Organizations should fix the identity attack path that can cause the most harm, based on each online service and user group. That often puts stronger authentication, exposed-system patching, and tighter controls on personal-data or payment requests first.
Identity theft is the misuse of identifying information to impersonate someone or commit fraud. The FBI's 2024 Internet Crime Report recorded 21,403 identity-theft complaints and $174.4 million in reported losses. It also recorded 64,882 personal-data-breach complaints and $1.45 billion in losses; these complaint-based figures do not measure all victimization.
Table of Contents
- Choose the next fix by service and user
- Strengthen sensitive and privileged logins
- Patch the paths authentication cannot block
- Add controls around trusted requests
- Include SaaS, suppliers, and federated access
Choose the next fix by service and user
There is no universal control that every organization should implement next. NIST's digital identity guidance calls for separate assessments of identity proofing, authentication, and federation for each service and user group. Identity proofing establishes who a person is.
Authentication checks returning users, while federation lets an external identity provider vouch for them. For each service, document: Prioritize the service with the largest credible harm and weakest protections. A customer portal, payroll platform, or administrator console may deserve action before a lower-impact system with more users.
- Who uses it, including administrators, employees, customers, contractors, and suppliers
- Whether users can view personal data, change records, release data, or authorize payments
- The harm that account takeover, false enrollment, or failed federation could cause
- Existing controls, recovery paths, and known gaps
Strengthen sensitive and privileged logins
NIST's Authentication Assurance Levels, or AALs, describe the required strength of authentication. Under NIST SP 800-63-4, services that let users view or modify personal information require AAL2 and two distinct factors. Highly sensitive or privileged access maps to AAL3, which requires phishing-resistant authentication.
Not all two-factor methods resist phishing. NIST says manually entered one-time passwords can be relayed by an impostor, while WebAuthn and FIDO2 can provide phishing resistance by binding authentication to the legitimate domain. Move privileged and sensitive accounts to phishing-resistant authenticators first. Treat one-time codes as an interim measure, and test account recovery and help-desk procedures so attackers cannot bypass the stronger login.
Patch the paths authentication cannot block
Authentication upgrades do not close vulnerable software. The Verizon 2026 Data Breach Investigations Report found that vulnerability exploitation initiated 31% of analyzed breaches, overtaking stolen passwords as an initial access method.
That percentage describes Verizon's analyzed breach set, not every organization's individual risk. It still makes internet-facing and identity-system vulnerabilities part of identity-theft prevention, especially when exploitation could expose personal information or privileged accounts. Use a focused remediation queue:.
- Identify internet-facing systems that handle logins, identity data, or account recovery
- Rank vulnerabilities by exposure and the data or privileges reachable after exploitation
- Patch or otherwise restrict the highest-risk paths
- Verify remediation instead of closing work when an update is merely scheduled
Add controls around trusted requests
The FBI describes business-email compromise as the use of social engineering or intrusion to compromise legitimate accounts. Attackers then seek transfers or employees' personally identifiable information.
A familiar sender address therefore does not make an unusual request safe. Build checks around the requested action, not only the message: These controls matter even after stronger authentication is deployed. They can stop harm when an attacker controls a real account or persuades an authorized employee to act.
- Confirm payment, payroll, and contact-detail changes through a previously known channel
- Require a second approval before releasing personal data or sending unusual transfers
- Restrict bulk exports of customer and employee records
- Give staff a fast way to report and pause suspicious requests
Include SaaS, suppliers, and federated access
An identity program should not end at systems the organization hosts. NIST's digital identity risk-management guidance requires documentation for managed services and external services supporting the mission, including email, social media, and online marketing. Inventory which outside services store personal information, accept federated logins, or can initiate sensitive communications.
Record the responsible owner, user groups, authentication level, administrator access, recovery process, and offboarding method for each one. Review supplier and contractor access using the same harm-based method as employee access. Disable unused accounts, remove unnecessary privileges, and verify that departed users can no longer reach either the primary service or its federated login.