What is Identity Theft?
Identity theft is the unauthorized use of someone's personal or corporate identifying information to commit fraud. Companies encounter it from two directions at once: as a target, when criminals impersonate the business or its executives, and as a custodian, when the employee and customer data they hold is stolen and used elsewhere.
How identity theft affects companies
Business email compromise is the costliest variant. An attacker impersonates an executive or a known supplier and instructs a payment change, often timed around a genuine invoice. The payment is authorised through normal channels because nothing looks unusual except the bank details.
Vendor impersonation works the same way at scale, targeting accounts payable with fraudulent change-of-bank-details requests. Employee data breaches create downstream exposure through payroll diversion and fraudulent expense claims, while corporate identity misuse covers fake entities trading under a company's name.
Controls that limit exposure
The decisive control is mundane: out-of-band verification of any change to supplier or employee bank details, using a phone number held on file rather than one supplied in the request. Most successful BEC attacks survive every other control and fail at this one.
Around it sit access restrictions on vendor master data, dual approval for changes, mandatory cooling-off periods before the first payment to new details, and monitoring for the patterns that follow a compromise: a supplier's bank details changing shortly before a large invoice, or two suppliers sharing an account number.
Identity Theft and Supervizor
Supervizor's AI and Controls platform monitors master data changes alongside the payments that follow them, which is where impersonation fraud becomes visible. Teams use it to:
- Detect suspicious bank detail changes, including accounts shared between suppliers or matching an employee record
- Flag payments following a recent master data change, the sequence that characterises most vendor impersonation
- Monitor access and approval on vendor master data continuously rather than at audit time