Over 80% of employees overshare on social media, potentially exposing themselves and their employer to online fraud, phishing and other cyber-threats.
Now, IT expert John Pepper, CEO and founder at Managed247, a managed IT service provider, is warning that employees could be unintentionally giving cybercriminals valuable information about their organizations through everyday social media posts. He urges businesses to pay closer attention to what employees are sharing online and offers practical advice for businesses and employees on how to reduce the risks associated with their digital footprint.
1. Employees could be impersonated
More than 220,000 fraud-risk cases were recorded to the National Fraud Database in the first six months of 2026, with identity fraud accounting for 59% of cases, according to fraud prevention service Cifas. Social media can provide cybercriminals with a wealth of information about employees and the organizations they work for, including names, job titles, places of work, company locations, colleagues, clients and professional responsibilities.
This information could be used to impersonate a member of staff, manager or company director and make convincing requests for money, sensitive information or access to business systems.
“Employees can unintentionally give criminals a lot of useful information about themselves and the people they work with,” Pepper said. “When those details are brought together, it can make it much easier for someone to convincingly impersonate a colleague or senior member of staff.
“Businesses should think about employees’ digital footprints as part of their wider cybersecurity strategy and make sure staff understand what information could potentially be useful to someone outside the organization,” he added.
2. A social media post could help build a targeted scam
The more criminals know about an organization, the easier it can be to make a scam appear genuine. Social engineering often involves attackers using information gathered online to make fraudulent messages appear genuine. By monitoring employees’ social media activity, criminals can identify who works for an organization, what their responsibilities are and who they regularly interact with.
For example, an employee posting about a new role, project or business relationship could inadvertently give criminals enough information to create a convincing message that appears to come from a colleague, customer or supplier.
“Social engineering works because criminals are trying to make their messages feel familiar and trustworthy,” Pepper said. “The more information they can find about an organization and its employees, the easier that becomes.
“If an employee receives an unusual request involving money, confidential information or access to a system, it’s always worth checking through another trusted channel before taking action,” he added.
3. How AI can be used in employee impersonation
Scammers need just three seconds of audio to clone a person’s voice, and with so many videos available on social media, it is becoming increasingly easy for criminals to generate convincing voice clones. Similarly, publicly available photographs and videos can be used to create AI-generated images and deepfakes.
For businesses, this could mean criminals attempting to impersonate employees, directors or other company representatives.
“AI is a useful technology and there are plenty of positive ways businesses can use it, but like any technology, it can also be misused,” Pepper said. “Businesses should be aware that publicly available photos, videos and recordings can potentially be used to make an impersonation more convincing. The important thing is not to panic, but to have sensible processes in place so that unusual requests are independently checked, particularly when money or sensitive information is involved.”
4. What employees post can affect a company’s reputation
Oversharing on social media can also create significant reputational risks for businesses. Employees may unintentionally associate their personal accounts with their employer by listing their workplace, using company branding or discussing their professional lives.
“Employees are often seen as representatives of a business whether they intend to be or not, so it’s worth thinking about how personal social media activity could be perceived,” he said. “What you post online can sometimes have a much longer life than you expect, especially when your social media profile is linked to your workplace. Something shared in a personal capacity can still influence how customers, colleagues or potential clients view you and the business you work for.”
5. A harmless post could reveal more about your business than you realise
One of the biggest risks of oversharing is inadvertently revealing information that could be useful to cybercriminals or competitors.
Employees may not realize that seemingly harmless posts can provide valuable intelligence about an organization. Photos from inside an office could reveal security systems, access points, screens or documents. Posts about upcoming projects could disclose confidential business plans, while announcing new clients, suppliers, software systems or company locations could give attackers useful information about the organization’s operations. Even seemingly innocent posts, such as celebrating a new contract or sharing photographs from a workplace event, can reveal information that businesses may not yet want to make public.
“Employees don’t necessarily need to share confidential documents to reveal useful information about a business. Sometimes it can be the small details that add up,” Pepper said. “A photo from the office, a post about a new client or even an update about an upcoming project could give someone outside the organization a better understanding of how that business operates.
“It’s about encouraging employees to take a second before posting and think about whether there’s anything in the background or in the caption that they wouldn’t want a stranger to know,” he added.
Photo credit: jannoon028/Freepik
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
