FBI IC3 received about $2.9 billion in business-email-compromise loss reports in 2023, second to investment fraud.
An attacker looks up your org chart on LinkedIn. They find the CFO's name and the finance team. They spoof an email from the CFO to the accounts payable person: 'We have an urgent wire transfer for a confidential acquisition. Process immediately and do not discuss with colleagues.' The research is done in minutes. The email takes seconds. The wire goes through because the request looks exactly right.
Your profile tells attackers who your boss is, who's new on the team, what projects are active, and what language your company uses internally. They use all of it to make fake requests indistinguishable from real ones.
The defenses: establish a verbal confirmation policy for any financial transaction over a certain threshold. Confirm by calling a known number — not replying to the email. Be suspicious of any request that asks you not to verify with someone else. And consider what information your public LinkedIn profile reveals versus what it needs to reveal.
This isn't a reason to abandon LinkedIn. It's a reason to think of your public professional profile the way a security-conscious person thinks about anything public — share what needs to be shared, nothing more.
Sources for this correction, checked October 17, 2026: https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf