{
  "slug": "insider-bribery-customer-signature",
  "title": "When support staff can be bought, the only control is a key they do not hold",
  "summary": "Bribed support agents are authorized users doing authorized things. Least privilege cannot stop them. The customer's own signature can.",
  "lede": "A bribed support agent is not an intruder. They are an authorized employee, doing a task inside their job description, with permissions your access review deliberately granted them. Every control built to keep outsiders out is pointed the wrong way. The one control that still works is the one the agent cannot exercise: the customer's own signature.",
  "date": "2026-09-07",
  "reading_time": "16 min read",
  "category": "Security",
  "tags": [
    "insider threat",
    "customer support",
    "account takeover",
    "BPO",
    "help desk",
    "third party risk"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Insider%20Bribery%20Support/1200_630/blog.jpg",
  "url": "/blog/insider-bribery-customer-signature.html",
  "wordcount": 4099,
  "related": [
    "passkey-recovery-weakest-link",
    "help-desk-mfa-reset-attack",
    "identity-failure-map"
  ],
  "schema": "Article"
}