Why Identity Fraud Is a Growing Boardroom Concern for New Zealand Businesses – And What to Do About It

Background

As reported recently in insurancebusinessmag.com, the research commissioned by Lumin, and carried out by Sapio Research, paints a concerning picture of a business environment where AI-powered impersonation, fake communications, fraudulent invoices, and document verification failures are becoming increasingly common. Just as concerning, many organisations acknowledge they may not be adequately prepared to detect or prevent these threats.

While technology often receives the most attention in discussions about fraud prevention, identity fraud is increasingly becoming a legal and governance issue that extends well beyond the IT department.

Why Identity Fraud Is Becoming More Difficult to Detect

The report highlights how artificial intelligence is enabling fraudsters to create increasingly convincing communications and supporting documents. Fraud attempts no longer rely on obvious spelling mistakes or poorly written emails.

Instead, businesses are facing:

• Fake invoices appearing to come from senior executives
• Fraudulent payment requests
• Impersonation of staff members
• Manipulated documents and signatures
• Credential theft and business email compromise

As one industry commentator noted, organisations can no longer rely on simply verifying a signature. Increasingly, they must verify the identity of the person behind it.

How Businesses Can Protect Themselves

Technology remains important, but legal and procedural safeguards are equally critical.

Businesses should consider:

Strong Internal Authority Policies

Many fraud losses occur because staff members are pressured into making urgent decisions.

Clear policies around:

• Payment approvals
• Banking changes
• Supplier verification
• Contract execution

can significantly reduce risk.

A documented process requiring independent verification before payments are made can often prevent fraudulent transactions from occurring.

Robust Contractual Controls

Contracts with suppliers, contractors and service providers should clearly address:

• Identity verification requirements
• Authority to act on behalf of organisations
• Notification obligations following cyber or fraud incidents
• Liability allocation where fraud contributes to loss

These provisions may not prevent fraud, but they can help reduce exposure and provide clearer remedies when issues arise.

Governance and Board Oversight

The report found that many businesses now view identity fraud as a strategic risk.

Boards and business owners should ensure that:

• Fraud prevention policies are reviewed regularly
• Staff receive training
• Verification processes are tested
• Third-party risks are assessed

This is particularly important where businesses handle significant financial transactions or sensitive information.

What to Do If Your Business Has Been Targeted

When identity fraud occurs, speed matters. The first priorities are often to:

• Preserve evidence
• Secure affected systems
• Notify financial institutions where appropriate
• Assess contractual obligations
• Identify reporting requirements
• Limit further loss

Businesses may also need to consider whether customers, suppliers, insurers, regulators, or other stakeholders should be notified.

The legal response will depend on the nature of the incident, but early action can often improve the likelihood of recovery and reduce ongoing exposure.

The Reputation Risk Businesses Often Overlook

One of the more striking findings from the report was that nearly 70% of New Zealand businesses said they would reconsider working with an organisation that had recently experienced identity fraud.

This means the consequences can extend far beyond direct financial losses.

A significant fraud event may affect:

• Customer confidence
• Supplier relationships
• Commercial negotiations
• Future business opportunities

Managing the legal and reputational aspects of an incident is therefore becoming just as important as addressing the technical issues.