You had a coffee at Gateway this morning, and the person at the next table never said a word to you. By tonight a follow request from that stranger can be sitting on the private account you were sure nobody could trace back to you, the one with no name, no photo and no posts. The case this is built on is real, and the method behind it works on anyone sitting within camera range, in any cafe in the country.
How a stranger finds you from one photo
They never touched your phone, and they never needed your password. A single photo, taken while you were looking down at your laptop, is enough. Dropped into a face search engine like PimEyes, which crawls billions of public images and returns matches in seconds, that photo links your face to your profiles, your name, where you work and old forum posts you forgot you ever wrote. Two Harvard students demonstrated last year how the same trick runs through Meta's Ray-Ban smart glasses paired with off-the-shelf software, so the person across from you may not even lift a phone.
There is a lazier version that needs no photo at all. Henry Fisher, CEO of the privacy education group Techlore, told Cybernews on 28 May 2026 that if your location sharing is on and you and a stranger are on the same mall WiFi, Meta has more than enough data to connect the two of you and start suggesting your profiles to each other. The word "burner" did a lot of work in the case that started this. An account you verified with your everyday phone number was never really a burner, since that number ties it straight back to you, and syncing your contacts lets the app match you to everyone who has your number saved.
Why South Africa makes it easy
Your face is your most personal data, and POPIA agrees, classifying it as special personal information under Section 26, which means processing it generally needs your explicit consent. That protection only counts if someone enforces it, and right now the cameras at your mall, your estate boom gate and your gym are scanning and storing faces with no consent and no transparency across Durban, Cape Town and Johannesburg, as the Mail and Guardian reported in August 2025. The hardware keeps getting cheaper. Meta and EssilorLuxottica sold more than seven million Ray-Ban and Oakley smart glasses in 2025, and in early 2026 a Russian vlogger was identified for using a pair to film women in Kenya and Ghana without their knowledge, as TechBuild Africa reported in May 2026.
For an SME owner this is not abstract. Your face is on your About page, your staff tag the business in their posts, and your morning check-in at the gym quietly hands over your suburb. South Africa does give you recourse once something goes wrong, since the Protection from Harassment Act lets you apply for a protection order even against someone you have no relationship with, and the Cybercrimes Act treats cyberstalking as a crime. A court order arrives after the harm is done, though. The prevention is yours.
What to do this week
None of this is carelessness. It happens to people who are careful, and the fixes below are small enough to start today.
- Make your accounts private. This is the single highest-impact move, because most face-search and profile-suggestion tricks only reach what is already public. Lock Instagram, Facebook, TikTok and X down to followers you approve.
- Audit what your face is attached to online. Run your own photo through a face search tool to see where you already appear, then remove or lock down what you did not choose to make public, and check that your profile pictures do not give away your gym, your child's school or your street.
- Turn off location services for your social apps, and treat free public WiFi as a room full of strangers, since the connection at the mall or the coffee shop puts you on the same network as everyone else on it.
- Stop reusing one phone number across accounts you want kept separate, and switch off contact syncing so an app cannot quietly link your private account to people who already have your number saved.
- Switch on two-factor authentication (2FA), so a stranger who finds you still cannot get into anything. Our guide to setting up 2FA walks through it.
Where Ubuntu Guard fits
If you want to know exactly what a stranger can pull up on your face before they go looking, that is what our cybersecurity assessment is built for. We check your real exposure across email, accounts, devices and the privacy settings most people never open, then hand you a plain-language report on where the gaps are and how to close them. We speak human, not tech jargon, and we do it on-site where that helps. You can see how it works on our cybersecurity assessment page.
Want to know what a stranger can already pull up on your face? WhatsApp us and we will show you exactly where you are exposed. You can also reach us at [email protected].
Cybersecurity Made Simple
© 2026 Ubuntu Guard Cybersecurity | Durban, South Africa
ubuntuguard.co.za