Protecting your Privacy When you Enter Competitions

Not too long ago I got a phone call from someone who knew my name. They sounded professional, had a believable reason for calling, and were very keen for me to confirm a few details.

I didn't give them anything new, and the call ended pretty quickly.

It took me a while afterwards to work out where they may have got my number. The likely source was a competition I'd entered years earlier and had completely forgotten about. My details had ended up in a marketing database which was later compromised.

The information the callers had wasn't especially secret, but it was enough to make the call sound more convincing. They already knew who they were supposedly talking to and the brand of the competition I entered.

What bothered me most was that I hadn't entered some obviously dodgy giveaway. It had been a real competition from a real company. The competition finished years ago, but my information had lasted much longer than the prize did.

That's something worth thinking about if you enter competitions regularly.

Your entries leave a trail

Most competitions don't ask for particularly sensitive information. Usually it's some combination of your name, email address, phone number, postcode and perhaps your date of birth.

Individually, most of that might not seem especially concerning. Your date of birth is a little different, but the bigger issue is how much information a regular comper can hand to different organisations over the years.

Some promoters will only use them to administer the competition. Others may also use them for marketing, add you to a mailing list or share information in ways described in their privacy policy and terms.

And once the competition is over, you don't really know how long all of those databases will continue to exist.

That doesn't mean you should stop entering. I certainly haven't. I just try not to give every competition my everyday contact details by default.

A separate comping email is probably the easiest win

If you enter a lot of competitions, having a separate email address for them is useful even before you start thinking about privacy.

It keeps newsletters and competition mail away from your normal inbox, makes it easier to keep an eye out for winner notifications, and means the address you're handing to dozens of promoters isn't the same one you use for more important accounts.

There's another small advantage too. If a message claiming to be from your bank suddenly arrives at the email address you only use for competitions, you've got a fairly good clue that something isn't right.

I wouldn't make the account disposable, though. You still need to monitor it properly. A dedicated address isn't much use if a genuine winning email sits unread for a month.

You don't have to fill in every box

It's easy to get into the habit of filling out a competition form from top to bottom without really thinking about it.

If something is optional, I'll generally consider whether there's any reason the promoter actually needs it. An address might be necessary to send a prize. Your date of birth might be needed to check eligibility. Other times, an optional field is simply that: optional.

There's no great trick to this. I just prefer not to add information to another database unless there's a reason to.

The same goes for marketing consent. If receiving marketing is part of the deal and I'm happy with that, fine. If there's an optional box allowing my details to be used for additional marketing or shared with other parties, I don't automatically tick it just because it's there.

Your phone number is worth thinking about

A phone number is a little harder because plenty of legitimate competitions use one to contact winners.

It's also information that can hang around for a very long time.

My own experience made me a lot more conscious of that. The callers weren't trying random numbers and hoping for the best; they already had my name and number together, which made the conversation sound much more legitimate than a completely cold scam call.

Some regular compers use a second number for competitions. I don't think everyone needs to rush out and buy another SIM, but if you're entering a large number of promotions it's an option worth considering.

Whatever number you use, someone knowing your name and phone number isn't proof that they're who they claim to be.

If a caller wants passwords, security codes, banking details or additional personal information, I wouldn't continue the conversation. Scamwatch recommends hanging up and contacting the organisation yourself using contact details you've independently found, rather than details supplied by the caller.

Occasionally check where your email has turned up

One useful tool is Have I Been Pwned, which lets you check whether an email address has appeared in known data breaches. You can also register an address to be notified if it appears in a newly added breach.

It isn't a complete record of everywhere your information may have leaked, but it can be an interesting check if you've been using the same competition email for years.

If that address does appear in a breach, pay attention to what information was exposed. An email address on its own is one thing; an old password, phone number or other information may deserve a bit more attention.

Old competition data doesn't always disappear

This is the part I hadn't given much thought to before my own experience.

A competition can run for six weeks while the information collected from it may stick around for years.

For organisations covered by Australia's Privacy Act, the Australian Privacy Principles include rights to request access to personal information held about you. Covered organisations are also generally required to take reasonable steps to destroy or de-identify personal information they no longer need, subject to exceptions such as legal requirements to retain it.

In practice, I'm not going to contact every company I've entered a competition with over the past decade and ask what they still have. But if there's a promoter or marketing company you no longer want to hear from, there's nothing wrong with unsubscribing, asking to be removed from marketing, or asking what information they hold about you.

If a strange call comes years later

The biggest thing my experience changed was how much weight I give to information a caller already knows.

Someone knowing my name doesn't impress me. Neither does knowing my phone number, email address or where I live. That information may have come from a perfectly legitimate form I filled out years ago and barely remember.

If something doesn't feel right, I'll end the call and contact the organisation myself.

And if you've already handed over banking information, passwords or security codes, deal with that quickly. Contact your bank or the affected service directly. IDCARE provides support for Australians dealing with scams and identity issues, and scams can also be reported through Scamwatch.

I'm still entering competitions

None of this put me off comping.

It just made me realise that entering a competition isn't only about whether I trust the page sitting in front of me today. I'm also handing over information that may still be sitting somewhere long after I've forgotten entering.

These days I use an email address specifically for competitions, think a little harder about which details I provide, and don't automatically agree to every optional marketing request put in front of me.

It doesn't add much effort to entering.

But after discovering that a competition I'd forgotten about years earlier may have helped a scam caller make their call more convincing, it seems worth doing.