by Brian Thompson | Jul 15, 2026 | Uncategorized
Your employees are almost certainly using AI tools at work right now, whether your company approved it or not. An employee AI use policy is the fastest way to get ahead of that reality. Most small businesses still don’t have one. Verizon’s 2026 Data Breach Investigations Report found that shadow AI, meaning AI tools used without formal approval, is now the third most common non-malicious insider action detected inside breached organizations. Detections rose fourfold in a single year.
Last Updated: July 2026
Picture the scenario. An HR coordinator pastes a list of new hires, including Social Security numbers, into a free AI tool to draft offer letters faster. A bookkeeper uploads a spreadsheet of vendor payments so an AI assistant can summarize it before a board meeting. Neither person means any harm. Both just handed sensitive data to a system nobody at the company controls, reviews, or even knows is being used.
Shadow AI Is Already Inside Your Company
Shadow AI isn’t a future risk. It’s already running inside most small businesses today. The U.S. Chamber of Commerce reports that 58 percent of small businesses currently use some form of generative AI. That share keeps climbing. A 2026 Founder Reports survey of more than 2,000 U.S. workers found that 44 percent say their employer has no clear AI policy, or they aren’t sure one exists. That gap is worse at the smallest companies. Fifty-nine percent of workers at businesses with fewer than 10 employees report the same lack of policy.
The problem isn’t that employees are being reckless. A 2026 survey from PagerDuty and Wakefield Research found that 66 percent of office professionals have used AI tools at work despite believing those tools were not permitted. More than a third admitted entering customer data into public AI models while doing it. People generally aren’t hiding AI use because they want to break rules. They’re using it because it makes them faster, and because nobody told them where the line is.
What Happens Without an Employee AI Use Policy
Without an employee AI use policy, sensitive data doesn’t stay inside your business. A 2026 survey by cybersecurity firm Anagram found that 58 percent of employees admitted pasting sensitive data, including client records and internal documents, into large language models. Nearly half said they were using AI tools their employer hadn’t approved.
IT leaders are already dealing with the fallout. A 2026 Freshworks survey of IT leaders found that 86 percent had experienced a negative event tied to unauthorized AI use in the past year. A quarter had seen it happen three or more times. Those aren’t abstract numbers. Each one represents a moment when data left a building it should have stayed in.
In April 2026, that risk played out publicly. One employee at a company using the hosting platform Vercel granted a third-party AI tool broad permissions across the organization’s internal systems. That single decision created a trust path attackers later used to breach the platform. Vercel’s own security team didn’t catch it first. The breach surfaced only when the attacker chose to make the stolen data public. No malware was involved, and no password was stolen. One ungoverned integration was enough.
What an Employee AI Use Policy Actually Needs to Cover
A workable employee AI use policy doesn’t need to be long. It needs to answer three questions clearly enough that no employee has to guess.
Which tools are approved, and which aren’t. Name the specific platforms your team can use. That might be a paid enterprise version of a tool, or a vetted alternative your IT provider recommends. State explicitly that free consumer versions of AI tools are off limits for company data. Vague language like “use AI responsibly” leaves too much room for interpretation. That kind of ambiguity is exactly what got Samsung’s engineering team into trouble in 2023, when employees pasted proprietary source code into a public chatbot on three separate occasions in a single month.
What data can never go into an AI tool. List it specifically: Social Security numbers, dates of birth, bank account and routing numbers, health information, employee records, customer payment data, and anything covered by a client confidentiality agreement. Generic warnings about “sensitive information” get ignored. Specific examples don’t.
Who reviews AI-generated output before it’s used. AI-written emails, contracts, and customer responses need a human check before they go out. This isn’t about distrust of the technology. It’s about catching the moments when AI produces something inaccurate, off-brand, or built on outdated information before a customer or regulator sees it.
None of this requires new software or a formal audit before you can start. Most small businesses can get workable policy language in place with an hour of focused work. Pick your approved tools. Write down your prohibited data list. Decide who signs off on AI-assisted work before it leaves the building.
The Compliance Angle HR Teams Can’t Ignore
An employee AI use policy isn’t only a security document. It’s increasingly a compliance requirement. When an employee enters a customer’s personal information into a third-party AI tool, your business can lose visibility over where that data goes and how it’s processed. You may no longer be able to say with confidence whether it should have been shared at all. Several state privacy laws already treat that kind of uncontrolled data transfer as a reportable event. More states are adding AI-specific provisions to their breach notification rules every year, which means the compliance bar keeps moving even if your policy doesn’t.
HR teams carry particular exposure here. So much of what they handle, offer letters, benefits enrollment, payroll changes, W-2 data, involves information covered by regulation. Say a member of your HR team pastes an employee’s health plan details into an AI tool to draft a benefits summary. That single action can trigger obligations under HIPAA, state privacy law, or both. Good intentions don’t change what the regulator sees.
This is exactly the kind of organizational risk that a documented, enforced policy exists to prevent. Our guide to 10 essential security policies for small businesses covers the broader framework an employee AI use policy fits into. It walks through credential management, incident response, and data classification in more detail.
