Hiring Fraud and Candidate Identity Verification Guide

Remote hiring lets a person who is not who they claim to be pass interviews, clear a background check and receive a laptop, credentials and production access on day one. The FBI has warned since 2022 that applicants use deepfakes and stolen personal data to apply for remote technical roles. This guide covers how to verify that the candidate you interview, the candidate you check and the person who starts work are the same real person: identity document checks, liveness and deepfake resistance, proxy interviewers, reference and history fraud, UK right to work digital checks and NIST SP 800-63A-4 identity proofing. It is written for security, HR, talent acquisition and IAM teams who share the hiring pipeline, and it keeps privacy and fair treatment in scope throughout. State sponsored remote worker schemes are covered separately in the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes).

Key takeaways

Identity is a hiring control, not an HR formality. The first credential you issue a new joiner is only as trustworthy as the identity proofing behind it, so treat candidate verification as the start of the identity lifecycle.
Bind the same person across every stage. Most hiring fraud works by swapping people between stages: one person interviews, another passes the assessment, a third collects the laptop. Re-verify the face and document at each hand-off.
Video is evidence, not authentication. Face swaps, voice changers and proxy interviewers defeat a casual video call. Use liveness with presentation attack detection, live challenges and an in-person or supervised step for high-risk roles.
Use certified services where the law defines them. In the UK, digital right to work checks on British and Irish passports must use a provider on the OfDIA register, and the employer still has to confirm the photo matches the person.
Collect the minimum, at the right stage. Run document and biometric checks on shortlisted or offered candidates, apply them to everyone in the same role, and offer a non-biometric route, so fraud controls do not become discrimination or data protection failures.

How hiring fraud works

The patterns below recur in FBI public service announcements, the May 2022 State, Treasury and FBI guidance and company disclosures.

Pattern	How it works	Signals seen in practice	Stage where it is caught
Stolen identity	Applicant uses a real person's name, date of birth and national identifier. The background check returns clean because the victim is clean.	Background check results that belong to someone with a different history; victims receiving tax forms for jobs they never held (FBI, May 2024)	Document plus face match against the identity, not the background check alone
Synthetic identity	Combination of real and invented attributes, with a thin but plausible online presence	Very new professional profiles, portfolio sites that are overly simple, references that only exist by email	Evidence validation against authoritative sources
Deepfake or face-swapped interview	Real time face swap or voice changer over a video call, or AI-edited photos on identity documents	Lip movements that do not match audio, coughs or sneezes not seen on camera (FBI, June 2022); refusal to turn on the camera	Liveness with presentation attack detection; live challenges
Proxy interviewer	A skilled stand-in passes the technical interview; someone else does the job	Different voice, accent or skill level between interview and first weeks; candidate who avoids follow-up calls	Re-verification of the face at offer and at day one
Fabricated history and reference fraud	Invented employers, degrees or references, with referees who are friends or the candidate	Referee contact details supplied only by the candidate, free email domains, VoIP numbers reused across applications	References verified through independently sourced contacts
Location fraud	Candidate claims a local address but works from elsewhere, often via a forwarding address	Address change between offer and equipment shipping; payroll account changes during onboarding (FBI, January 2025)	Address confirmation and equipment shipping controls

A Gartner survey of 3,000 candidates in the second quarter of 2025 found 6% admitted to interview fraud, either posing as someone else or having someone pose as them, and Gartner predicts that by 2028 one in four candidate profiles worldwide will be fake. Treat the prediction as an analyst forecast, not a measured rate.

Once hired, the fraudster holds T1078 Valid Accounts, which is why prevention has to happen before the account exists. See the Synthetic Identity Fraud Guide.

A verification model for the hiring pipeline

NIST SP 800-63A-4, which supersedes SP 800-63A, gives a vocabulary that maps well to hiring even though it is written for credential service providers. Identity proofing has three parts: resolve the claimed identity to one real person, validate the evidence is genuine and accurate, and verify that the applicant is the rightful owner of that evidence. The last step is the one most hiring processes skip.

