October is Cybersecurity Awareness Month, and most of the advice doing the rounds focuses on passwords, phishing links, and software updates. All of it matters, but one risk gets far less attention, and my work shows it to me from an unusual angle: the online profiles people build about themselves.
Social media has become an extension of our professional identities, with platforms such as LinkedIn used to share career achievements, professional experiences, opinions and connections. However, the information we share publicly can also become a valuable resource for cybercriminals. Details about an individual’s role, employer, colleagues and professional activities can be used to build convincing impersonation attempts, targeted phishing attacks and other forms of social engineering. For employers, this highlights the importance of understanding the digital footprint of individuals entering their organisations. Social media screening, conducted responsibly and with the necessary consent, can provide an additional layer of insight into publicly available information, helping businesses identify potential risks and make more informed hiring decisions.
What strikes me in my work is how much a public profile gives away. Not scandal, detail. Where someone works and for how long. Who they report to. The qualification certificate they posted the day they graduated. Where their children go to school. Their voice, from a conference panel posted online. Their face, from every angle, across ten years of photos.
That is exactly the raw material an impersonator needs.
And impersonation has changed. AI-generated impersonation now accounts for 22% of identity fraud cases in South Africa, the highest share in Africa, according to the Smile ID 2026 Digital Identity Fraud Report. A convincing fake no longer needs a film studio. It needs clear video and audio of the person, and many of us have published hours of it ourselves.
Hiring itself has become a target. Research firm Gartner predicts that by 2028, 1 in 4 job candidate profiles worldwide could be fake. In its survey of 3,000 job seekers, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them. Gartner’s own warning is that candidate fraud creates cybersecurity risks far more serious than a bad hire. A fake employee with system access is not a recruitment problem. It is a breach with a payslip.
So what does that mean in practice this month?
For individuals, it starts with looking at yourself the way a screener would. Search your own name across the platforms you use and ask one question of everything you find: does this tell a stranger where I am, who I report to or who my family is? Then share with purpose. Your achievements belong on a professional profile. Your ID document, your qualification certificates and the details that answer security questions, such as birthdays, pets’ names and schools, do not. Do your own due diligence too: if a recruiter asks you to pay for a background check or any other fee before you are hired, check that the company and the job are real before any money moves. Above all, agree on a call-back habit at home and at work. If a voice note or video call asks for money, access or a password, end it and call back on a number you already have.
For employers, three things matter more than they did a year ago.
First, verify identity properly, and more than once. A copy of an ID at the first interview is not enough when faces and voices can be faked. Use identity verification that matches the person to the photo on the official record, confirm that the person who was interviewed is the person who arrives on day one, and keep checking for roles with access to money, systems or data.
Second, put it in policy. Whatever checks form part of your hiring, including social media screening, should follow one documented process, applied the same way to every candidate. Social media screening can only be done with the candidate’s consent, so build consent into that process from the start. Consistency is what turns a check into a genuine security control rather than a judgement call.
Third, treat your own people’s public footprint as part of your security. The executive whose voice is on every podcast is the easiest one to clone. Build call-back steps into every payment and access request and make them so routine that nobody takes them as an insult.
Employers are already responding. At MIE, identity verification has grown 12% year on year, and we have now completed close to half a million identity verifications to date. That is a significant increase in a single year, and it tells me employers have stopped taking identity at face value. Cybersecurity is usually framed as a technology problem. Increasingly, it is an identity problem. Proving that people are who they say they are and making it harder for anyone else to be them. The profile you built to get hired, and the one your company built to win business, are real assets. This month is a good time to make sure they are not also the easiest way in.
By Jessica De Beer – MIE Operations Executive