When a Policy Isn’t Enough: Where Identity Protection Fits In
A strong employee AI use policy reduces how often sensitive data ends up in the wrong place. It doesn’t eliminate the risk entirely. Employees will still make mistakes. Tools will still get misconfigured. A determined attacker only needs one gap to get in, the way a single over-permissioned AI integration did in the Vercel breach.
That’s the point where policy hands off to protection. When an employee’s Social Security number, address, or financial data ends up exposed through an AI-related incident, the damage isn’t abstract. It’s the specific, personal kind of exposure that leads to fraudulent tax filings, opened credit lines, and months of cleanup on that employee’s own time. Employee identity protection benefits give HR teams a way to catch that exposure early. A recovery advocate can start working the case immediately, instead of leaving affected employees to sort it out alone.
Building AI Governance Without Slowing Your Team Down
None of this has to slow your team down. The businesses handling AI well aren’t the ones banning it outright. They’re the ones giving employees clear rules and an approved path to the productivity benefit without the exposure. Start with three moves this month. Publish your employee AI use policy in writing. Walk through it in a single all-hands meeting instead of burying it in a handbook nobody reads. Name one person who owns AI-related questions so employees have somewhere to go instead of guessing.
If employees are already using AI without your knowledge, don’t lead with punishment. A short amnesty period, where employees can disclose their current AI use without consequence, gets you an honest inventory of what’s actually happening across your team. That inventory is worth more than a policy nobody admits to violating. You can’t govern tools you don’t know are in use.
Revisit the policy every quarter. The tools your employees use today will look different in six months. A policy written once and never updated becomes exactly the kind of vague, ignored document that created this gap in the first place.
Writing an employee AI use policy protects your business from the inside. Protecting your employees when a policy isn’t enough is a different job, and it’s one defend-id was built for. Explore how employee identity protection benefits give your HR team a recovery partner the moment exposure happens, not months after the damage is done.
Frequently Asked Questions
What is an employee AI use policy?
An employee AI use policy is a written document covering three things: which AI tools are approved for work use, what data can never be entered into an AI tool, and who reviews AI-generated work before it’s used. It replaces guesswork with clear rules that employees can actually follow.
Do small businesses actually need an AI policy?
Yes. A 2026 Founder Reports survey found that 59 percent of workers at companies with fewer than 10 employees say their employer has no clear AI policy. Generative AI use among small businesses is already widespread, with the U.S. Chamber of Commerce putting adoption at 58 percent and rising.
What is shadow AI?
Shadow AI refers to AI tools employees use for work without their employer’s knowledge or approval. Verizon’s 2026 Data Breach Investigations Report found shadow AI detections rose fourfold in a single year. It’s now the third most common non-malicious insider action found in breach investigations.
What data should never be entered into an AI tool?
Never enter Social Security numbers, dates of birth, bank account details, health information, employee records, or customer payment data into a public or unapproved AI tool. The same goes for anything covered by a confidentiality agreement.
What happens if an employee accidentally exposes data through an AI tool?
Exposed data can be used for identity theft, fraudulent account openings, or tax fraud against the affected employee or customer. Employers should have a response plan in place and should consider identity protection benefits that give affected employees direct access to recovery support.
How often should an employee AI use policy be updated?
Review it every quarter. AI tools and employee usage patterns change quickly. A policy that isn’t updated becomes about as effective as having no policy at all.
Can AI still help my small business if I put a policy in place?
Yes. A clear employee AI use policy doesn’t restrict AI’s benefits, it directs them. Employees get a defined, approved way to use AI for real productivity gains without creating data exposure the business can’t take back.
Related Articles
by Brian Thompson | Jul 8, 2026 | General, Identity Theft, Scams
On July 7, 2026, the IRS and its Security Summit partners launched a five week campaign called “Protect Your Clients; Protect Yourself.” It targets tax professionals squarely, and it makes the case for identity theft protection for tax professionals plainly: small tax and accounting firms are a preferred target for identity thieves, not an afterthought.
Last Updated: July 2026 | Reading time: ~10 minutes
If you run a small tax prep shop, bookkeeping firm, or accounting practice, this campaign is about you. Here is what it covers, why your firm faces exposure, and what to do about it before the next filing season, not during it.
Table of Contents
- Why Tax and Accounting Firms Are a Preferred Target
- What the IRS Summer Campaign Actually Covers
- The Scams Making the Rounds Right Now
- What Smart Firm Owners Are Doing Differently
- What to Look for in Identity Protection Coverage for Your Staff
- Frequently Asked Questions
Why Tax and Accounting Firms Are a Preferred Target
A ten person tax prep firm can hold more concentrated identity data than a mid sized retailer. Names, Social Security numbers, dates of birth, W-2 and 1099 records, bank routing numbers, dependents’ information, sometimes years of returns going back a decade. It is a single, dense target, and most small firms protect it with a shared office password and whatever antivirus came with the computer.
The Security Summit has run this awareness campaign for eleven years for a reason. Tax professionals keep getting hit, and the fallout does not stay contained to the firm. A single breached preparer can hand a criminal ring the raw material to file fraudulent returns in hundreds of clients’ names, each one a multi month recovery process for the victim and a reputational hit for the firm that lost the data.
Small firms also face structural exposure in ways large firms do not. Fewer dedicated IT staff. No formal incident response plan. Client documents moving over email instead of a secure portal. Seasonal staff get a login in January and are gone by May, sometimes with nobody ever revoking their access.
