The Ghost Delete Academy · Module 1, Lesson 1

How data brokers get your information, and why scammers already know your name

Free lesson · About 10 minutes · Ends with the free scan

The call that sounds real

A call comes in. The screen shows your bank's number. The caller uses your name. She says she is from the fraud department, and she can tell you which bank you use, because she already knows.

Nothing about that call is a guess.

CBC Marketplace investigated this exact scam in October 2026. In Toronto, a man named Asif Mohammed got that call, appearing to come from Tangerine, his bank. A courier later collected his debit card as supposed evidence. He lost $7,200. In England, Samantha Bradshaw got a near-identical call. The scammers who took her cards knew where she lived. She lost £11,000, nearly $21,000 Canadian.

Marketplace confronted one of the scammers behind calls like these. He told them he makes up to £5,000 from each victim, about $9,400 Canadian.

This lesson is about where he got the script. Not the words. The facts: your name, your number, your bank, your address. Those facts are for sale, and much of them are free to find. Understanding that is the start of taking them back. We retell the full investigation on the blog: The Bank Scam Starts With Your Data.

First, the plain definitions

A data broker is a company that collects your personal information and sells it or lists it where anyone can find it.

A people-search site is the public end of that business: the pages that show your name, your home address, your phone number, and your relatives to anyone who types your name into a search box.

A breach is when data a company stored about you gets exposed or stolen: names, emails, passwords, phone numbers, addresses.

Spoofing is faking the number a call appears to come from. The number on your screen can say anything the caller wants it to say.

Where brokers get it

Brokers do not steal most of this. They collect it, buy it, and trade it, in the open.

Public records. Property sales, court filings, business registrations, and in parts of the United States, voter registration lists. Your name and address sit in records that were never private, assembled by companies most people have never heard of.

The apps and programs you joined. Loyalty cards, contests, quizzes, and free apps collect what you type and what your phone reports. CBC Marketplace's App Trap investigation found one search for prenatal vitamins shared with 10 outside companies, and apps that began sending data the moment they opened. Some of that data is sold. Some is shared with partners, who share it onward. The result is the same: it travels.

Social media. What you post publicly is collected and matched to the rest: your city, your family members, your birthday, the names of your relatives. People-search pages list your relatives because the connections are published by you and by them.

Each other. Brokers buy from brokers. One company's list becomes another company's product, merged, cleaned, and resold. This is why removing yourself from one site does not remove you from the system, a fact the rest of this academy is built around.

Breaches. When a company's stored data is exposed, it joins the circulation. Breach data carries the details that make a scam call specific: which bank, which services, which email, sometimes which password. Lesson 2 covers how to read a breach. Lesson 3 shows you how to check your own.

Why this makes the scam work

A cold call from a stranger is easy to doubt. A call from someone who knows your name, your bank, and your address sounds like the fraud department doing its job.

That is the whole trick. The scammer is not more convincing than you are careful. He is better informed than you expected a stranger to be. The information did that work before he ever dialed.

It also explains the second half of the CBC story. Bradshaw's bank repaid her in full within days, because British law requires banks to make most scam victims whole. Mohammed spent months pleading and settled for part of his loss, because Canadian banks carry no such obligation. The lesson here is not about banking law. It is this: in Canada especially, the protection has to happen before the call, because after the call there may be no one obliged to make it right.

What you can do about it

You cannot uninvent the data economy, and this academy will not pretend otherwise. What you can do is shrink your listing in it.

The work comes in three kinds, and the academy takes them in order. First, learn what is exposed, starting with breaches (Module 1). Second, remove the listings, broker by broker, network by network (Module 2). Third, keep them removed, because listings come back (Module 6). Around that work sit the habits that stop the call itself (Module 3), the account locks (Module 4), and the credit rights you already hold (Module 5).

Start smaller than that. Start with the checklist below, today.

Checklist: your first 15 minutes

1. Search your own name plus your city, in quotes, the way a stranger would. Note the people-search sites that list you. You will meet them again in Module 2.
2. Search your phone number, in quotes. Note where it appears next to your name and address.
3. Run the free scan and see whether your email address has appeared in a breach. If it has, the passwords on those accounts move to the top of your list in Module 4.
4. Say the two rules out loud, once, so they are there when you need them. No bank sends a courier to collect your card. If a call claims your card is compromised, hang up and dial the number on the back of the card yourself.
5. Tell one person in your family what you learned. The family drill turns this into a rehearsed plan.

The honest line about doing it yourself

Everything in this academy can be done by hand, for free, and the free lessons will show you how. What doing it yourself cannot do is make it fast or make it permanent: the biggest brokers alone take most of a day the first time, and removed listings commonly come back within 60 to 90 days as brokers buy fresh data. Removal is maintenance. This academy teaches the maintenance. Whether you keep doing it yourself or hand it over is a decision for the last lesson, made with the numbers in front of you.

Next lesson: What a breach is, and how to read one.

Be a Ghost.

Lesson sources: CBC Marketplace, "Same scam. 2 countries. Why Canadians don't get their money back", David Common and Nelisha Vellani, October 23, 2026, and "The App Trap" investigation, summarized and credited here; the full retelling is in Module 3. Broker collection practices as documented in the Ghost Delete DIY removal guide.