A detailed Yelp review feels like a civic contribution. Researchers now show it can also sketch your social network for anyone willing to run the math, and that map is exactly what spear-phishing attackers need.
A study published in Information Systems Research finds that review behavior on platforms like Yelp, specifically how long your reviews are and which businesses you review, can be used to reconstruct significant portions of your real-world social network. No friend list required.
How Your Review Habits Reveal Your Friends
The algorithm doesn’t need your contacts. It just needs your word count.
Lead researcher Yan Leng of the University of Texas at Austin developed an algorithm called Homophilous Network Learning (HNL) with co-researcher Yijun Chen of the University of Melbourne. Collaborators from Oxford, the Chinese University of Hong Kong, and the University of Sydney also contributed.
HNL does not look at who you follow. It looks at patterns: friends tend to write reviews of similar lengths, and that behavioral synchronicity leaves a statistical fingerprint across thousands of public posts.
The team tested HNL on 4,299 Yelp reviewers in New Orleans and Pittsburgh. At a 10% false-positive rate, the model correctly recovered roughly 49 to 50% of real Yelp friendships from review behavior alone.
Push that tolerance to 20%, and recovery climbs above 60%. The algorithm correctly identified more than three out of five real-world friendships without ever seeing a friend list.
No single review exposes you. It is the aggregate pattern across many users and many reviews that makes inference possible.
Why This Makes You a More Valuable Target
A map of who you trust is exactly what a scammer needs.
Spear-phishing is targeted fraud where a scammer impersonates a specific trusted contact, a friend, a colleague, someone you would actually recognize, to trick you into clicking a malicious link or surrendering sensitive information. It works precisely because it feels personal. Protecting your password vaults and credentials is an essential step when such targeted attacks are on the rise.
The study connected its network-inference results to an economic model using FBI Internet Crime Complaint Center data. In the Pennsylvania sample, the modeled return on a spear-phishing campaign using inferred social ties started at 109% for 500 impersonation attempts. Scale that to 10,000 attempts, and the modeled return climbs to 1,098%.
One critical clarification: no real-world criminals have been documented using this specific Yelp-based method. The profitability figures are simulated and prospective. The risk is credible, not yet confirmed in the wild. Reviewing basic practices to stay safe online remains worthwhile regardless.
What Platforms Can Do, and What You Should Know
A little noise in the data goes a long way toward making attacks unprofitable.
The researchers propose a countermeasure built on differential privacy, a technique that injects small amounts of random noise into review-length data before it is analyzed or shared. In tests on the Yelp dataset, about 75% of review-length values stayed completely unchanged, and 95% differed by roughly 15 words or fewer.
Readers would never notice the difference. That modest scrambling was enough to push smaller spear-phishing campaigns into unprofitable territory.
Platforms that expose behavioral data through public datasets or third-party APIs should treat that data as sensitive, even when no friend lists are attached , much like apps caught secretly tracking users without their knowledge. The study focused on Yelp, but the authors flag Amazon, YouTube, and Groupon as platforms where similar behavioral signals, including ratings patterns, comment lengths, and watch history, could carry comparable risks. Those platforms were not empirically tested in this work.
Writing honest reviews is still worth doing. Knowing that your public behavior, in aggregate with thousands of other users, can quietly outline your social world is reason enough to treat unsolicited messages from long-silent contacts with extra scrutiny, especially when a message references shared experiences with suspicious specificity.