What the IRS Summer Campaign Actually Covers
The 2026 “Protect Your Clients; Protect Yourself” series runs five weekly releases, timed to coincide with the IRS Nationwide Tax Forums running through September (Chicago, then New Orleans August 4 to 6, New York City August 18 to 20, Orlando September 1 to 3, and San Diego September 15 to 17). Here is what each week covers, according to the IRS:
- Week one, new and emerging scams. IRS impersonation by email, text, and spoofed calls. Misleading “tax hack” advice circulating on social media. Fake prospective clients sending malware disguised as tax documents. Phishing attempts targeting a preparer’s EFIN, PTIN, or CAF number specifically.
- Week two, phishing, spear phishing, and whaling. How targeted attacks differ from generic phishing, and the “Security Six” protections the IRS recommends every firm put in place.
- Week three, the written security plan. Federal law requires paid preparers to maintain a Written Information Security Plan. The IRS is using this week to push firms that do not have one, or have not updated it, to fix that.
- Week four, tools that actually help. Multi factor authentication, Identity Protection PINs, IRS Online Accounts, and Tax Pro Accounts.
- Week five, recognizing and reporting theft. What the early signs of a breach look like and the reporting steps that limit the damage, including contacting your local IRS Stakeholder Liaison and your state tax agency through the Federation of Tax Administrators.
The “Security Six,” Explained
Week two is worth pausing on, because the “Security Six” gets referenced constantly in tax industry guidance without much explanation of what it actually requires. Under IRS Publication 4557, the six baseline protections are:
- Anti-virus and anti-malware software, kept on automatic updates so it catches newly identified threats daily.
- Firewalls, both hardware and software, to block unwanted traffic before it reaches a workstation or server.
- Multi factor authentication, on every system that touches client data, not just email.
- Backup software or services, with critical files routinely copied to an external or cloud source.
- Drive encryption, so a stolen or lost laptop does not hand over readable client files.
- A virtual private network, for any connection made outside the office, including a preparer’s home Wi-Fi during a slow afternoon.
None of this is new advice, exactly. What is new is the IRS spelling out, in public, that tax professionals remain a soft and valuable target heading into the back half of 2026.
The Scams Making the Rounds Right Now
Per the IRS’s week one release, four patterns account for most of the current activity against tax professionals:
- IRS impersonation. Scammers use email, text, direct messages, and spoofed caller ID, sometimes with computer generated voices, to push preparers or their staff toward a malicious link or a request for sensitive information.
- “New client” phishing. A fraudster poses as a prospective client and sends an attachment disguised as a tax document. Opening it hands over firm and client data at once.
- EFIN, PTIN, and CAF number theft. These are the credentials that let a preparer file on a client’s behalf. Once stolen, they let a criminal file fraudulent returns that look, on paper, like they came from a legitimate practice.
- Viral tax misinformation. Social media “hacks” convince taxpayers to claim credits they do not qualify for or file with false information, which then lands on the preparer’s desk as a compliance headache, and sometimes as an accusation that the preparer enabled fraud.
What Smart Firm Owners Are Doing Differently
The firms that stay off next year’s breach notification list treat this as an operating requirement, not a once a year training video.
Write the security plan and actually follow it. A Written Information Security Plan is a federal requirement for paid preparers, not a nice to have. If your firm does not have a current one, the IRS publishes a template. If you have one from three years ago, assume it is out of date.
Turn on multi factor authentication everywhere client data lives. Tax software, email, cloud storage, the works. This single step stops the majority of credential based break ins.
Verify before you trust a “new client.” A legitimate prospective client will tolerate a phone call to confirm identity before you open their attachment. A fraudster will not.
Lock down access the day someone leaves. Seasonal and part time staff need offboarding discipline as much as full time employees. Revoke logins the day the engagement ends, not whenever someone gets around to it.
Protect the people who handle the data, not just the data itself. Your staff’s own identities are a target too. A preparer or bookkeeper whose personal Social Security number ends up on the dark web is one incident away from a very bad month, and a distracted employee is a bigger risk to your clients’ data. Offering identity theft protection as a benefit is not just goodwill. It is a control that keeps your team focused and your firm out of a second, unrelated breach story.
What to Look for in Identity Protection Coverage for Your Staff
If you are evaluating identity protection as a benefit for your firm, whether it is three employees or thirty, the features that matter are the same ones that matter for any small business:
- Dark web monitoring, so you find out if an employee’s credentials or Social Security number are circulating before a criminal uses them.
- SSN and credit file monitoring, which flags new accounts or inquiries early, the first sign something is wrong.
- Fully managed recovery, meaning a dedicated advocate handles the calls, disputes, and paperwork if a criminal compromises an employee’s identity, rather than handing them a checklist during your firm’s busiest season.
- Family plan coverage, since a compromised household member’s finances can distract an employee just as much as their own.
- U.S. based support with real response times, measured by how fast someone picks up, not by a features list.
Frequently Asked Questions
Does my small tax practice really need a Written Information Security Plan?
Yes. It is a federal requirement for any paid tax return preparer, regardless of firm size. The IRS publishes a template (Publication 5708) that firms can adapt rather than build from scratch.
