Almost nobody gets burned in a chat room because they handed over something dramatic. They gave a first name, then a city, then the name of the shop where they work — three ordinary sentences across two hours of pleasant conversation. At no point did it feel like a mistake. That is the mechanism: the risk is never in one message, it is in the sum of them.
So here is what stays in your head, and for every item the concrete why — not “be careful”, but what a stranger can actually do with it.
The short list, in ten seconds
Never in a public room, and never in a private conversation with someone you met an hour ago:
- Your full name. A first name is fine. First plus last is a search query.
- Your employer, your school, your shift pattern.
- Your phone number, on any pretext whatsoever.
- Your street, your building, the view from your window.
- Photos that identify you — face, work uniform, number plate, a room someone could recognise.
- Documents: ID, payslip, official letters, anything carrying a reference number.
- Account details: the email address you use everywhere else, a username you reuse, and passwords, obviously.
Each section below takes one line of that list and the reason it is there.
Your full name is the key that opens every other door
A surname is not a piece of personal information, it is a lookup key. Typed into a search engine alongside a city, it pulls up social profiles, club listings, company registries, old forum posts. From a profile you get a friends list; from that, family names; from family names, the answers to the security questions protecting your accounts — mother’s maiden name, first school, town where you grew up.
If your surname is rare it is worse: in a small town, a rare surname is effectively a street address. And there is no way to un-say it, or to know who copied it while the room was busy.
Where you work or study is an address you did not think you gave
Naming your employer hands over two things at once: a fixed physical location and a reliable timetable. Someone who knows you work at a specific pharmacy knows a building where you can be found, and roughly when. Add “I finish at six” and they know the hour.
There is a second, quieter danger: your workplace is leverage. The threat “I will send this to your colleagues” only works on someone who has said where they work. People who pressure others online ask about jobs early for exactly that reason, and it never sounds like an interrogation — it sounds like small talk about a hard day. The same applies to a school or a class year, which also pins down your age.
Your phone number is not a contact, it is a search field
People think of a number as a way to reach them. Treat it instead as a string that can be looked up. Added to a stranger’s contacts, most messaging apps show them your display name and profile photo. Typed into a search engine it can surface old classified ads or a leaked database. It confirms your country and often your region, and it becomes a recovery route someone can attack on your accounts. It also lets an unknown person call you at two in the morning for as long as they feel like it.
The technical trail you leave simply by connecting is a separate question, with narrower limits than most people assume — we went through it in what your IP address really shows in a chat.
Photos and documents leak more than what is in frame
A photo of your face can be reverse-searched. If the same face appears on a public social account, the two are matched in seconds, and the person you were chatting with now has your name, your friends and your city without you saying a word.
Backgrounds give people away constantly: a street sign, a school badge on a jumper, a delivery box with the label still on it, a distinctive building through the window, a reflection in a screen. Some files also carry embedded metadata, including where the picture was taken.
And the rule that overrides all of them: anything you send has been copied. “Delete after viewing” describes a button, not reality. That applies to live video too — a webcam is a photo taken thirty times a second, and it can be recorded silently. If pressure ever follows, the response is counter-intuitive and it matters: see what to do about webcam blackmail.
Documents are the worst case, because they bundle everything: an ID photo gives full name, date of birth, document number and often an address — the exact combination needed to impersonate you to a call centre. No legitimate chat room conversation has ever required one.
The harmless detail that finishes the puzzle
This is the part people underestimate. Nobody hands over their address. What they hand over is the dog’s name, the number of the bus they take, the gym they go to, the fact that they turned thirty last week, “my daughter starts secondary school on Monday”.
Each is worth nothing alone. Four of them, from the same person, in the same evening, describe one identifiable human being in one identifiable neighbourhood — and two of them are answers to password reset questions. This is jigsaw identification, and it takes no skill, only patience and notes.
The test: before you type a detail, ask whether it is specific to you or true of thousands. “I love thrillers” is safe. “I go to the Thursday running group by the canal” is an appointment.
The “normal” requests that are not normal
These sound reasonable, which is the whole point:
- “Let’s carry on somewhere else, it’s easier.” Sometimes innocent. But moving off-site removes moderation, reporting and any trace — and the move itself usually requires your number.
- “Send a quick photo so I know you’re real.” Verification that runs one way only is not verification. Notice whether they sent theirs first, unprompted, in the pose they are asking of you.
- “Are you home alone? What time does your partner get back?” That is availability mapping, phrased as concern.
- “I want to send you a gift, just give me your email and number.” Unsolicited generosity that collects identifiers is a collection method.
- Urgency plus a sad story. Genuine distress almost never requires your surname within ten minutes.
One more signal, easy to miss in a fun conversation: someone who asks a great deal and reveals almost nothing, with answers that stay vague or oddly generic. That pattern, and the automated versions of it, are worth recognising — how to spot fake profiles and bots goes through the tells.
If it is already out there
Panic makes people delete things. Do the opposite, in this order.
- Screenshot first. Usernames, timestamps, the messages. You cannot report what you have erased.
- Block, then report in the room — not just close the tab. Closing it protects you tonight; reporting protects the next person.
- Change what can be changed. If an email address leaked, change that account’s password and switch on two-step verification. A number cannot be un-shared, so instead expect unknown calls and never answer them.
- If you sent images: do not pay, do not negotiate, do not send more. All three make it worse, without exception.
- Tell one real person. Isolation is the entire leverage; saying it out loud removes most of it.
- Search yourself — name, number, usual username — and clean up what you control.
- If there are threats, money, or a minor involved, go to the police with your screenshots. That is what the evidence was for.
What a serious site will never ask you for
Keep this as a hard boundary, because it makes impersonation attempts obvious:
- Your password — never, in any channel, including anything calling itself support.
- Your ID document sent through a chat message.
- Payment or card details in a private conversation.
- Your phone number to “unlock” or “confirm” a feature.
- A program to install in order to talk to someone.
Moderators also do not message you first asking for account information. On LibertiChat the rooms are free, there is no sign-up, nothing to download and everything runs in your browser — which means there is very little about you for anyone to ask for in the first place, and any message pretending otherwise is not from us. What moderation actually does, and how to report someone, is set out in the chat rules and reporting guidelines.
The habit that replaces the whole list
Decide your line before the conversation gets warm, because warmth is when boundaries slip. Mine is simple: nothing that pins me to a place, a time or a legal identity, however well it is going.
Then use the test that never fails. Say no to one small request and watch the reaction. Someone decent shrugs and keeps talking. Someone who sulks, guilts you, or asks again in a different shape has just told you what they were after — and you found out for the price of nothing. For the longer version, see chatting without registration, safely; and if a conversation moves toward real life, meeting people from online without taking risks covers what happens off the screen.
None of this is about being suspicious of everyone. Most people in a room are there for the same ordinary reason you are. It is about making sure the rare one who is not walks away with nothing.