Employee behavior once considered unacceptable is becoming tolerated across various industries, particularly in IT and telecommunications, and at all levels of seniority, including leadership.

Cifas Workplace Fraud Trends research, based on a survey of 2,000 UK employees working at companies with more than 1,000 staff, shows that employee-driven fraud, such as selling login credentials or secretly working for competitors, is being viewed as justifiable.

“These findings reflect a broader shift in workplace behaviors when faced with the opportunity to commit fraud,” said Mike Haley, CEO at Cifas. “They suggest a shift in workplace norms and raise urgent questions about organizational culture, risk management, and accountability.”

Employees increasingly justify workplace fraud

Participants were presented with five fictional workplace fraud scenarios and asked whether they considered the actions justifiable, as well as whether they or someone they knew had engaged in similar behavior. The scenarios included falsifying references, selling login credentials, secretly working for a competitor, misusing expense claims, and gambling with company funds with the intention of repaying the money later.

The findings were striking, especially considering that fraud is estimated to cost the UK £219 billion annually.

24% of respondents, equivalent to around 240 people in a company of 1,000 employees, said it is acceptable to secretly work for a competitor, a practice referred to as “polygamous working.” Almost the same proportion, representing the most commonly witnessed behavior, said they knew someone who had committed expense fraud within the past year.

Falsifying references to cover employment gaps and secure a job followed at 19%. Meanwhile, 13% of respondents said they or someone they knew had used company funds for gambling with the intention of repaying the money after winning. The same proportion also said they, or someone they knew, had sold company login credentials and considered the behavior harmless.

Senior leaders also viewed fraud as acceptable

One of the more concerning findings was that one-third of senior managers and directors surveyed considered such behavior justifiable. The proportion was even higher among C-suite executives and business owners.

Rachael Tiffen, Director of Learning at Cifas, said selling login credentials may appear insignificant to those involved, but can open the door to serious fraud and financial harm. She added that the findings show the value of building fraud-aware workplace cultures in which employees at every level understand both their responsibilities and the consequences of fraudulent behavior.

Download: 2026 SANS Identity Threats & Defenses Survey