What is an EFIN, and why do criminals want it?
An Electronic Filing Identification Number is what the IRS issues to authorize a preparer to e-file returns. A stolen EFIN lets a criminal file fraudulent returns that appear to come from a legitimate firm, which is why this year’s campaign calls out phishing attempts targeting EFINs, PTINs, and CAF numbers specifically.
What should I do if I think my firm has been breached?
Contact your local IRS Stakeholder Liaison immediately so the IRS can move to block fraudulent returns filed under your clients’ names. Also report the incident to your state tax agency through the Federation of Tax Administrators’ data breach reporting page, and follow the FTC’s data breach response guidance for businesses.
Is offering identity theft protection to my employees actually useful, or just a nice-to-have benefit?
Both. For a firm handling client SSNs and financial data all day, a compromised employee identity creates both a distraction and a risk vector at the same time. Coverage that includes dark web monitoring and managed recovery limits how much of your busiest season gets eaten up by one employee’s personal identity theft crisis.
What exactly are the IRS’s “Security Six” protections?
Six baseline controls defined in IRS Publication 4557: anti-virus and anti-malware software, firewalls, multi factor authentication, regular data backups, drive encryption, and a VPN for remote connections. The IRS treats these as the minimum, not a finish line.
How should I handle security for seasonal or part-time tax prep staff?
Treat their offboarding with the same discipline as a full time employee’s. Revoke login credentials, tax software access, and shared drive permissions the day the engagement ends, not weeks later when someone remembers to do it. A seasonal preparer’s forgotten login is one of the more common ways firm data stays exposed long after filing season closes.
The Window to Fix This Is Now, Not January
Tax season is when firms discover their security gaps. Summer is when firms actually have time to close them. The IRS is using its five week campaign to make that case publicly. Use the slow season to write or update your security plan, turn on multi factor authentication, and decide whether your team has the identity protection coverage they need before next filing season puts everyone back under pressure.
If you are evaluating identity theft protection as a benefit for your practice’s employees, defend-id works with small businesses to provide identity theft protection and recovery services for employees and their families. A dedicated, U.S. based recovery advocate is what matters most when something actually goes wrong.
Articles related to protecting tax and accounting firms
by Brian Thompson | Jul 1, 2026 | Identity Theft, Scams
Summer travel scams cost Americans real money every year. The FTC’s most recent Consumer Sentinel data shows travelers reported $274 million in losses tied to travel, vacation, and timeshare fraud. That covers more than 58,000 reports. Most scam victims never file a complaint at all, so the real number is almost certainly higher.
Last Updated: July 2026
What makes summer travel scams different this year isn’t just volume. It’s who’s behind them and how convincing they’ve gotten. AI voice cloning tools that used to require a Hollywood studio now run on a laptop. Travel companies you trust with your booking details are getting breached at a pace that should worry every family planning a trip. If you’re heading out this summer, or you’re an HR leader protecting employees who travel for work, last year’s advice needs an update.
Why Summer Travel Scams Look Different in 2026
Two things changed the landscape this year. First, generative AI made impersonation cheap and convincing. Booking.com’s head of internet safety told attendees at the Collision technology conference that the platform has seen a 500 to 900 percent increase in AI-driven travel scams over the past 18 months. Fake listings and phishing emails that used to have obvious typos now read like they came from a professional copywriter.
Second, the travel companies themselves keep getting breached. Amtrak disclosed a data exposure in April 2026 affecting more than 2.1 million customer accounts. The exposed data included names, email addresses, and support records. Carnival confirmed a breach in June 2026 after a social engineering attack compromised a single employee account. Nearly 6 million people had names, contact details, dates of birth, and in some cases government-issued ID numbers exposed. Security researchers have also tracked a sharp rise in scams impersonating Booking.com, with some travelers receiving fraudulent messages that quote real reservation details before the company even announced a problem.
Put those two trends together and the risk compounds fast. A fake message might already know your real hotel, your real dates, and your real confirmation number. That context makes people less skeptical. It also makes them far more likely to hand over exactly what a scammer needs to open new credit in their name.
Common Summer Travel Scams in 2026
Fake QR Codes at Airports and Hotels
Scammers print stickers that look identical to official QR codes. They place them over real ones on parking meters, menus, and airport signage. Scanning one can send you to a phishing site built to steal login credentials, or trigger a malicious download. Look for signs of tampering before you scan, like a sticker sitting slightly off center. When in doubt, type the website address in manually instead.
AI Voice Cloning (“Vishing”) Calls
Voice cloning tools can now recreate a familiar voice from just a few seconds of audio, often pulled from a social media video. Scammers use the cloned voice to call a family member claiming to be stranded or in legal trouble abroad. They pressure the listener to wire money immediately. The same technique shows up in fake airline and cruise line calls, where an AI-generated agent walks a traveler through a fraudulent refund. If a call creates urgency and asks for money or personal information, hang up. Call the person or company back using a number you look up independently. We cover the mechanics of these calls in more detail in our guide to vishing attacks.
Fake Booking and Rental Websites
Cloned booking sites and hijacked vacation rental listings remain some of the most expensive summer travel scams. They’ve also gotten harder to spot. Scammers now scrape real listing photos and reviews, then advertise the same property at a lower price. They push you to pay outside the platform. Once the payment method is a wire transfer, gift card, or cryptocurrency, the money is effectively gone. Book directly through the hotel’s official site or a platform you’ve used before. Treat any request to pay off-platform as a hard stop.
