Your Online Professional Profile Is Now an Attack Zone

Published on October 29, 2026

Online social networks, including the professional ones, are no longer deception- and fraud-free zones. Although we would like to believe that the spaces we go to build careers, to network intentionally for professional and philanthropic purposes, or to engage with community peers to advance our portfolio career journeys are free of malicious intent, sadly this is no longer the case. 

Eight in ten of us have already been targeted

This month (October), our community met for a session on AI, online impersonation and executive hiring. We opened with one question: have you received a suspicious recruitment solicitation or board-seat offer in the last year? Of the 44 people who answered, 35 said yes. That is 80%.

The moderator explained why this topic was the focus of the event agenda. In three months, he had received at least ten messages from supposed "retained search consultants". Each one recited his career point by point. Several came from personal webmail accounts, and a few offered advisory fees of around 600,000 USD annually. The goal wasn't his money. It was his name: to lend credibility to a scheme aimed at other people.

Broader data sets from global sources show that he wasn’t alone:

  • The FBI's Internet Crime Complaint Center recorded a record 20.9 billion USD in reported losses in 2025. More than 22,000 complaints involved AI, with losses above 893 million USD, and the FBI says this figure likely underrepresents actual total volume  (The Register).

  • US reports of online job scams rose 19% in the first half of 2025, with almost 300 million USD lost (Fortune, citing FTC data).

But the above issue of online fraud in professional social media and via email is just one aspect of cybersecurity risk today. And since October is Cybersecurity Awareness Month, we decided to mark the occasion by going back through five years of community conversations on cyber risk, crisis and AI and contrast issues addressed and discussion findings with what is happening now. The tools have changed almost beyond recognition. Most of what protects us has not.

Five years of cybersecurity conversations

Over five years, cyber risk has moved from the IT budget to the CEO's desk (as well as to governance and advisory boards). And now it impacts each of us personally.

2021: cyber climbs the crisis list. A speaker who had run operations across five continents described watching cybersecurity "skyrocket to the top" of a Fortune 500 company's priorities. He warned that size offers no shelter: every business, however small, has to cover risk related to cyber, reputation and social media. A director on the same call noted that most boards still handled crises reactively. (How Boards Handle Crisis Management, 2021)

2021: we learn to trust a face on a screen. Weeks into lockdown, a speaker warned that remote work was quietly wearing down the trust teams depend on. He also flagged risks few had considered, such as a competitor reading your screen in a café. Five years on, the face on the screen can itself be fake. (The Sudden Move to Virtual Working, 2021)

2025: cyber becomes a director's liability. An insurance specialist explained that boards are now held responsible for security controls, testing and even how much cyber coverage was bought. After Target's 2013 breach, directors faced claims alleging poor preparation. This director’s reminder: you don't have to do anything wrong to be sued; you only have to be accused. (Board Directors & Risk: Why Director Liability Coverage Should Be Top of Mind, 2025)

2025: AI raises the stakes. A panel including a privacy attorney and a senior defence-technology leader asked why we would accept less accuracy just because AI is involved. They urged boards to insist on red-teaming and human-in-the-loop practices; and to treat AI as a tool, not a colleague. (Boards, Information Security, and Ethics in an AI World, 2025)

2026: the warning signs are there, but filtered. Two governance specialists showed how risk is softened on its way to the board, so dashboards stay green while problems grow underneath. Cyber resilience, they argued, is an enterprise risk, not an IT one. (When Oversight Feels Strong… But Risk Is Quietly Growing, 2026)

2026: AI starts acting on its own. A legal panel compared an AI agent to a tireless intern with access to your calendar, contracts and credit cards. Their conclusion: "the AI did it" is not an acceptable defence argument. (Is Agentic AI a Legal Liability Nightmare? What Corporate Directors Should Know, 2026)

2026: the target is you. This month's panel described the newest troubling phenomenon. Attackers no longer need to break into a system. They can borrow a person: a face, a voice, a career history and a network others already trust. (Would You Spot the Fake? AI, Impersonation & the Future of Executive Hiring, 2026)

How these new types of scams work

A convincing (deep) fake of a senior-level person now takes minutes, and costs less than a lunch, to create.

During this month's learning session, a panellist who builds likeness-protection tools showed how this is done. She took the moderator's photo from a web search and ran it through a generative video tool that has a monthly subscription fee of about 14 USD. In under five minutes she had a video of him saying whatever she typed, and a short audio sample used for voice replication made it sound like him.

