According to fraud prevention service Cifas, a surprisingly large number of UK employees have sold their corporate credentials over the past year, exposing their organisation to cyber and financial crime.

In its Workplace Fraud Trends report, which is based on responses from 2,000 UK employees working in companies with 1,000+ staff, 13 per cent of respondents admitted to selling their logins over the past 12 months or knew someone who had.

The same percentage of staff claimed they thought the act of selling credentials was “justifiable”, and among C-suite executives, the figure rose to 43 per cent and to an incredible 81 per cent among business owners.

The report suggests that insider risk is not only persistent but, in some settings, becoming normalised.

This worrying trend underlines the need to treat insider threat as a core fraud and financial crime issue.

Cybercriminals are aware of the willingness of this minority of employees to commit fraud for a cash return and recent research suggests there are at least 25 unique posts on the dark web that are attempting to recruit workers into aiding fraudulent activity.

Employees selling their logins can open the door to serious fraud and financial harm, allowing criminals to bypass security and cause data breaches that can severely damage the business’s reputation.

Roger Isaacs, Forensics Partner at Milsted Langdon, said, “These findings are hard to believe, but even if a much smaller percentage of staff are selling their login details, it is still a cause for concern.

“Many businesses still focus most of their fraud prevention efforts on external threats, when in reality, employees and contractors can pose a significant risk because they already understand the systems and controls in place and are therefore better positioned to exploit them or to provide access to outsiders.

“Once legitimate credentials are compromised, it can become extremely difficult to distinguish genuine activity from fraudulent behaviour, especially where access is being used remotely or outside normal working patterns.

“Businesses need to build fraud‑aware cultures where employees at all levels understand their responsibilities and the damage they could cause by selling their logins.

This type of fraud also highlights the importance of removing access from anyone who ceases to be an employee of a business, especially if they have departed on acrimonious terms.”