UK workers are shockingly relaxed about selling access to company systems

UK workers are shockingly casual about insider‑enabled fraud, with one-in-eight admitting to having sold company logins.

In the last 12 months alone, 13% said they had either sold their company login details to a former colleague, or that they knew someone who has.

The figures from the UK’s fraud prevention service, Cifas, show that 13% of respondents believed selling access to company systems was ‘justifiable’.

That number was even higher for senior managers, at 32%, and directors at 36%.

Latest Videos From

Among C‑suite executives, this figure rose to 43% while for business owners themselves, the figure was an astonishing 81%.

“These findings point to an unsettling reality: for a meaningful minority of staff, selling company logins is no longer beyond the line – and that should concern every employer," commented Joby Carpenter, fraud and emerging threats lead at anti-financial crime certification and intelligence company ACAMS.

“Cifas’ survey suggests insider risk is not only persistent, but in some settings it’s becoming normalized. For firms, this underlines the need to treat insider threat as a core fraud and financial crime issue, supported by strong culture, proportionate controls, targeted training, and effective access governance.”

Researchers said effective fraud prevention relies not only on secure systems, but on strong access governance, regular staff training, and a clear organizational stance on the misuse of credentials.

“Selling login details might seem insignificant to those involved, but it can open the door to serious fraud and financial harm. These findings show how vital it is for organisations to build fraud‑aware cultures, where employees at all levels understand their responsibilities and the consequences of their actions," said Rachael Tiffen, director of learning at Cifas.

“Counter‑fraud training plays a central role in helping staff recognise manipulation, appreciate the risks associated with insider activity, and act with integrity when handling access to systems and data.”

Insider threats are rising

A slew of studies over the last two years point toward rising insider threats. A report from Arctic Wolf, for example, found that 61% of organizations had spotted insider threats during 2024, with 29% of those leading to a leak.

Similar research last year from Exabeam concluded that two-thirds of European security professionals now see insider threats as a bigger risk than external threat actors.

More than half said they’d seen a measurable increase in insider incidents over the last year, with 54% saying they expect that growth to continue.

Cyber criminals are aware of the openness of many workers to fraud, and have been actively recruiting company insiders on the dark web, with researchers at NordStellar saying earlier this year they'd found 25 unique dark web posts attempting to recruit employees for fraud.

Aiming to target specific organizations, particularly social media or cryptocurrency platforms, they are hoping to carry out ransomware attacks, sell information on business agreements to competitors, or carry out sophisticated phishing scams.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.