Assurance level (SP 800-63A-4)	What it requires	Hiring use
IAL1	Claimed identity exists and core attributes are validated against authoritative or credible sources; loose link to the applicant	Not sufficient for any role that receives system access
IAL2	Stronger evidence and checks that the applicant rightfully owns it; addresses targeted attacks, basic forgery and social engineering	Baseline for remote hires who receive corporate credentials
IAL3	On-site attended session with a trained proofing agent and at least one biometric collection; addresses advanced forgery and sophisticated social engineering	Privileged administrators, developers with production or signing key access, finance roles that release payments

SP 800-63A-4 also separates four proofing types: remote unattended (fully automated), remote attended (secure video session with a proofing agent or trusted referee), on-site unattended (a controlled kiosk) and on-site attended (in person, on devices the provider controls).

Evidence strength matters too. The standard grades evidence as fair, strong or superior. Superior evidence carries cryptographically protected data with verifiable digital signatures, such as the chip in an electronic passport, which a capable document reader can authenticate.

Map the stages of your pipeline to the checks that belong there:

Application: flag the same phone number, email or CV text across applications, as the FBI's January 2025 PSA recommends. No identity documents yet.
Interview: camera on for every interview, with the interviewer noting the face and voice. Ask questions about the work the candidate claims to have done, and gentle questions about location and education, as the FBI suggests.
Conditional offer: full identity proofing at the level the role needs: document validation, liveness, face match to the document, and comparison against the person seen at interview.
Pre-start: right to work, background screening and reference verification, all tied to the proofed identity.
Day one: re-verify the face before handing over credentials, ideally at the moment the person enrols their first phishing-resistant authenticator.

Document validation, liveness and deepfake resistance

Each control below defeats a different attack, and none of them is sufficient alone.

Document authenticity: read the chip of an electronic passport or identity card where the provider supports it, and check security features of physical documents. The May 2022 joint guidance advises rejecting low-quality document images and scrutinising documents for forgery.
Presentation attack detection (PAD): SP 800-63A-4 requires remote biometric capture to use PAD with an impostor attack presentation accept rate below 0.07, tested to ISO/IEC 30107-3:2023. Ask providers for independent test reports against that standard, not marketing claims.
Injection attack detection: face swaps are often fed in through a virtual camera or emulator rather than held up to a real lens. SP 800-63A-4 requires remote processes to detect virtual cameras, emulators and jailbroken devices and to analyse media for manipulation. A provider that only does PAD is not covering this.
Live challenges: in attended sessions, SP 800-63A-4 calls for random live challenges. In interviews, asking the candidate to turn their head fully, move a hand across the face or hold their document next to their face on camera, as Microsoft recommends, stresses real time face swaps.
Photo forensics and supervised proof: Mandiant recommends checking whether profile photos were AI-modified, as a reason to step up. For high-risk roles, Mandiant and Microsoft suggest notarised proof of identity, and the FBI recommends in-person onboarding where possible.

Do not use knowledge-based questions: SP 800-63A-4 prohibits knowledge-based verification. See the Deepfake-Resistant Identity Verification Guide and the Identity Proofing and KYC Guide.

Proxy interviewers and identity drift between stages

Identity drift is the gap between the person who interviewed, the person who was checked and the person who starts work. KnowBe4's July 2024 disclosure shows why it matters: its hire passed four video interviews in which HR confirmed the person matched the photo, a background check and reference checks, because a real but stolen US identity was paired with an AI-enhanced photo. The checks each passed; nothing tied them together.

Carry a reference image forward: capture a consented reference image at identity proofing, then compare at day one and at the first authenticator enrolment. Without consent, use a trained person comparing live video against the document.
Technical follow-up without warning: a short, unscheduled call in the first two weeks about work the person has done catches proxies who passed the technical interview.
Agency and contractor hires: both FBI PSAs ask employers to audit staffing firms routinely. Write the proofing standard into the contract and ask for evidence.

Deepfakes in hiring are part of a wider impersonation problem. The Arup deepfake fraud showed that a whole video call of familiar faces can be synthetic; a single candidate on a webcam is an easier target. See the Deepfake and AI Impersonation Guide.