The same technique already works against large companies:

  • Arup, 2024. A finance employee in Hong Kong made 15 transfers totalling about 25.6 million USD after a video call with people who looked and sounded like the firm's CFO and colleagues. Every one of them was a deepfake (CNN).

  • WPP, 2024. Fraudsters set up a WhatsApp account with the CEO's public photo, then held a Teams meeting using a cloned voice and YouTube footage of a senior executive. They asked an agency leader to set up a new business. Staff spotted it and the attempt failed (case summary of The Guardian's news report).

Why target board members and advisors? The session's privacy and AI attorney gave two reasons. A flattering board-seat offer is a cheap way in, and the payoff is large. A scammer who recruits a few respected names gains legitimacy, then uses it to approach an even bigger target for information, intellectual property or money.

This means the main risk to board directors and C-level leaders, like many of you who attended the session,  is reputational, not financial. If your identity is used to front a scam, your livelihood is at stake. Even an innocent victim can be pulled into an investigation as a witness, and rebuilding credibility takes a considerable amount of time.

The flip side of the coin: fake candidates

The same tools that fake recruiters can also fake candidate personas, and the hiring company carries the risk.

Gartner predicts that by 2028, one in four candidate profiles worldwide could be fake (HR Dive). The most serious cases already stand before the courts. In June 2025 the US Justice Department announced charges against the initiators of a North Korean-originated scheme in which remote IT workers used stolen or fake identities to get hired by US companies, including Fortune 500 firms. Their wages funded the regime's weapons programme, and some gained access to sensitive military technology data (AP).

The panel described the same pattern from inside hiring:

  • Profiles outlive people. An HR and talent advisor was once contacted by a recruiter still listed on a search firm's website. When she called the firm, she learned the recruiter had already left.

  • Privacy rules leave a gap. Under GDPR, European recruiters avoid asking for ID until the final stage. That protects candidates, but it lets a fake recruiter or candidate get a long way before anyone runs thorough background checks.

  • Interviews can be scripted. Some tools keep a candidate's eyes on the camera while they read from a prompter, and others put a cloned face on the call. In one reported case, a hiring  team reached the final stage of vetting with an engineer who turned out not to be who he claimed.

  • The employer is liable. If a company pays someone from a sanctioned country, it may stand in breach of export controls even if the hiring company was the deceived party. The advice from the attorney in the session: be wary of relationships that exist only online and make background checks standard.

Ultimately, the practical fix is in the interview itself. Ask specific, scenario-based questions, which are much harder to answer from a script.

What hasn't changed since 2021

Across five years of learning and discussion sessions, our community kept coming back to the same four lessons. And outside (non-community-led) events continue to prove them right.

1. Being small doesn't protect you. In 2021 a speaker said cyber and reputation risk apply to every company, whatever its size. In 2026 a technology risk advisor described smaller firms that assume no one will target them as "the lowest hanging fruit": their money has the same value, and their defences are weaker. Verizon's 2025 breach report found ransomware in 88% of breaches at smaller businesses, against 39% at large ones (Help Net Security). The same goes for individuals: a modest public profile is still enough to clone.

2. Not knowing is not a defence. Our speakers repeatedly compared AI and cyber to a balance sheet: a director can't approve what they don't understand and then claim ignorance. Regulators and courts agree.

  • In Moffatt v. Air Canada (2024), the airline argued that its chatbot was responsible for its own words. The tribunal rejected that and held Air Canada liable (ABA Business Law Today).

  • The EU's NIS2 directive requires the management bodies of in-scope organisations to approve and oversee cyber risk measures, take cybersecurity training, and accept that they can be held liable (NIS2, Article 20).

3. Warning signs must reach the board unfiltered. In 2021 a speaker described a "situation alert" that went from the business straight to the board, with no filters. In 2026 a governance specialist described a board that rewards staff for reporting near-misses, so it sees potential trends before any disaster. Equifax shows the cost of the opposite. Its team was alerted to a critical vulnerability in March 2017 and ordered a fix within 48 hours, but no one confirmed the fix had happened. The breach that followed exposed data on about 147 million people and cost at least 575 million USD in settlement payments (FTC).

4. People still make up the front line. Verizon finds a human element in about 60% of breaches, year after year (Help Net Security). The effective defence remains the same one as in 2021: trust, but verify. Back then, this meant calling back to check a request. Now it means not trusting even a familiar face on a video call without verifying it in some other way. As one panellist's colleague tells his family: if anyone calls in his name asking for money, assume it isn't him.

