Every few days, one of my Facebook friends posts something like this, filled out with their own answers, and invites everyone to copy, paste, and do the same. It looks like harmless fun. It is not harmless fun. It is a phishing operation dressed up as a chain letter, and the fish are your mother.

The Quiz

In case you have somehow avoided these, here is a typical example. I have filled it out for your entertainment.

See those last two? If you have ever set up a bank account, recovered a password, or verified your identity over the phone, you may recognize them. They are security questions. And someone just asked you to post the answers publicly!

How the Scam Works

The quiz itself is not the scam. The quiz is the setup. Here is how it plays out.

The quizzes are designed—sometimes by bored humans, increasingly by organized fraud operations—to extract specific categories of personal information that banks, credit card companies, phone carriers, and government agencies use to verify identity. Not all at once. Nobody posts a quiz that says "Social Security number?" because even the most rabid Facebook user would notice that. Instead, the questions are scattered across dozens of quizzes over months and years, each one pulling out a few more pieces:

• Your mother's maiden name (password recovery gold)
• The city you were born in
• Your first pet's name
• The make of your first car
• The street you grew up on
• Your high school mascot
• The year you graduated

These are not random nostalgia prompts. These are literally the questions that Wells Fargo, Chase, AT&T, and the Social Security Administration use to confirm that you are you. If someone has collected your answers from three or four of these quizzes—and your Facebook profile helpfully provides your birthday, your hometown, and your relatives—they have everything they need to call your bank and become you.

The Phone Call Your Mother Gets

Here is the part that makes it personal. The fraud does not always target you directly. Sometimes it targets the people who love you.

Armed with details from your quiz answers and your public profile—places you have traveled, your general age, maybe a recent post about a trip—a scammer calls your mother. Or your elderly aunt. Or your father who is not great with technology. The conversation goes something like this:

"Hi, this is Sergeant Williams with the U.S. Embassy in London. Your son Paul has been in an accident and his wallet was stolen. He's okay, but he needs $2,000 wired immediately to cover the hospital bill and a replacement passport. He asked us to call you because his phone was damaged."

Your mother, who knows from your Facebook that you have traveled internationally, who knows you have been to the ER before, who knows your birthday and your middle name because the scammer casually drops them into the conversation to sound legitimate—your mother panics. She does not call you first because she has been told your phone is broken. She wires the money. By the time anyone has figured out what happened, the money is gone and the scammer has moved on to the next quiz-taker's grandmother.

This is not hypothetical. The FBI's Internet Crime Complaint Center logs thousands of these "grandparent scams" every year, and the personal details that make them convincing come overwhelmingly from social media. Those cute quizzes are the supply chain.

The Other Uses

Identity verification fraud is the big one, but it is not the only thing your quiz answers enable:

• Password cracking. If your password is your first pet's name followed by your birth year—and statistically, it might be—you have just handed someone the key.
• Spear phishing. A targeted email that references your actual hometown, your actual first car, and your actual favorite city is enormously more convincing than a generic "Dear Customer."
• Account recovery attacks. Most "forgot my password" flows ask you to answer security questions. If those answers are on your Facebook wall, the attacker does not need your password at all.
• Synthetic identity fraud. Your real data gets blended with a fake Social Security number to create a new "person" who can open credit cards, take out loans, and vanish. You do not find out until a collection agency calls you about a debt you never incurred.

But Paul, Your Entire Life Is Online!

Yes. I am aware of the irony. I have maintained a personal website since 1998 that documents, in considerable and sometimes embarrassing detail, my travels, my relationships, my medical adventures, my family, my opinions, and my dogs. I have written about my marriages and my divorces, my necrotizing fasciitis and my prescriptions, my first car and my first kiss. If you want to know things about me, you do not need a Facebook quiz. You need a search engine and an afternoon. Or a month. (It could conceivably take you as long to read about my life, as it's taken me to live it.)

The difference is that I have been trying for years to get someone to steal my identity, so far with no luck. Apparently, no one wants it. I choose to find this hurtful, but it probably boils down to my having an empty bank account and a negative credit score.

But more seriously: the information on my website is my choice, published deliberately, in a context I control, on a platform I own. I know what is out there because I put it there. The problem with Facebook quizzes is not that they make information public—it is that they trick people into making information public without understanding what they are giving away or who is collecting it. The fifty-seven-year-old woman in Topeka who posts her mother's maiden name, her first pet, and her childhood street in a quiz she copied from a friend does not know that three months later, a stranger in another country will use those answers to reset her email password. She thinks she is playing a game. But it is not a game.

What To Do Instead

I am not going to tell you to get off Facebook. I am seventy-four years old (have I mentioned that? It's just that it still surprises me) and I use Facebook to keep up with my grandchildren, argue about politics, and post pictures of sunsets. It has its uses. But here are a few things worth doing:

• Never fill out those quizzes. Not even the funny ones. Not even the ones your best friend posted. Especially not the ones your best friend posted, because your best friend does not know where the quiz originated either.
• Lie on your security questions. When a quiz asks for your mother's maiden name, type "Pterodactyl." When they ask for your first pet, type "Zamboni." The point of answering these phishing expeditions is not that the answer is true—it is actually intended to scam the scammers.
• Tell your parents about the grandparent scam. Specifically. Describe how it works. Tell them: if anyone ever calls claiming I am in trouble and need money, hang up and call me directly. If they cannot reach me, call my spouse, my kid, my neighbor. Do not wire money to a stranger based on a phone call, no matter how convincing the caller sounds.
• Use a password manager. If your passwords are generated randomly and stored in an encrypted vault, it does not matter how many quizzes you have filled out. The answers to your security questions are not your passwords, and your passwords are not guessable from your biography.

The Uncomfortable Truth

The reason these scams work is not that people are stupid. The reason they work is that people are trusting. They trust their friends, who shared the quiz in good faith. They trust Facebook, which allowed it to be posted. They trust that a fun little chain-letter game is just a fun little chain-letter game, because why would anyone go to the trouble of designing a fake quiz just to learn their mother's maiden name?

The answer is: because that maiden name, combined with a birthday and a hometown, is worth money. Not a lot of money per person—maybe a few hundred dollars, maybe a few thousand—but multiplied across millions of willing participants, it is an industry. A quiet, patient, profitable industry that feeds on the gap between how much people share and how little they understand about why it matters.

So the next time one of those quizzes shows up in your feed, resist the urge to play along. Or if you absolutely cannot resist, do what I did above: fill it in with jokes. Your number of hysterectomies and trips to Beta Centauri are unlikely to compromise your banking credentials.

Probably.