Personal security
What Investigators Can Find Out About You
There’s a tier of data vendor the public can’t buy from. This is what those systems hold, who gets in, and — the part that matters most — how often what comes back is simply wrong.
- Who can access
- Vetted businesses with a permissible purpose
- Vetting includes
- Site inspection, credentials, security review
- Governed by
- GLBA, DPPA, FCRA
- Accuracy
- A lead, never a conclusion
People search sites that anyone can pay for are assembled from marketing lists and stale scrapes. The systems investigators use are a different category. They’re built on credit header data, utility and telecom records, motor vehicle files where the law permits, and court and property records, and access to them is restricted.
Who actually gets access
You can’t sign up for these. Getting an account means proving you have a permissible purpose under the Gramm-Leach-Bliley Act, the Driver’s Privacy Protection Act and, where the data is used to make decisions about people, the Fair Credit Reporting Act. Recovering a debt, locating collateral, serving process and supporting litigation are the common ones.
Before an account is issued the vendor investigates the applicant. In my case that meant a business credentials check, a background check on me personally, an inspection of the office, and questions about how records are stored and destroyed. Accounts are audited afterwards, and searches are logged against the stated purpose. People do lose access.
How a search is run
A person can be searched by any of these, and partial information often suffices:
- Social Security number
- Full or partial name
- Address, or any part of one — street, city, county, state, ZIP
- Phone number
- Driver’s license number
- Date of birth, or an age range
- Email address
A business can be searched by name, by EIN, or by the name of an owner — which is how an entity gets traced back to a person, and how a person gets traced to entities they never mentioned.
What comes back
| Category | Typical detail |
|---|---|
| Identity | Social Security number, full name, aliases and former names, date of birth |
| Address history | Dated, frequently back to the first credit application — sometimes decades |
| Phones | Multiple numbers per person, current and historic, of varying accuracy |
| People around you | Relatives, associates, former housemates, anyone who shared an address |
| Assets | Property records and deeds, vehicles by make, model and plate, domain registrations, employers |
| Legal | Criminal and civil case records, bankruptcies, foreclosures, judgments, liens |
| Family | Marriage and divorce records |
| Licenses | Professional, DEA, pilot, hunting and fishing |
The comprehensive reports go further — full deed histories, complete DBA filings, deeper vehicle history. The address history is usually the part that surprises people. It’s dated, and a dated address history is effectively a timeline of your life.
The part the industry does badly
The reports are wrong often enough that treating them as fact is malpractice.
Court records are the worst offenders. They arrive through bulk feeds, are matched to people by name and date of birth, and they mismatch. Someone with a common name inherits a record that isn’t theirs. Dispositions don’t get updated, so a dismissed charge sits there looking live. Sealed and expunged matters sometimes persist in the commercial copy after they’re gone from the court’s own file.
Phone numbers age badly. Associate links are generated by shared addresses, so a stranger who once lived in your apartment appears as a known associate for years.
The rule. A database report is a set of leads to verify, not an answer. A criminal record goes in a report only after it has been pulled from the court that issued it. An address is confirmed against the assessor, the clerk, or something else independent. Every single time.
The failure mode is common and it’s lazy: pull a report, put a letterhead on it, bill it as an investigation. Nothing was verified and the client is now carrying the risk. Take that into court and the case can go badly on a single wrong entry.
Why I do not use them for everything
I get accused of running every piece of research I publish through these systems. I don’t, and I cite sources in articles and videos specifically so that’s checkable. Most of what appears here comes from public records, court portals, social media and breach data — material anybody can reach.
The restricted data gets used on vetted cases with a documented purpose, and not otherwise. Part of that’s the audit, and part of it’s that people do ask for locates with bad intent. What goes back to a client is scoped to what the case actually requires.
What this means if you are on the other side
Most of what these systems hold about you came from routine transactions: applying for credit, connecting a utility, registering a vehicle, buying a house, filing a case. It’s not the product of surveillance and there’s no single place to opt out of it.
Some of it you can affect. Freezing your credit limits what new activity generates. Registering a property or vehicle to a trust or an entity changes what a name search returns. Voter files, professional licenses and property records are public by law and are not going anywhere.
And you can correct errors. If something in your file is wrong, the FCRA gives you a dispute right — and it’s worth using, because an incorrect record doesn’t stay in one database. It propagates.