelong portfolio of data on this little girl that she won’t have privacy control over.
When you click the parent’s registry number, you get even more detail (as shown below) such as the baby’s gender, grandparents’ names, and of course, what’s been requested and bought.
- In this case, three grandparents are listed. One grandmother is listed alone. Is she divorced? A widow? It probably means she lives alone. We know it’s her mother that’s listed singly by the last name, putting a common password authentication hint at risk—how often are has this soon-to-be mom been asked to provide her mother’s maiden as authentication? Now you know it too. Will the grandparent’s homes be empty as they go to see the new baby?
- Baby’s gender—it’s a girl! For someone looking to steal gender specific items or to steal a little girl, either for themselves or for resale, this is information is key.
- The items they’ve requested – and what’s been purchased. This not only helps thieves who are after specific items, but the prices of items also helps indicate the family’s economic bracket.
Some sites ask parents to reveal even more information.
Think about how enduring most of this information is: your names and the baby’s birth date aren’t going to change, and your address may remain the same for a long time. All this information is a valuable commodity that may be sold and resold many times to legitimate companies, or other crooks. And now, a predator has a great deal of the information they need to commit several types of crime:
- Identity theft of parents and grandparents. If the parents give the baby’s name (as they often do), they may also help an identity thief begin the process of stealing the baby’s identity as well.
- Scams targeted to new parents and grandparents such as baby, toddler, or college saving scams.
- Baby theft. Fortunately the theft of a baby is extremely rare. However, the National Center for Missing and Exploited Children (NCMEC) is concerned enough that they have created material specifically instructing parents on how to avoid the theft of their baby from the hospital and at home. See Safety Tips for Expectant Parents: What Parents Need to Know. Information posted on a baby registry site can provide information that NCMEC recommends be masked—such as where to find a new-born, the gender, etc.
What you can do
Think about what information you are really sharing, and with whom you feel comfortable sharing it because it’s naïve to believe that the only people looking at this are your friends and family.
Although site policies vary, I didn’t find a single word on any baby registry to help you use them more safely. To compensate for this lack of information, I’m making the following recommendations:
- Choose carefully what information you give. I haven’t found any baby sites that let you make your posting private or allow you to protect some of the information with a password. Remember that the less information you show, the less a criminal will learn.
- Only complete required fields; leave others blank. Unfortunately most sites require the mother’s first and last name, city and state, and the baby’s due date. If this is more than you want to share, then consider a different registry site which makes more information optional. For example, the Amazon Baby Registry asks for, but does not require, grandparents’ names and other details. (Or consider not using a registry at all.)
- Evaluate all the information you’re asked to reveal, and compare that with your comfort level in sharing it. For example, consider what information the requested gifts provide. Even if you don’t reveal the baby’s name or sex, the items you ask for—such as blue bedding—can give away the gender.
- Never post information online about anyone without their consent. Check with grandparents, aunts, uncles, or others before posting any information about them on the registry.
- Ask a friend to review your registry site for potential risks. When you’re caught up with joy and baby preparations, safety may not be at the top of your mind.
- Call the service shortly after the baby is born and request that your listing on the registry be taken down. Some sites keep information visible for more than 18 months after the baby’s due date. And since most people create these several months before the baby is due, this information could be available for at least a couple of years. So make a note on your calendar to close it. Unfortunately, you have to call because none of the Web sites let you do this online. With enough calls asking to remove information, however, companies will automate it to keep support costs down.
- Complain to the baby registry site you want to use. Highlight the missing safety features and risk notices. If enough people ask for changes, companies will provide better safeguards. You should at a minimum have the option of protecting your registry page with a password, being informed of potential risks, and getting recommendations for how to use the registry more safely.