Travel-Themed Text Message Scams
Expect a wave of texts this summer claiming your flight changed or your booking needs verification. Some promise a refund if you click a link. These messages often arrive with real-looking airline or hotel branding. The urgency is designed to make you tap before you think. Never click a link in an unsolicited travel text. Log into your airline or hotel account directly instead, or call the number printed on your original confirmation. Our smishing breakdown walks through how to spot these messages before you tap anything.
Fake Hotel and Airport Wi-Fi
Public networks with names like “Airport_Free_WiFi,” or a near match to your hotel’s actual network name, can let an attacker see everything you send while connected. That includes login credentials and session data. Confirm the exact network name with staff before connecting. Avoid logging into banking or work accounts on any public network unless you’re running a VPN.
Lost or Stolen Phones and Devices
A lost phone is more than an inconvenience while traveling. It’s often the fastest route into someone’s full identity. Phones typically hold saved passwords, banking apps, and two-factor authentication codes. Use a strong passcode and enable Find My Phone or an equivalent tracking feature. Remove stored passport or payment card details from apps before you leave home.
How to Protect Yourself Before and During Your Trip
- Turn on multi-factor authentication for email, banking, and any travel accounts before you leave. Confirm it also works on payroll or benefits portals if you’re traveling for work.
- Use a VPN on any public Wi-Fi, whether that’s an airport lounge, hotel lobby, or coffee shop.
- Pay with credit cards, not debit cards. Credit cards generally offer stronger fraud protection and faster dispute resolution.
- Set up transaction alerts on the cards you plan to use. That way you catch unauthorized charges within minutes, not weeks.
- Verify unexpected contact through a second channel. This applies to a call from a “relative in distress” or an email about a canceled flight. Call the person or company back using a number you already have.
- Enroll in identity monitoring before you travel, not after something goes wrong. Services like defend-id watch for signs your information is being misused and alert you the moment something changes.
What to Do If You Think You’ve Been Scammed
Speed matters more than almost anything else once a scam happens. Take these steps in order:
- Contact your bank or card issuer immediately. Dispute the charges and lock down the affected account.
- File a report at IdentityTheft.gov. This gets you a personalized recovery plan from the FTC.
- Place a fraud alert or credit freeze with one of the three major credit bureaus. They’re required to notify the other two.
- Document everything. Save dates, names, confirmation numbers, and copies of any messages from the scammer.
- Get help if the case involves a real financial loss. Identity theft cases with financial impact are far less likely to resolve without support. This is exactly the gap defend-id’s restoration advocates are built to close. They handle the calls and paperwork so you don’t have to untangle it alone.
🚩 Free Travel Safety Checklist
Download our Travel Safety Checklist here and keep it on your phone for quick reference before and during your trip.
Travel Safety FAQ
Should I use public charging stations at airports?
No. Public USB charging ports can be compromised in an attack known as juice jacking. A modified port can install malware or pull data while your phone charges. Bring your own charger and wall adapter, or carry a portable battery instead.
Is it safe to book travel deals I found on social media?
Treat social media travel ads with caution. Scammers routinely build convincing ads for fake vacation rentals and discounted packages. Verify any deal on the company’s official website before entering payment information. Be skeptical of prices that are dramatically lower than everywhere else.
What should I do if I lose my passport while traveling internationally?
Contact the nearest U.S. embassy or consulate immediately to begin the replacement process. Keep a digital copy of your passport’s photo page stored securely before you leave. It speeds up the replacement significantly.
What if I lose my phone during my trip?
Use Find My Phone or your device’s equivalent to lock or wipe it remotely. Then change the passwords on any accounts that were logged in on that device. Start with email and banking.
Are AI voice cloning scams really that convincing?
Yes. Modern voice cloning tools need only a few seconds of audio to generate a convincing fake of someone’s voice, often pulled from a public social media post. The defense isn’t spotting the fake by ear. It’s verifying any urgent request for money through a second channel before acting.
How is a summer travel scam different from identity theft?
A travel scam typically targets your money directly, like a fake booking charge. Identity theft happens when a scammer uses information collected during that scam later. That can mean your name, date of birth, or passport number used to open new accounts or file fraudulent claims. That’s why even a small travel scam is worth monitoring for months afterward.
For HR Teams: Protecting Employees Who Travel This Summer
Summer means more employees booking personal vacations and more teams traveling for conferences and client visits. Both create exposure that eventually lands on HR’s desk as lost productivity or a compromised work account. A few low-lift steps make a real difference:
- Send a short, five-point security reminder before major travel windows instead of relying on an annual policy document nobody reads.
- Confirm MFA is enabled on payroll and benefits portals specifically, not just email.
- Share the Travel Safety Checklist in your next newsletter or pre-trip email.
- Offer an identity protection benefit like defend-id so employees have a fast, professional resource if something goes wrong on the road.
If work travel specifically is your priority, we go deeper on device security, payroll portal risk, and pre-trip protocols in our guide to preventing identity theft during work travel.
