Senator Reports Data Brokers Fuel Scams, Billions Lost

Senator Maggie Hassan released a detailed report this week that exposes how data‑brokerage firms fuel scams and identity theft. The document argues that the industry’s standard practice—selling enriched personal profiles built from public records and purchased datasets—has directly contributed billions in consumer losses through phishing, social engineering, and targeted fraud campaigns. ¹

The report highlights several key failures in current broker operations. First, many brokers sell predictive models that flag individuals as high-risk targets for debt collectors or financial institutions. In 2018, a Federal Trade Commission investigation identified five major players who marketed voter registration lists paired with predictions such as “likely to be targeted by debt collectors.” These enhanced profiles make victims appear attractive to scammers who then launch attacks via sophisticated phishing or social engineering channels, turning ordinary private information into actionable intelligence for fraudsters.

Second, the FTC noted a correlation between list sales and subsequent fraud reports following each sale event. When brokers release new data sets, there is an uptick in reported scam incidents tied to those same data points—a pattern suggesting direct causality rather than mere coincidence.

Third, the report estimates that $3 billion may have been lost due to compromised accounts, including both direct loss from stolen credentials and secondary costs borne by banks and credit unions when they respond to breaches. These secondary impacts are often not separately reported but can add significantly to overall consumer damages.

Expert commentary underscores how widespread this practice has become. The U.S. FTC estimated over $1 trillion in consumer-level personal information was traded annually by these brokers; yet most states lack robust regulations governing data brokerage, unlike Europe’s GDPR which imposes stricter consent requirements. Data enrichment services routinely combine publicly available records—such as property ownership, court filings, and public voting rolls—with purchased datasets, creating detailed profiles used increasingly for targeted advertising and now fraud schemes.

Many states lack robust regulations regulating data brokerage practices. Without stronger oversight, brokers can continue selling predictive models with little accountability.

In practical terms, the findings suggest tighter regulation around who can purchase voter registration lists, what predictions can accompany those lists, and how brokers must disclose the intended use of such enriched data. Regulators imposing limits similar to GDPR's consent model would reduce the volume of high-risk profiles falling into scammers’ hands.

Ultimately, Senator Hassan’s report shines a light on an industry whose profitability depends on commodifying private data while simultaneously enabling large-scale scams. It calls attention not only to individual victims but also to systemic changes required to protect all Americans from future identity theft.