Identity theft: how it happens and how to protect yourself

Identity theft is the misuse of someone's personal data so an attacker can pose as another person, open accounts, run transactions, or sign in to systems. The consumer version of this crime, where a stolen card or national ID is used to drain a bank account, is well known. The business version is quieter and more damaging. Here the prize is not your money, it is your employee's login. With a valid username, password, and session, an attacker walks into your email, your file shares, and your cloud console as a trusted insider. Almost no detection rule fires, because nothing technically broke. Someone simply signed in.

For a regulated company, this matters because identity is now the perimeter. Staff log in from home, from phones, and from third-party SaaS apps that sit outside the firewall. A single compromised account can expose customer records, trigger fraudulent payments, and become the foothold for ransomware. It also creates legal exposure. Under the GDPR, the unauthorised disclosure of personal data is a reportable breach, and frameworks such as the NIS2 Directive and ISO/IEC 27001:2022 expect you to control access and prove you did. Identity theft is therefore both a security problem and a compliance problem.

Identity theft in a business context

When people picture identity theft, they think of a stranger opening a credit card in their name. In the enterprise, the target shifts. Attackers want corporate identities because those identities unlock data and money at scale. A finance clerk's mailbox is worth more to a fraudster than an individual's savings account, because it can be used to redirect an invoice worth far more.

Account compromise is the engine. Once an attacker controls a real employee login, they can read mail, reset other passwords, approve their own access requests, and move laterally. This is the launch pad for business email compromise, where the criminal sends a payment request from a genuine internal address that passes every authenticity check a recipient might run.

Impersonation extends the same idea without always stealing a password. An attacker registers a lookalike domain, spoofs a display name, or uses a deepfake voice to pose as an executive. The goal is the same. Convince a human that they are dealing with a trusted colleague so they hand over data, credentials, or a wire transfer. Identity, not malware, is the weapon.

How identity theft happens

Attackers rarely rely on a single method. They chain them. A breach at one service supplies an email and password, that password is reused at your company, and a phishing message harvests the second factor. The table below maps the common attack vectors against the control that actually blunts each one.¹

Two of these deserve a closer look. Credential stuffing works only because people reuse passwords. The same pair leaked from a hobby forum gets tried against banking and corporate portals, and a percentage succeed. Infostealer malware is the newer threat. It does not just grab passwords, it lifts the active session cookie, so the attacker can bypass MFA entirely by replaying a session you already authenticated. Read more in our guides to phishing and social engineering and malware.

The consequences for individuals and companies

For an individual, identity theft means financial loss, fraudulent contracts opened in their name, damaged credit, and a long, frustrating cleanup that can take months. The emotional cost of proving you are who you say you are should not be underestimated.

For a company, the stakes are organisational. A stolen employee identity gives the attacker access to email, systems, and data as a legitimate user. That single foothold can cascade into data exfiltration, ransomware deployment, fraudulent payments, and supply-chain attacks against your own customers. The downstream costs include incident response, regulatory fines, contractual penalties, and lasting reputational damage.

There is a regulatory dimension that is easy to overlook. If the misused identity exposes personal data, you are not merely a victim, you are a data controller with reporting duties. The breach clock starts the moment you become aware, and a slow or absent response is itself a finding an auditor will note.

How to protect identities

Protection is layered. No single control is enough, but a small set of well-implemented controls removes most of the risk. The priority order below reflects what stops the most attacks for the least effort.

• Enable multi-factor authentication everywhere, and prefer phishing-resistant methods such as FIDO2 security keys or passkeys over SMS codes, which can be intercepted.
• Give every user a password manager so each account has a long, unique password and no credential is ever reused across services.
• Run continuous breach monitoring so exposed corporate credentials trigger an immediate forced reset before they can be replayed.
• Apply least privilege and just-in-time access, so a compromised account reaches only what that role genuinely needs and admin rights are granted only when used.
• Deploy endpoint protection and keep devices patched, because session-stealing malware defeats passwords and MFA alike if the device is already infected.
• Authenticate your email domain with SPF, DKIM, and DMARC so attackers cannot easily spoof your own brand.

Identity is the new perimeter, and a stolen login rarely trips an alarm, because nothing broke. Someone just signed in.

What to do if it happens

Speed limits the damage. The first hour matters more than the next week. Follow a defined sequence so nothing is missed under pressure, and tie it into your wider incident response plan.

1. 01
   Contain the account

   Revoke active sessions, reset the password, and disable the account or force re-authentication so the attacker is locked out immediately.
2. 02
   Reset and re-enrol MFA

   Rotate the password, remove any attacker-added MFA methods or app passwords, and re-enrol the user on a trusted device.
3. 03
   Assess the blast radius

   Check sign-in logs, mailbox rules, granted OAuth apps, and any data accessed or exfiltrated during the window of compromise.
4. 04
   Notify and report

   Tell affected internal owners, your bank where money is involved, and assess GDPR breach notification duties without delay.
5. 05
   Preserve evidence

   Capture logs and timelines before they roll off, so forensic analysis and any later regulatory questions can be answered.
6. 06
   Review and harden

   Close the entry point, expand monitoring, and fix the gap that allowed the compromise so it does not recur.

The GDPR and breach notification

When identity theft exposes personal data, the General Data Protection Regulation applies. Article 33 requires a controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.² Where the risk is high, Article 34 also requires you to inform the affected individuals.

This turns identity protection into a documented obligation. You need to detect the compromise, assess the risk, and be able to show the timeline. A company that cannot prove when it became aware, or that took weeks to notice an attacker reading a mailbox, is exposed to enforcement on top of the original loss. Strong access controls and monitoring are how you both prevent the breach and stand behind your response.

The role of awareness training

Most identity theft starts with a person, not a flaw in code. An employee clicks a link, approves a push prompt, or trusts a confident voice on the phone. Technical controls reduce the odds, but the human remains the most attacked surface, and that is precisely what good training addresses.

Effective awareness training is not an annual slideshow. It is realistic, repeated, and measured. Simulated phishing shows which teams are vulnerable, targeted coaching follows up, and reporting rates become a metric leadership can track. Done well, it turns staff from the weakest link into a sensor network that flags attacks early. Frameworks like ISO/IEC 27001:2022 expect this kind of ongoing security awareness, not a one-time tick box.

How Raptoric helps

We help regulated companies make identity the strong part of their defence. Through our governance, risk, and compliance work, we put identity and access management, least privilege, and breach response on a footing that satisfies the GDPR, NIS2, and ISO/IEC 27001. Through security awareness training, we run realistic phishing simulations and coaching that measurably lower the human risk. Book a scoping call to find out how far a single stolen identity could reach inside your organisation, and how to close that gap.