Join our Newsletter — 33% off our NHI Course

Who should own fraudulent hire detection in a joiner process?

It should be shared across IAM, HR, security operations and hiring managers because no single team sees the full picture. IAM issues the access, HR owns the employment record, and security must correlate the signals when the two diverge.

Why fraudulent hire detection cannot sit in a single team

Fraudulent hire detection is a joiner-process control problem, not just an HR screening task or an IAM provisioning task. The answer depends on IAM and IGA Basics because the control only works when the employment record, access request, and issued identity are reconciled across functions.

IAM sees whether access was created correctly, HR sees whether a real employment event exists, and security operations sees anomalies that do not fit either record. Hiring managers matter because they usually see the business context first, including role expectations, start dates, and whether the request matches the actual team or budget line.

The practical implication is that ownership should be shared, but accountability should still be explicit. One team should own the workflow, while the others own the evidence they contribute. That is the difference between a detector that can flag inconsistencies and a process that can actually stop a false joiner from entering the environment.

What each function contributes to the detection decision

Fraudulent hire detection only becomes reliable when each function contributes a different signal. HR owns the authoritative people record, which helps confirm that a real hiring event exists and that the joiner is expected. IAM owns the identity creation and access assignment step, which makes it the best place to detect mismatches between requested access, approved access, and actual onboarding state.

Security operations adds correlation and triage. It can compare the joiner record against unusual device activity, duplicate personal details, repeated onboarding attempts, or access patterns that do not match the declared role. For detection engineering and case handling, teams can use SANS Security Resources as a practitioner reference for how to structure monitoring, investigation, and escalation around anomalies.

Hiring managers provide a final business reality check. They can confirm whether the role, team, manager, and start timing are plausible. In many cases, the hiring manager is the first person able to notice that a request looks legitimate in isolation but wrong in context.

How to assign ownership without creating blind spots

The best ownership model is a federated one: one control owner, multiple signal owners. HR should own the employment source of truth, IAM should own the identity and access workflow, and security should own alerting and investigation logic. This also aligns with Joiner-Mover-Leaver (JML) Guide, which treats onboarding as part of the wider identity lifecycle rather than a standalone admin step.

IAM and IGA Basics is the right place to anchor the approval and provisioning model because joiner fraud is often exposed when birthright access, entitlement assignment, or role mapping does not match the expected joiner profile. That makes the joiner control a governance problem as much as a technical one.

If the organisation handles repeated onboarding exceptions, the ownership model should also include a clear exception path. The exception owner should be the function that can verify evidence fastest, not the function that can close the ticket fastest.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 IA-2 — Identification and Authentication (Organizational Users) Joiner fraud is exposed when a non-genuine joiner reaches identity creation.
IA-5 — Authenticator Management Joiner fraud often includes issuance of credentials to the wrong person.
Recommendation — Require proof before issuing organizational user accounts. Control credential issuance, rotation, and revocation for new joiners.
NIST CSF 2.0 ID.AM-01 — Physical devices and systems are inventoried Fraudulent joiners create inventory and reconciliation mismatches across records.
PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited The question centers on who manages joiner identity issuance and verification.
DE.CM-01 — Networks and network services are monitored to find potential events Security operations must correlate signals that indicate a fraudulent joiner.
Recommendation — Maintain authoritative inventories and reconcile onboarding records against them. Assign joiner identity issuance and verification to controlled owners. Monitor joiner-related signals and investigate anomalous onboarding patterns.

Practitioner Guidance

What to prioritise: Build a cross-check that compares HR’s expected joiner record, IAM’s issued identity, and the hiring manager’s confirmation before access is granted. If any one of those signals is missing, treat the case as a verification problem rather than a routine onboarding delay.

What to verify: Confirm who can approve the employment event, who can approve access, and who can halt provisioning when the records disagree. The control is only trustworthy if the workflow makes disagreement visible before the account becomes useful.

Common mistake: Letting HR “own” the whole detection question because the fraud starts with a fake hire. HR can validate employment, but it usually cannot see the access and identity inconsistencies that reveal abuse.

Practitioner takeaway: The strongest model is shared detection with clear control ownership, because fraudulent hire cases are usually exposed by mismatches across records rather than by any single team’s view.