Conclusion
Scammers have better tools this year. The fundamentals of staying safe haven’t changed nearly as much as the threats have. Verify before you trust. Pay with a credit card. Keep your accounts monitored, and treat any unexpected urgency as a reason to slow down rather than speed up. A few minutes of caution before you leave is a lot cheaper than months spent untangling identity theft after you get home.
Related Articles:
by Brian Thompson | Jun 17, 2026 | Breach, Employee Benefits, Identity Theft
Constella Intelligence is one of the companies that powers many of the identity protection services operating in the U.S. today. Every quarter they publish a breach report drawn from their global monitoring network. Their Q1 2026 data breach report covers January through March 2026, and the numbers are worth paying attention to if you have employees.
Here is what the report found, in plain terms.
Criminals stole a staggering amount of data in just three months
In the first quarter of 2026, Constella tracked more than 229,000 breach events across the open web, dark web, and underground forums. After filtering out duplicates and low-quality data, investigators confirmed 3,685 of those as real incidents containing usable identity information. Those breaches produced 9.73 billion verified records.
For comparison: Constella confirmed 8,460 total breaches across all of 2025. The 2026 pace is running nearly double that.
The odds that at least one of your employees has personal data sitting in that pool are not low. They are close to certain.
It is not just passwords being stolen anymore
This is the part that matters most for HR and benefits teams.
The largest category of Q1 breaches came from direct attacks on primary databases: government systems, telecom providers, financial institutions. These are not recycled credential lists. They are fresh records pulled from the source. In fact, 95% of those breaches contained more than just a username and password. Attackers walked away with phone numbers, home addresses, national ID numbers, and financial account details all bundled together.
That is a complete identity profile. Criminals do not need to piece it together from multiple sources. It comes pre-assembled.
One more number worth sitting with: companies holding your employees’ data stored 42% of those breached passwords in plain text. No encryption. No protection. Anyone who accessed those databases got working credentials instantly.
Your employees did everything right and still got exposed because someone else did not.
There is a type of attack most employees have never heard of
The second major finding in the report involves something called infostealers. Most non-technical people have never encountered this term, so here is a plain-language explanation.
An infostealer is a type of malware that runs quietly in the background on an infected computer. It does not lock files or demand a ransom. Instead, it copies every saved password, every active login session, and every stored credential from the device and sends that data to whoever deployed it. Then it disappears.
In Q1 2026, Constella processed 31.6 million of these stolen data packages, pulled from 2.77 million infected devices worldwide.
Why does this matter for your employees specifically? Two reasons. First, infostealers capture active session data, not just passwords. As a result, even accounts protected by two-factor authentication can fall to this attack. Changing the password afterward does not fix it. Second, employees who use personal devices for any work-related task, or whose family members share a home computer, have no corporate IT protection against this. In other words, it is a household risk, not just a workplace one.
The sectors hit hardest are ones your employees use every day
Finance and retail led Q1 breach counts. Government databases came in third. Healthcare was in the top ten.
These are not fringe platforms. They are banks, online stores, insurance portals, and benefits systems. The top five individual breaches of the quarter hit a data broker, a streaming service, a car marketplace, a retail chain, and a shipping company. Combined, those five incidents alone exposed 270 million records.
Every account your employees have ever created is a potential exposure point. Not because of anything they did, but because of how the companies holding their data chose to protect it.
What this means if you are evaluating identity protection as a benefit
The argument for offering identity protection as an employee benefit used to center on awareness and vigilance. Teach employees to spot phishing. Use strong passwords. Enable two-factor authentication. That advice is still worth giving. But the Q1 2026 data breach report makes clear it is not enough on its own.
Today, employers expose employees through breaches at companies those employees trusted years ago. The stolen data is complete enough to open new accounts, file fraudulent tax returns, and take over existing financial accounts. Additionally, the methods attackers now use, like infostealers, bypass the standard defenses most individuals have in place.
Monitoring, early alerting, and professional recovery support are not a luxury add-on. They are the difference between catching a problem in week one and finding out six months later when the damage is done.
If you are still on the fence about whether identity protection belongs in your benefits package, Q1 2026 answers the question plainly. The risk is real, it is growing, and it is landing on ordinary employees.
Learn more about how identity theft protection works as an employee benefit, or review our small business post-breach playbook for what to do if your company is affected. For a closer look at the attack methods behind these numbers, see our guides on phishing and third-party data breaches.
Source: Constella Intelligence, Q1 2026 Quarterly Breach Report. All statistics in this article come directly from that report. Full methodology available at constella.ai.
by Brian Thompson | Jun 15, 2026 | Identity Theft
Last Updated: June 2026 | Reading time: ~9 minutes
In March 2026, nearly 2.7 million employees and their dependents received breach notification letters from a company most of them had never heard of. Navia Benefit Solutions, a Washington-based benefits administrator serving more than 10,000 employers, disclosed that attackers had accessed its systems for 24 undetected days between late December 2025 and mid-January 2026. The data taken included Social Security numbers, dates of birth, and FSA, HRA, and COBRA enrollment details going back to 2018. Those employees did not choose Navia. Their employers did.
