When she was out, packages started arriving that were addressed to unknown recipients. Her boss sent them back. But on another day when the receptionist was out, a delivery person told the owner that one of the reclaimed packages was part of a potential fraud investigation. His records showed the receptionist had signed for the package a few days earlier.

The receptionist was immediately terminated, the business owner told Fortune Small Business magazine, which featured the story in a series of articles on “employees from hell.”

The next week, the office received a letter from a credit card company addressed to a former employee, who told her old boss that her identity had been stolen a few months prior.

Turns out, the fired receptionist had dug through employee records to steal identities and open credit card accounts to buy items that were being delivered to the office. And her absences? She needed her sick days to appear in court on other identity theft charges.

A recent study by Javelin Strategy and Research said that 8.4 million U.S. adults suffered some form of identity fraud in 2006, down from 10.1 million in 2002, the New York Times reported. The Federal Trade Commission and the Los Angeles County Sheriff’s Department, which operates an aggressive identity theft task force, also said it is leveling off.

To combat the ID theft problem, the Midwestern company in the Fortune Small Business example decided it would not allow new hires to have access to personnel files, which are now kept locked. Personal information has been removed from invoices. The company offered free credit-fraud alerts to all current and former employees. And, the company now keeps a lawyer on retainer to deal with personnel crises.

While in this case, the records involved paper files, the array of technology devices available make data theft from the workplace even easier. Consider the USB memory stick or an iPod. Because they can hold so much data, they are being used to copy files from corporate networks. So-called ‘pod-slurping,’ involves using a computer program to download vast amounts of data to an iPod in minutes, ElectronicsWeekly.com reported. Cameras and MP3 players are being used as well. Some companies and governments that need sensitive information have banned mobile devices as a preventive measure.

Peter Marshall , 17 March 2007 @ 18:54 PM  Additional resources This is an excellent article, highlighting an often overlooked, major corporate liability. Some key stats: Over 100 MILLION sensitive personal ID records help by companies have been compromised in just the last 2 years. Due to recent state and federal legal changes, companies are now liable for the impact, and their average DIRECT cost has been over $50 PER RECORD. I have written an extensive white paper on this topic -- vendor neutral -- which is available free at https://www.myidcenter.com/whitepaper.pdf. You can find additional guidance at https://www.myidcenter.com/idgblog.html. Please let me know if these are useful to you, or if you have further questions.