Identity Theft Prevention
Spot identity theft tactics targeting employees.
What Is Identity Theft Prevention?
Identity theft costs individuals an average of 200 hours and significant financial loss to resolve, and attackers frequently target employees through their workplace to collect the personal data they need. This simulation places you in scenarios where identity theft risk is high but easy to miss. You receive a convincing HR email requesting you to 'verify' your Social Security number and bank details for a payroll update. You discover a colleague's personnel file open on an unattended workstation. You get a phone call from someone claiming to be from your benefits provider who already knows your name, department, and manager. Each scenario teaches you to spot the warning signs that separate legitimate requests from social engineering attempts designed to harvest personally identifiable information (PII). The exercise covers both protecting your own identity and safeguarding the PII of colleagues, customers, and vendors that you encounter in your role. You learn specific verification steps, reporting procedures, and daily habits that reduce your exposure to identity theft at work.
What You'll Learn in Identity Theft Prevention
- Distinguish between legitimate HR, payroll, and benefits communications and social engineering attempts designed to harvest personal data
- Apply verification procedures before providing PII in response to any request received by email, phone, or in-person
- Secure personally identifiable information encountered in your role, including personnel files, customer records, and vendor data
- Report suspected identity theft attempts through proper organizational channels with enough detail for the security team to investigate
- Reduce personal exposure to identity theft by managing digital footprints, monitoring for compromised credentials, and securing physical documents at work
Identity Theft Prevention — Training Steps
-
A Routine Wednesday
It's Wednesday afternoon and you've just finished a productive client call. As you update your notes, your phone buzzes with a voicemail notification.
-
A Moment of Panic
Alice's stomach drops. A delayed paycheck would be a serious problem - rent is due next week, and she has client dinner expenses pending on her personal card. The urgency in Jennifer's voice sounded genuine. She grabs her phone to call the number from the voicemail: 1-888-927-3847 .
-
The Verification Portal
'Jennifer' sounds professional and helpful. She explains that Alice needs to verify her banking information through their secure HR portal to prevent payment delays.
-
Providing Banking Details
The portal looks professional - it has the Horizon Financial Services logo and mentions the quarterly payroll audit. Jennifer guides Alice through the form, asking her to enter her routing number and account number.
-
All Taken Care Of
Jennifer thanks Alice for her cooperation and confirms the information will be processed within 24 to 48 hours.
-
Reflection
Alice hangs up feeling relieved. But before we move on, consider what just happened.
-
A Creeping Doubt
As the afternoon wears on, Alice can't shake a nagging feeling. Why did HR call her personal phone instead of sending an email? Why was the callback number different from the company directory? And when has HR ever asked employees to verify banking details through a website during a phone call? A cold feeling settles in. Alice decides to call the real HR department to check whether Jennifer Walsh actually left that voicemail.
-
The Fallout
Marcus confirmed Alice's worst fear: Jennifer Walsh is a real HR employee, but she never left that voicemail. Someone impersonated her. The company never requests banking information through phone calls or external portals. Alice's banking details are now in the hands of an attacker. Marcus sends an email with immediate next steps and a link to the Security Portal for filing an incident report.
-
Accessing the Security Portal
Alice clicks the link to access the Security Portal and file her incident report.
-
Filing the Incident Report
Alice documents every detail of the attack - the voicemail, the callback number, the fake portal, and the information she provided. The more detail in the report, the better the security team can respond.