References, employment history and qualifications

Independently sourced contacts: the May 2022 joint guidance advises verifying employment and education history through independently sourced contacts. Call the former employer's switchboard or HR line found from its own website, not the number on the CV.
No email-only references: KnowBe4 concluded its email references were insufficient. A reference you cannot speak to, from a free email domain, is a lead to check, not evidence.
Qualification checks at source: confirm degrees with the awarding institution or an official verification service. Mandiant notes that fraudulent personas often claim education at overseas universities employers struggle to verify; the answer is a slower, documented check, not rejection of all overseas qualifications.
Consistency across profiles: compare names, dates, locations and contact details across CV, networking and code hosting profiles, a red flag in the 2022 guidance and the FBI PSAs. Check whether phone numbers are VoIP.

Broader screening belongs to personnel security. See the Personnel Security and Background Screening Guide.

UK right to work checks with certified digital verification services

UK employers must check right to work before employment starts, and the method they use decides whether they have a statutory excuse against a civil penalty. The Home Office Employer's guide to right to work checks (current edition 1 October 2026) sets out three routes.

Route	Who it covers	What the employer must do
Digital check through a right to work digital verification service provider (RtW DVSP)	Holders of valid British or Irish passports or Irish passport cards (including expired documents up to 6 months past expiry, verified with passive authentication of the chip)	Use a provider registered on the Office for Digital Identities and Attributes (OfDIA) register that follows the supplementary code for digital right to work checks; confirm the photo and biographic details belong to the person, in person, by video call or through the provider's facial recognition; obtain the specified data fields; keep a clear copy
Home Office online check	People with an eVisa or immigration status in Home Office systems	Use the 9 character share code beginning with W (valid 90 days) and the date of birth; confirm the photo matches; keep a PDF or HTML copy of the profile page
Manual document check	Anyone, including those who do not have or do not want to use a valid passport digitally	Check originals from the Annex A lists for validity, photo and date of birth consistency and restrictions; copy, date and retain

The employer stays liable: using a certified provider does not transfer responsibility. If the requirements are not met there is no statutory excuse.
Retention: keep evidence for the duration of employment and two years afterwards, as the guide specifies.
Certification framework: certification is against the UK digital verification services trust framework (version 1.0 published 9 June 2026; earlier versions were titled the UK digital identity and attributes trust framework). Check the register at the time of contracting and periodically after.
Fair treatment: the guide requires employers to offer a manual alternative to anyone who does not hold a valid passport or does not want a digital check, to apply checks consistently to all workers including British citizens, and not to make assumptions based on race, nationality, accent or surname.

A right to work check proves eligibility, not a full identity proofing for system access: treat it as one input to the joiner's identity record.

Privacy and fairness by design

Verification collects some of the most sensitive data an employer holds: identity documents, facial images and, if biometric matching is used, special category data under UK GDPR when processed to identify someone. The ICO's recruitment and selection guidance was under review following the Data (Use and Access) Act at the time of writing, so check its current status before relying on it.

Stage the collection: do not ask every applicant for documents. Proof identity at conditional offer, when the purpose is clear and the volume is small.
Assess before deploying: SP 800-63A-4 requires a privacy risk assessment before fraud checks go live and informed, recorded consent for biometrics with published retention and deletion. In the UK, a data protection impact assessment is the natural vehicle.
Offer an alternative: keep a supervised, non-biometric route (in-person document check, trusted referee session) for candidates who cannot or will not use biometric checks.
Measure bias: SP 800-63A-4 sets demographic performance limits for biometric matching. Ask providers for demographic test results.
Apply checks by role, not by person: stepping up verification because of a candidate's name, accent or nationality is discrimination. Step up on observable signals (reused phone numbers, camera refusal, address changes) and on the risk of the role.

