Most SMB leaders intuitively know that identity theft and fraud happen “out there,” but the truth is far more uncomfortable: employee identities are now routinely stolen at work, often via familiar business systems that seem safe on the surface. Even more troubling for small and mid‑sized businesses, Business Email Compromise (BEC) remains one of the costliest threats, contributing nearly $2.8 billion in losses in 2024 alone. Across 2024–2025, BEC losses rose to nearly $8.5 billion, underscoring just how valuable stolen identities have become to attackers who rely primarily on social engineering, not code, to infiltrate organizations.
Featured in this Article:
Although used interchangeably, identity theft and identity fraud refer to two very different stages of an attack on your personal information. Identity theft occurs first, when your information is taken without your permission. Identity fraud happens next, when that stolen data is actively used to steal money, open accounts, or commit financial harm.
When personal information is taken without permission. This includes names, addresses, credit card numbers, Social Security numbers, login credentials, and other sensitive data.
The key idea here is that identity theft = information stolen.
When stolen personal data is used for financial gain.
The key idea here is that identity fraud = stolen information is exploited.
Employers are responsible for a great deal of personal and private information regarding their employees. Third parties may want that information for a variety of reasons, some of which are bureaucratic, financial, nosy, or even dangerous.
There are plenty of ways, but here are a few popular methods:
CISA confirms that attackers increasingly set up fraudulent Wi‑Fi networks with the same identifiers (SSIDs) to legitimate hotspots so employee devices connect automatically. Once connected, attackers can intercept credentials, redirect traffic, or present fake login pages to harvest authentication details. As travel and hybrid work grow, the attack surface does too.
BEC has evolved into a sophisticated identity‑theft machine. Modern attackers intercept both passwords and session cookies, allowing them to bypass MFA entirely. Microsoft has documented multi‑stage BEC campaigns abusing SharePoint workflows, mailbox rules, and trusted document‑sharing flows to compromise organizations undetected.
MFA fatigue attacks surged between 2024–2025, exploiting user frustration instead of system weaknesses. Microsoft noted that about 1% of users approve the very first unexpected MFA prompt, enough to cause widespread compromise across SMBs. Attackers bombard a victim with nonstop MFA notifications until fatigue, confusion, or irritation leads them to approve a fraudulent login.
QR‑code phishing bypasses traditional corporate defenses by pushing victims to scan codes using personal smartphones, which operate outside enterprise controls. Between August and November 2025, successful QR phishing attacks grew 5×, according to StrongestLayer’s 2026 report, even after major security vendors deployed QR‑scanning features.
Old hardware remains one of the most underestimated causes of employee identity theft. The FTC’s updated Safeguards Rule requires organizations covered by GLBA to report any unauthorized acquisition of unencrypted data affecting 500+ consumers within 30 days—including exposure through poorly wiped devices.
The release of NIST Cybersecurity Framework 2.0 brings a clearer roadmap for SMB security programs by elevating cybersecurity governance to an executive responsibility. The new Govern function helps small businesses define roles, oversight, supplier controls, and strategic risk priorities—ensuring identity protection is not left entirely to IT teams.
Pair that governance with:
…and SMBs can dramatically reduce their vulnerability to identity-driven compromise.
When identity compromise occurs, the first step is containment. In many attacks, password resets alone are insufficient. For example, BEC attacks require session token revocation, mailbox rule cleanup, OAuth permission review, and vendor/bank notification. The FBI encourages businesses to file IC3 reports promptly because recovery workflows depend on timely reporting.
If you need help or maybe this seems like something you should outsource to make sure you're not subjected to, contact us today and we'll get you one your way to better protection.
Want us to manage all this for you? Check out our Secure Managed Services offerings that cover your IT support and cybersecurity all in one package.