The pattern behind the fun
Every so often, a new prompt spreads through feeds: “Your pop star name is your first pet plus the street you grew up on,” “Post the car you drove first,” “Share the name of your school and the year you graduated.” They look like harmless entertainment, and for the most part the people posting them mean no harm. But the answers are often the same kinds of facts that organizations use to check who you are.
Think about the questions a service may ask when you forget a password: the name of your first pet, your mother’s maiden name, the street you grew up on, the make of your first car, your first school, your favorite teacher. Those are exactly the details that quizzes and challenges ask people to post. Someone who collects the answers does not need to hack anything. They only need to read.
Why this works so well for the wrong people
- The answers are public. A post on an open profile can be read by anyone, and a challenge that spreads through comments can reach people far outside your circle.
- It is easy to piece together. One answer seems trivial. Several, combined with a birth date and a hometown that appear elsewhere on your profile, can form a useful picture of you.
- It looks social, not suspicious. People tend to be more relaxed answering a friend’s post than answering a stranger’s request.
- It can run at scale. A prompt does not have to be written by a criminal to be harvested; anyone can search for a trending phrase and gather the public replies.
This is a general risk, and most quizzes will never lead to anything. But since the cost of skipping is tiny, caution is cheap. The related problem of accounts being unlocked by guessable answers is explained in the article on security questions.
Quizzes on websites and apps
Some quizzes are run by websites that ask you to log in with your social account, or to enter your email address, to see your result. Behind the scenes, the site may be collecting your profile information, your friends list or your contact details, and may keep access afterward. Sometimes the result is simply a way to build a marketing list. In worse cases, a quiz site can be a front for phishing messages that lead to fake log-in pages.
Warning signs include:
- A quiz that asks for permission to read your friends, posts or contacts.
- A request for an email address or phone number before you see the result.
- A site that has no clear privacy policy or no information about who runs it.
- A redirect to a page asking for your password.
- Pressure to share the result publicly to unlock it.
If you have already granted a quiz app access to your account, the steps for connected app access show how to review and remove it.
Challenges that ask for photos and memories
Trending challenges sometimes ask you to post a photo of your childhood home, your first day at a job, your family, your pet with its name, or your ID badge or ticket “to show how proud you are.” These can reveal where you live or work, who your relatives are and which details you use for security. A post that includes a boarding pass, a license or an access card is especially risky, since barcodes and numbers can often be read from a photo.
Joining in more safely
You do not have to avoid everything. Some practical ideas:
- Treat recovery answers as secrets. Do not post real answers to questions that sound like security questions. If you want to take part, invent a playful answer that is not true.
- Change the real answers where you can. On accounts that still use security questions, consider replacing them with random answers saved in a password manager, or use two-step sign-in instead.
- Check who sees it. If you do take part, make the post visible only to people you know, and consider that friends of friends may see comments.
- Avoid logging in with your social account to see a quiz result. If a quiz asks for permission to your profile, say no.
- Do not post documents or tickets, even cropped, unless you are sure the numbers cannot be read.
- Do not paste links from others without a pause. A challenge can be a vehicle for scams.
For families
Children and teenagers often love these prompts. Talk with them about why some answers are best kept private, and remind them that a result is not worth giving away a school name or a full birth date. The point is awareness rather than fear, and it connects to the wider idea of digital literacy.
If you shared too much
If you posted real answers you now regret, delete the post, ask friends to remove their replies if they quoted you, and change any security questions or passwords that relied on those facts. Watch for signs of trouble such as unexpected password-reset emails; the article on account takeover signs lists what to look for. If an account is hacked, the steps in hacked account response apply. Outcomes vary, and acting early generally helps.