Identity theft as a business risk has been transformed by technology. The traditional playbook of stealing private data to exploit security vulnerabilities is now boosted by voice and image cloning. Criminals require only a few seconds of material to trick victims into remitting funds, disclosing classified data, or yielding access credentials.

For Ed Williams, head of Penetration Testing at cyber security firm LevelBlue, the trend is stark. Observing both sides of attack and defence, he sees how AI is reshaping identity theft and why organisations must rethink how they combat it.

AI has geared up the risk quotient

"Right now, I’d say the attackers are winning. They’re a bit further ahead at the moment, able to spread that work among swarms of agents carrying out 10,000 days’ worth of work within a week that would previously have taken humans months or years," says Williams.

Attacks are also increasingly targeted, moving away from obvious mass emails to a tailored yet scalable ‘scattergun' approach. Identity fraud remains the most prevalent cyber crime recorded by Cifas' National Fraud Database (NFD), accounting for 59% of all cases during the first half of 2026.

Senior executives are a prime target

For attackers, senior executives – especially those with financial authority – offer the highest return. "The C-suite is always targeted, so if they can get the CFO to wire something across that they shouldn’t, that’s what they’re going to do," Williams says.

While awareness has improved, modern workload pressures and multitasking leave executives vulnerable during moments of fatigue. "We are all so busy; notifications pinging on your two laptops and phone, things are constantly happening. It only takes the attacker to get in or to get you to do something once, and then it's difficult."

That single momentary lapse in concentration provides the initial foothold. Once an executive’s mailbox is compromised in that window of vulnerability, criminals can operate within the organisation’s own processes across the entire network.

"If they get access to your emails, they’re in your work environment, then they can start to do all sorts of things. They can start to create fake purchase orders, they’ll remove the ‘sent’ items and get emails rerouted, so you don’t even see them coming in."

Social media as intelligence

Modern identity theft relies heavily on open-source intelligence, making platforms like LinkedIn and Facebook primary targets for profiling executives. Attackers create customised phishing campaigns using mined details, such as educational background or past employment, to ensnare victims.

"The hook could even be people sharing on Facebook where they go on holiday, details of their family, whatever people might innocently share, and it might not mean much [on its own]. But you start to build these up, and you can get a picture; where their kids go to school for example. Let’s assume it’s private school, where VAT has gone up recently. The attacker can send a phishing email pretending to be part of a campaign against it – ‘sign up here’, and that’s it,” says Williams.

AI then automates both the data-gathering and the execution, making the "pool that much easier to fish in".

Building a layered defence

A layered defence strategy combining technical controls and cyber hygiene significantly reduces risk. "The individual needs to take some responsibility around choosing good passwords, making sure that they're using multi-factor authentication, or a physical key for your laptop. That extra level of defence works well, but nothing is 100% secure," Williams warns.

To counter cognitive exhaustion from multitasking and digital overload, which leaves workers prone to being caught off-guard, Williams recommends carving out focus blocks: "I think you’re better off working in 30-minute blocks and then moving on to the next task. The more organised you can be, the better. Shut down Teams for that half-hour block, so you're not getting notified."

That doesn't always work because the type of environment you're in might not be suitable to do that, he concedes. “That's why I think the attackers right now have an advantage."

Embed scepticism and reporting

"It’s worth being sceptical…if you see something, report it," Williams says. Constant reporting teaches underlying AI phishing filters and email systems what to look out for.

Williams also advocates using AI for defence and conducting regular penetration testing and red teaming exercises: "At an organisational level companies need to be implementing best of breed tooling, and that exists. We do see organisations using AI more and more in defending, which is good."

Responding to suspected breach

Early warning signs include unknown payments or unusual messages. "If you think you’ve been compromised, speak to IT security. That’s the first thing. They’ll perform an investigation, change credentials and then probably get an external organisation in to determine what happened. Attackers often move laterally from one system to another, so defenders must close every route in."

Third-party vulnerability

Finance leaders must also strictly evaluate vendor security.

"We see lots of organisations compromised through a third-party relationship and the old adage that ‘you're only as strong as your weakest link’ is very much true,” says Williams. You could be a brilliant organisation in terms of security, but when you're onboarding a third-party supplier, which everybody does, you then need to make sure that their security is up to scratch as well.

“And there are many things you can do to make sure that it is - there are questionnaires, contract clauses, etc, but we don't see enough organisations really getting into the detail around, what their password policy is like or what their patching policy is like.”