Say someone has your phone number and a photo of you. How much scamming or identity theft or mischief can be done with just those two things alone?
Not clear what the “rules” are here.
If forced to knowing only those two things then the only scams are the ones where someone calls the number and tries to get money someway.
But given a phone number, there are services for money that will provide an incredible amount of knowledge about whoever is associated with that number. (They can often find the account owner name, address, email, etc. via unethical phone provider employees if the name is not public.)
And then any usual scam can be run at will.
If they don’t want to pay then public lookups of the number can sometimes tell more. Reverse image lookup can work if that same photo is posted online.
Once you have a name and a location, social media may well give a great deal of information which can be used in different ways to scam an individual.
If the phone number has a listed address, or the address is found thorough back channels as ftg suggests, then the scammer can visit the address. If it is an apartment, they can stake it out and wait for the occupant to throw out their trash with additional information needed for a future scam. If a house, they just wait until trash is taken to the curb. Social media will also help if they have their accounts poorly locked down.
Once you have the name, you can also run a background search on the individual for a small fee. You can also go to the country courthouse or use LexisNexis and look up legal and mortgage information on the individual. Each piece of the puzzle can be used to get more pieces…
LexisNexis is now incredibly picky about allowing public records access (as opposed to just newspaper searches), because even though they are in fact public, they feel they have liability if someone uses the records for nefarious purposes.
Cite: My experience last week when LN sent a third-party site inspector to confirm that the company is real, that it occupies the address given, and that we have a separate locked office onsite where LN will be used.
In my job I regularly deal with the Privacy Act, PIA, SORN and a host of other government privacy acronyms. Taking your post at face value, using publicly available (and free) online searches (not from the so called “Deep web,” either), I could steal your identity where I can buy quite a few things in your name, mess up your insurance, ruin your credit rating, ruin your medical history, get you fired from your job, get you arrested, and make you lose sleep for a long time (because the FTC says it takes, on average, ten years to clear your name after identity theft).
No matter how much I advocate with my coworkers, many just don’t listen.