Employers see you online – as do scammers

The information people share publicly on platforms such as LinkedIn, including their role, employer, colleagues and professional activities, can be used to build convincing impersonation attempts, targeted phishing attacks and other forms of social engineering.

What strikes me in my work is how much a public profile gives away. Not scandal, detail. Where someone works and for how long. Who they report to. The qualification certificate they posted the day they graduated. That is exactly the raw material an impersonator needs.

Impersonation has changed, and hiring is a target

South Africa now records the highest share of deepfake-driven identity fraud in Africa, according to the Smile ID 2026 Digital Identity Fraud Report. Hiring itself has become a target: research firm Gartner predicts that by 2028, 1 in 4 job candidate profiles worldwide could be fake, and in its survey of 3,000 job seekers, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them.

A convincing fake no longer needs a film studio. It needs clear video and audio of the person, and many of us have published hours of it ourselves. A fake employee with system access is not a recruitment problem. It is a breach with a pay slip.

Employers are already responding

At MIE, identity verification has grown 12% year on year, and the company completed more than 400,000 identity verifications in the past year alone.

That is a significant increase in a single year, and it tells me employers have stopped taking identity at face value.

What individuals can do

• Look at yourself the way a screener would. Search your own name across the platforms you use and ask one question of everything you find: does this tell a stranger where I am, who I report to or who my family is?
• Share with purpose. Your achievements belong on a professional profile. Your ID document, your qualification certificates and the details that answer security questions, such as birthdays, pets’ names and schools, do not.
• Check before you pay. If a recruiter asks you to pay for a background check or any other fee before you are hired, check that the company and the job are real before any money moves.
• Agree a call-back habit. If a voice note or video call asks for money, access or a password, end it and call back on a number you already have.

What employers can do

• Verify identity properly, and more than once. Use identity verification that matches the person to the photo on the official record, confirm that the person who interviewed is the person who arrives on day one, and keep checking for roles with access to money, systems or data.
• Put it in policy. Whatever checks form part of your hiring, including social media screening, should follow one documented process, applied the same way to every candidate. Social media screening can only be done with the candidate’s consent.
• Treat your people’s public footprint as part of your security. The executive whose voice is on every podcast is the easiest one to clone. Build call-back steps into every payment and access request and make them routine.

Cybersecurity is usually framed as a technology problem. Increasingly, it is an identity problem. The profile you built to get hired, and the one your company built to win business, are real assets. This is a good time to make sure they are not also the easiest way in.