That is the exposure embedded in modern benefits administration. Your FSA vendor, your COBRA administrator, your HRA platform: each one holds a concentrated file of employee identity data. When any one of those vendors is breached, the notification goes to your workforce, your company’s name appears in the context, and the reputational and productivity fallout lands in HR. Identity theft protection as an employee benefit is no longer a financial wellness perk. It is a risk management decision, and 2026 is the year most HR leaders are being forced to treat it that way.
The Scope of the Problem in 2026
The Federal Trade Commission received 1.1 million identity theft reports in 2024, a 9.5% increase from the previous year. (FTC Consumer Sentinel Network Data Book, 2024.) Javelin Strategy and Research puts total identity fraud losses at $27.3 billion in 2025, affecting 18 million U.S. victims. A new identity theft victim is created roughly every five seconds in this country.
Employment-related identity theft, the category most directly relevant to your workforce, generated 87,473 FTC complaints in 2024. That represents a 20% increase year over year. This category covers criminals using stolen Social Security numbers to apply for jobs, claim wages, or file fraudulent tax returns under a victim’s name. The complications for affected employees extend across years, not weeks.
The numbers that matter most for a benefits decision split into two very different stories. Most identity theft is minor and resolves quickly: the Bureau of Justice Statistics’ Identity Theft Supplement, the largest and most rigorous dataset available, found that a majority of victims (56%) spent one day or less resolving financial or credit problems from their most recent incident. (Bureau of Justice Statistics, 2021.) A fraudulent card charge is often a 20-minute phone call.
But a meaningful minority of cases are nothing like that. New-account fraud, tax-related fraud, and government ID fraud are far more severe, with the FTC reporting an average of 77 hours to resolve new-account fraud and the Identity Theft Resource Center’s Aftermath Study finding that severe cases can run as high as 600 hours, often spread over 6 to 22 months. (ITRC Aftermath Study.) Roughly 5 to 8% of employees experience one of these more serious cases in a given year, and because resolution requires calls to banks, credit bureaus, and government agencies, almost all of that time falls during the business day.
What Identity Theft Actually Costs Your Company
The direct costs to the employee get most of the attention: damaged credit, fraudulent tax filings, drained accounts, the exhausting work of untangling fraudulent lines of credit opened in their name. Employers absorb a substantial share of the cost too, through channels that rarely surface in a benefits discussion.
Productivity is the most immediate one. For the 5 to 8% of employees who experience a serious case, dozens to hundreds of hours of resolution work land during business hours over a period of weeks or months. Those employees are not performing at capacity, regardless of whether they are physically present. Researchers call this presenteeism, and its cost to employers consistently exceeds the cost of outright absenteeism. The company pays full salary for significantly diminished output throughout what can be a months-long resolution process.
Benefits and complications follow closely. An employee victimized by medical identity theft may find fraudulent claims attached to their health plan, which drives up costs and creates coverage disputes that HR must help untangle. Fraudulent payroll direct-deposit changes, a tactic flagged repeatedly by the FBI Internet Crime Complaint Center, redirect an employee’s paycheck before anyone realizes something is wrong. Each of these scenarios eventually reaches HR.
Company network exposure is the third layer that most organizations underestimate. Social engineering attacks almost always begin with personal data on an individual target. An attacker holding an employee’s Social Security number, date of birth, home address, and benefits enrollment details has exactly what is needed to build a convincing impersonation. That impersonation can reset passwords, bypass multi-factor authentication challenges, or socially engineer access to company systems from a trusted-looking identity. Your employees’ personal data and your company’s cybersecurity posture are directly connected, even if your IT team has never mapped that relationship formally.
Why Your Benefits Vendor Ecosystem Is a Target
The Navia breach fits a pattern that accelerated sharply in 2025 and 2026. TriZetto, a billing systems provider used by thousands of healthcare organizations, disclosed a breach in early 2026 that compromised approximately 3.4 million records. Conduent, which provides payment and document processing services to large health insurers including Anthem, suffered a breach affecting state government employees across multiple states. Benefits administrators keep appearing in breach reports for a specific reason.
These vendors hold dense concentrations of high-value identity data, with records spanning multiple years, across thousands of employer clients at once. A single successful intrusion gives attackers Social Security numbers, employer IDs, dates of birth, health plan details, and contact information for entire employee populations. Unlike a retail breach that captures credit card numbers that can be canceled and reissued, a breach of benefits data captures identity information that is permanent. Your employee’s Social Security number and date of birth do not change after a breach.
The practical implication for HR leaders is clear. Offering identity theft protection as an employee benefit is not only a financial wellness move. It functions as a recovery mechanism for the exposure that already exists inside your vendor ecosystem, before any breach at your own organization ever occurs. Your employees may already need it because of decisions your company made when selecting third-party vendors.
What Employees Expect From Their Employer on This
A LegalShield survey found that 60% of employees have experienced identity theft attempts. More than half of those employees reported interest in identity theft protection as a workplace benefit. A separate 2024 PeopleKeep survey found that 81% of employees consider an employer’s benefits package an important factor in whether they accept a job offer.
Identity theft protection has crossed from ancillary perk to expected offering in a relatively short window. Willis Towers Watson data showed that 78% of employers planned to offer the benefit by 2022. That window closed several years ago. Employers who have not added this benefit are behind the expectation baseline their workforce already holds, not ahead of a trend.