Implementation roadmap

Map the pipeline and owners (weeks 1 to 2): document every stage from application to first login, who runs it (HR, agency, hiring manager, IT) and what identity evidence exists at each point.
Tier roles (weeks 2 to 3): assign each role a target level, for example IAL2 for standard remote roles and IAL3 or a supervised step for privileged, developer and payment roles.
Select verification providers (weeks 3 to 8): require ISO/IEC 30107-3 PAD test evidence, injection attack detection, chip reading, demographic performance data and, for UK right to work, OfDIA registration. See the Deepfake-Resistant Identity Verification Guide for evaluation questions.
Pilot on one hiring stream (weeks 8 to 14): run the new checks in parallel with existing ones for one department or one agency, measure completion, false rejection and step-up rates, and collect candidate feedback.
Connect to identity provisioning: make "identity proofed" a required attribute in the HR record that triggers account creation, so no account is provisioned for an unverified joiner. See the Joiner-Mover-Leaver Guide.
Roll out with a fallback: keep the manual route working and staffed. Roll back by switching affected roles to supervised manual checks, never by skipping verification.

Decision guidance

Situation	Option A	Option B	Choose B when
Remote standard role	Remote unattended proofing with liveness and chip read	Remote attended video session with a trained agent	Automated checks fail, evidence is weak, or red flags are present
Privileged or developer role	Remote attended session with live challenges	In-person or notarised identity check before access	The role gets production, signing key, payment or customer data access in the first month
Agency or contractor	Contractual requirement and audit of the agency's process	Your own proofing of each individual	The person receives the same access as an employee
Small organisation	Manual checks by a trained person, in person where possible	Subscription verification service	Hiring remotely at volume or across borders

Large organisations need automation for consistency, but should keep human review for exceptions and step-ups.

Detection and measurement

Signals to log: verification outcomes and failure reasons, PAD and injection alerts, duplicate contact details across applications, address and bank detail changes between offer and day one, and face mismatches at day one.
Proofing coverage: percentage of new joiners with an identity proofing record at the target level before their first account was created (target 100%).
Drift catches: number of hires where the day one re-verification did not match the proofed identity.
Step-up rate by route: the share of candidates sent to manual or supervised checks, broken down by provider and channel, to spot both fraud trends and bias.
Agency compliance: percentage of agency hires with evidence of proofing supplied before start.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	PR.AA-02	Identities are proofed and bound to credentials based on the context of interactions
NIST CSF 2.0	GV.RR-04	Cybersecurity is included in human resources practices
NIST SP 800-53 Rev. 5	IA-12, IA-12(3)	Identity proofing; identity evidence validation and verification
NIST SP 800-53 Rev. 5	PS-3, PS-6	Personnel screening; access agreements before access is granted
ISO/IEC 27001:2022 Annex A	A.6.1 Screening	Background verification checks before joining and on an ongoing basis
MITRE ATT&CK v20	T1585, T1588.007, T1078	Persona creation, AI capability acquisition, and the valid accounts a fraudulent hire receives

Common failure patterns

Background check treated as identity check: a clean check on a stolen identity proves nothing about the applicant. KnowBe4's hire passed exactly this way.
Checks that never connect: interview, right to work and IT onboarding each verify something, but nobody confirms they verified the same person.
Trusting the video call: camera on is treated as proof, with no liveness, no live challenge and no comparison to the document.
Candidate-supplied references: calling the number on the CV verifies only that the candidate has a friend.
Profiling instead of signals: stepping up checks by nationality or accent, which is unlawful, catches fewer fraudsters than consistent role-based checks and observable red flags.

Practitioner checklist

Tier every role to an identity assurance target, with IAL2 as the floor for any remote hire who receives credentials.
Proof identity at conditional offer with document validation, liveness with ISO/IEC 30107-3 tested PAD and injection detection.
Re-verify the face at day one before credentials and the first authenticator are issued.
Require camera on interviews, with live challenges and work-specific questioning.
Verify references and history through independently sourced contacts only.
Flag reused phone numbers, emails and CV text across applications, and address or payroll changes between offer and start.
For UK right to work, use an OfDIA registered RtW DVSP or the Home Office online check, keep evidence for employment plus two years, and offer a manual route.
Write proofing standards into staffing agency contracts and audit them.
Complete a DPIA, stage data collection, offer a non-biometric alternative and delete unsuccessful candidates' evidence on schedule.
Make "identity proofed" a precondition for account provisioning in the joiner workflow.

Hiring Fraud and Candidate Identity Verification Guide: Verifying Candidates Before Access Is Granted