Online reviews leave a hidden ‘digital footprint’ — which fraudsters can exploit

Such data could potentially be used for targeted phishing: by finding out who a person trusts, a fraudster can more convincingly pose as an acquaintance. However, the study simulates this threat rather than proving that criminals are already using this method on a large scale.

Details

The researchers analysed data from 4,299 Yelp users in Louisiana and Pennsylvania for the year 2020. Both review texts and actual friends’ lists were available on the platform, so the researchers were able to check how accurately connections could be reconstructed based solely on behaviour.

The algorithm detected around 49 per cent of existing social connections with a 10 per cent false positive rate. If a 20 per cent false positive rate was allowed, it was possible to identify up to 63 per cent of connections.

It should be noted that this does not represent a 90 per cent ‘accuracy in identifying friends’: the false positive rate refers to the proportion of unconnected pairs that the algorithm mistakenly identified as connected.

One of the most informative indicators turned out to be the length of comments. Statistical patterns were observed among connected users: for example, long texts from one person might be paired with longer comments from another, or, conversely, with shorter comments that complemented them.

This does not mean that a single long review is sufficient to identify a specific friend. Connections are identified based on the aggregate behaviour of a large number of users.

Why this is important

Such a ‘social footprint’ can be useful for spear phishing — a targeted scam in which a criminal poses as someone the victim knows.

The authors modelled the economic appeal of such attacks and found that reconstructing a greater number of social connections potentially increases their profitability. However, no actual phishing campaigns were carried out as part of the study.

The study raises a broader issue of privacy: even if a service hides a user’s friends list, the user’s own actions may indirectly reveal their connections.

As a safeguard, the authors propose adding carefully calculated statistical ‘noise’ to the published data, which makes it more difficult to reconstruct the social network whilst preserving the information’s usefulness for analysis.

Source

Study:“When Behavioural Data Betray Users: A Diagnostic and Protective Framework Against Social Interaction Leakages”.

Authors: Yan Leng, Yijun Chen, Xiaowen Dong, Junfeng Wu, Guodong Shi.

Journal: Information Systems Research, 2026.