The voluntary benefit structure makes this more straightforward than most HR leaders assume. Employees pay for most or all of the premium through payroll deduction at a group rate lower than anything they could access on their own. A Benefits Pro survey found that 83% of employees would enroll in a voluntary benefit without expecting their employer to fund it. The request from employees is access to the benefit, not necessarily a subsidy. Employer cost is frequently limited to the administrative work of making the program available during open enrollment.
What to Look for When Evaluating an Identity Theft Protection Provider
Not all identity theft protection products are equivalent. A few criteria separate programs that genuinely help employees from programs that create the appearance of protection without the substance.
Recovery advocacy matters more than monitoring alone.
Dark web monitoring and credit alerts are table stakes at this point. Every provider offers them. The differentiating factor is what happens after a problem is detected. A program with a dedicated recovery advocate, a specialist who works directly on the member’s behalf to restore their identity, is categorically different from a program that sends alerts and leaves the resolution work to the employee. For the minority of employees who face a serious, time-consuming case, a recovery advocate is the difference between weeks of disrupted productivity handled by a professional and weeks of disrupted productivity handled by the employee alone, on company time. When evaluating providers, ask specifically how case resolution is handled and who does the work.
Family coverage scope deserves direct evaluation.
An employee’s identity theft risk does not stop at their own Social Security number. Spouses, dependent children, and in some cases parents and in-laws face exposure through the same household data. Child identity theft is particularly damaging because it typically goes undetected for years, often discovered only when the child applies for their first credit card or student loan. A benefit that covers only the enrolled employee leaves significant family exposure in place. Confirm the exact scope of dependent coverage before committing to any program.
Insurance limits should reflect realistic exposure.
Programs typically offer between $25,000 and $1 million in identity theft insurance coverage. The lower end handles the majority of scenarios most employees encounter. The higher end matters for employees with more complex financial exposure. Understand exactly what the insurance covers and what exclusions apply before using coverage limits as a selling point internally.
Enrollment simplicity drives actual adoption.
A program that requires complex setup, multiple disconnected platforms, or a confusing user interface will have low participation regardless of the quality of the underlying protection. Ask prospective providers for adoption rate data across their current employer client base. Low adoption is almost always an interface and onboarding problem, not an employee awareness problem.
Frequently Asked Questions
Is identity theft protection a taxable employee benefit?
No. The IRS does not treat employer-sponsored identity theft protection as taxable income when structured as a voluntary benefit through payroll deduction. Premiums are post-tax deductions for the employee. Employers should confirm their specific plan structure with their benefits counsel before launch to ensure compliance with applicable rules.
How much does identity theft protection cost as an employee benefit?
Group pricing through an employer typically ranges from $5 to $15 per employee per month, depending on coverage tier and family options. That is significantly lower than individual retail pricing for comparable protection. Many employers offer it as a fully voluntary, employee-paid benefit, which limits employer cost to the administrative work of making the program available.
What is the difference between credit monitoring and identity theft protection?
Credit monitoring watches your credit file and alerts you when changes occur. Identity theft protection is broader in scope. It adds dark web surveillance, public records monitoring, identity theft insurance, and professional recovery assistance when fraud is detected. Credit monitoring tells you a problem exists. Identity theft protection helps you resolve it, often with a dedicated advocate managing the case on your behalf.
Can identity theft protection cover an employee’s family members?
Most employer-sponsored programs offer family tiers that include a spouse, dependent children, and sometimes extended household members such as parents and in-laws. Coverage terms for adult children living outside the home vary by provider. Family coverage is a critical evaluation criterion, particularly because minor children are high-value targets for identity theft and the damage typically goes undetected for years.
How does a breach at a benefits administrator affect my employees’ identity theft risk?
Benefits administrators hold some of the most valuable identity data available to attackers: Social Security numbers, dates of birth, health plan details, and enrollment history for entire employee populations, often going back multiple years. When a benefits administrator is breached, that data can be used for phishing attacks, fraudulent tax filings, medical identity theft, and account takeover. The Navia Benefit Solutions breach in early 2026 exposed records on 2.7 million individuals across more than 10,000 employer clients, illustrating the scale of this exposure and how broad the downstream impact can be for HR teams.
How long does identity theft resolution take?
It depends heavily on the type of case. Most identity theft is minor and resolves in a day or less — the Bureau of Justice Statistics found that 56% of victims spend one day or less resolving the issue. But 5 to 8% of employees face more serious cases. New-account fraud averages 77 hours to resolve, and the most severe cases — tax-related or government ID fraud — can stretch 6 to 22 months. Almost all of that time falls during business hours. A dedicated recovery advocate takes that burden off the employee and off company time for the cases where it matters most.
How do employees enroll in identity theft protection through their employer?
Most providers integrate with existing HR portals and payroll systems. Employees enroll during open enrollment or new hire onboarding, with premiums deducted from payroll post-tax. The provider delivers a welcome communication with account setup instructions. Initial activation typically takes less than ten minutes. Providers with strong onboarding communication see significantly higher adoption rates than those that rely on employees to self-initiate setup.
To learn how defend-id delivers identity theft protection as an employee benefit, including family coverage, dedicated recovery advocacy, and group pricing for employers of all sizes, visit defend-id.com.
Related Articles
