Ever since the concept of sharing your personal life on the internet became a reality, social media users have been warned about everything from oversharing to privacy settings to avoiding cyberbullies. But there’s another evil lurking in the background of your last Facebook post, and it can lead you to hand over all of your money.

One member of the military stationed in California found this out the hard way when a scammer contacted him by phone, claiming to be a representative of his bank. The caller explained that there had been fraudulent activity on the soldier’s bank account. The caller then said a new account had been opened for the soldier and they simply needed the authorization to transfer all of his funds into the new account. The soldier complied, grateful that his bank was staying on top of things and looking out for him.

Unfortunately, the new account number was not in the soldier’s name; once the funds were transferred, the scammer emptied the account and the money was long gone.

Why would someone fall for a scam like this? Because the scammer had a lot of detailed information about the soldier’s whereabouts and activities over the course of the previous few weeks, especially a trip to Hawaii. All of the information used to convince the victim that this was genuine was likely gleaned from his Facebook posts.

When you’re posting online, it’s important to keep a few things in mind:

1. Am I oversharing?

Oversharing is a touchy subject because isn’t the entire point of social media to let the people who care about you and your opinions know what’s going on? Yes, to a degree. But stop and ask yourself if some things really should be posted. Vacation photos can wait ‘til you get home (just remember that a scammer could use that information as in the scenario above), and other information like the purchase of a new car or a child’s accomplishments can be toned down to avoid inviting scammers.

2. Are my privacy settings strict enough?

While there’s a chance the scammer who targeted the soldier’s bank account could still have found some of the information another way, strict privacy settings could have kept the caller from knowing such highly detailed information. Make sure you know who can see your content and how to control it.

3. Who is this new friend request? OR, I thought I was already connected to Mike from accounting?

One easy way for scammers to see your social media posts is to send you a friend request. They can initiate a new contact and look to be someone you might like to connect with, or they can “spoof” an existing account that you’re already connected to. If you suddenly get a friend request from someone you should already be connected with, get in touch with that person before you accept the request and find out if it’s real or not.

Finally, regardless of what you post, this unfortunate situation serves as a dire warning about how you interact with “faceless” entities. If you receive a phone call or email about an account you own, do not take any kind of action just because someone contacted you. Thank them for the information, end the call or message, then reach out to your account company directly to find out what’s going on.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.