A checklist to keep on hand

The advice from our sessions highlights three critical moments: before you reply, if you have already engaged, and this week (or what to do sooner than later).

Before you reply to an unexpected approach

  • Look at what it asks for. A genuine search gives specifics: the industry, a rough location, why they chose you. A fake one is heavy on flattery and moves quickly to payment or ID credentials sharing.

  • Check the sender's real address and domain. Personal webmail from a "retained search firm" is a red flag, and a domain lookup (WHOIS) shows where the domain in question was registered.

  • Check the LinkedIn URL, not just the name and photo. One member spotted a fake because the profile address was spelled differently from the person's name.

  • Call the firm on a number you find yourself, and confirm the recruiter still works there.

  • Never send your passport, civil ID number or bank details. A legitimate background check goes through a screening provider, not the recruiter.

  • Hover over and consider links before clicking them. If a video call feels wrong, ask: "How can I call you back?"

If you have already engaged

  • Stop replying, but keep the evidence: screenshots, emails, links and profile URLs.

  • Change passwords, use a password manager, and call your bank if financial details were shared.

  • Expect follow-up scams: they now know more about you.

  • If someone is impersonating you, tell your network and report it to the platform.

  • Report it. In the US that means the FBI's Internet Crime Complaint Center (ic3.gov), the FTC (reportfraud.ftc.gov) and your state attorney general. Elsewhere, use your national fraud reporting service.

This week: three actions from the panel

  • Freeze your credit with the major bureaus where that's available. It's easy to switch on and off, and it stops fraudsters from opening credit lines in your name.

  • Remove your phone number and personal email from LinkedIn.

  • Write down how your face, voice or identity could be misused, then agree a response plan with your team and family.

  • Plus: reverse-image-search your headshot, set an alert for your name, and look for duplicate profiles using your photo.

Questions to take to your board

Protecting yourself is the start. As directors and advisors, we can also bring these questions into the boardroom. Each of the proposals below comes from a community-led session.

  1. Where might reality already be changing faster than our governance assumptions? A leading alternative to "what are our top risks?", a query that looks backwards. (When Oversight Feels Strong… But Risk Is Quietly Growing, 2026)

  2. What isn't reaching this room? A test for warning signs that get softened on their way up to board level. (same session)

  3. Who is our single point of contact for AI, and do we have an inventory of every AI tool and agent in use, including the ones nobody approved? (Is Agentic AI a Legal Liability Nightmare?, 2026)

  4. For each AI tool used, what is the value, and what have we done to limit the harm? Add the owner, the cost, the regulations that apply and what red-teaming exercises found. (same session)

  5. Could we reconstruct what our AI agents did after the fact? Think of a flight data recorder: logs you don't keep now can't be recovered later. (same session)

  6. How do we confirm that a candidate, recruiter or caller is real before we pay, hire or transfer money? (Would You Spot the Fake?, 2026)

  7. Has the board had cybersecurity training, and do our D&O liability insurance and cyber policies cover what we now face? NIS2 already requires this training for management bodies in scope. (Board Directors & Risk, 2025)

Don't disappear. Verify.

The moderator for this month’s event closed the session with a sense of irony most of us will recognise. The things we were taught to build (a visible career, a strong network and a public bio) are exactly what now make us vulnerable.

His answer wasn't to disappear. It was to make consent explicit and to make verification a normal part of how we work.

That is our message for Cybersecurity Awareness Month. Share the checklist with your network, take the questions to your next board meeting, and keep bringing your experiences to the community. Many of the most useful warnings in this piece came from members who saw something and then said something.

We extend very special thanks to Gary Kreissman, Scott Giordano, Minako Honda-Athenor and Anne Kavanagh, and to the speakers whose sessions are referenced here: Ahmed Hassan, Shimi Shah, Martin Wilderer, Christine Shasteen, Jay Weiser, Ali Hamdan, Cameron Powell, Greta Antonescu and Ravindra Kumar.

Sources

Other news

Anita Stojčevska – Get to know our VAB member

October 8, 2026
We would like to introduce you to VAB member, Anita Stojčevska, who joins our community from Ljubljana, Slovenia. She is a senior executive leader with more than 30 years of experience in corporate and retail banking, strategy and transformation. Her career has been shaped by leadership roles within Société Générale Group and OTP Group, where she led major integration and transformation initiative