Scams evolve at the same pace as technology. In a context in which more and more citizens use smartphones and connected devices where they store personal and banking information, cybercriminals have found new ways of acting. From the well-known phishing, where scammers impersonate organizations such as Social Security or banking entities to steal data, to more ingenious methods such as leaving a bill on the windshield, the ingenuity to deceive continues to grow.
Now, the Civil Guard has focused on a less known, but increasingly used technique: ‘dumpster diving’ or ‘trashing’. This method consists of searching through other people’s garbage to obtain sensitive information with which to start scams. As explained from the National Cybersecurity Institute (INCIBE)it is a practice that “consists of sniffing through your garbage in search of valuable information.”
The Civil Guard warns: if you receive an email in their name, do not respond, it is a scam
Negotiations begin between the Government and unions to advance the retirement age for National Police and Civil Guard agents
INCIBE itself also warns of the risks associated with this technique, since it can facilitate serious crimes: “They impersonate your identity,” “they steal money from your account” or even “they commit crimes in your name.” All this starting from something as everyday as a poorly managed garbage bag.
In this context, the authorities remember that today the mobile phone functions as an extension of our lives: in it we store personal data, access to bank accounts, emails and important documents. This concentration of information turns any oversight into an opportunity for criminals, who can act remotely and with little risk of being detected. Therefore, it is not strange that they also look for clues outside the digital environment, even in household trash.
How the trashing scam works
‘Trashing’ or ‘dumpster diving’ consists of reviewing waste, both physical and digital, in search of documents or devices that contain confidential information. Invoices, written down passwords, bank statements or any seemingly harmless piece of paper can become the gateway to fraud.
“Cybercriminals search our physical or digital trash for any type of document that we may have carelessly thrown away, such as passwords or card numbers, and thus be able to obtain all our information,” the authorities explain on their TikTok channel.
“Through these methods they use all our data to carry out a cyber attack. Therefore, always make sure to properly destroy all your personal documents when you are going to get rid of them.”
In addition, cybersecurity experts warn that deleting files or throwing away documents is not enough. “Deleting files from a device or throwing away documents with private information is not enough, it is necessary to use secure mechanisms for their elimination.” Even seemingly deleted files can be recovered if they are not deleted properly.
What scammers look for in your trash
Criminals do not need large amounts of information to start a scam. Small data is enough for them, which they then combine with other techniques. Among the most coveted items are bank statements, receipts, contracts, copies of ID, medical prescriptions, addressed envelopes or shipping labels from online purchases.
They also pay attention to discarded electronic devices, such as hard drives, cell phones or USB drives. If they have not been securely deleted, they may contain recoverable information. In fact, INCIBE recommends that before throwing away any device, specific secure deletion tools be used, since, otherwise, “your files could be recovered.”
The most common consequences of this type of fraud are identity theft and associated crimes, such as unauthorized purchases, credit applications or fraudulent transfers. In many cases, cybercriminals supplement information obtained in the trash with phishing attacks or other digital techniques.
For this reason, both the Civil Guard and the experts insist on not underestimating the information that is discarded. Anything from a simple letter with a name and telephone number to a label on a package can be enough to initiate an attack. The recommendation is clear: always destroy sensitive documentation before throwing it away and take extreme precautions with any medium that contains personal data.