Which of the following is a recommended step that businesses should take to protect their customers and employees from identity theft?

• A. Limit the personal information collected from customers.
• B. Conduct regular employee training on information-handling best practices.
• C. Require employees to use complex passwords or passphrases.
• D. All of the above

Answer: (D)

A strong defense against identity theft relies on layering safeguards that address different ways criminals can compromise information. Reducing what you collect, educating people who handle data, and enforcing strong authentication each tackle a separate risk, and together they form a more effective protection.

Limiting the personal information collected from customers minimizes the data that sits at risk. If you only gather what you truly need and retain it no longer than necessary, there’s less to steal in a breach or leak, which directly reduces potential identity exposure.

Regular training for employees on information-handling habits targets the human element. People are often the entry point for breaches through phishing, careless sharing, or unsecured channels. Ongoing, practical training helps staff recognize suspicious activity, follow proper data-handling procedures, and respond correctly when something seems off.

Requiring complex passwords or passphrases strengthens access controls. If credentials are predictable or reused, unauthorized users can gain entry even without breaking in through a system. Strong, unique passwords and passphrases raise the bar and make it harder for attackers to impersonate legitimate users.

When these steps are combined, they cover data exposure, user behavior, and access controls simultaneously. That layered approach—minimizing data, educating users, and enforcing strong authentication—provides comprehensive protection, which is why choosing all of the above is the best answer.