Topic starter
06/11/2026 6:40 pm
TL;DR: Remote hiring has created a fraud surface that background checks, document verification, and skills tests do not see, according to imper.ai, while nation-state operators can use stacked VPNs, proxy routing, and remote-controlled devices to pass interviews and onboarding. The control gap is continuity of the operator, not identity at a single moment.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “Hiring Fraud: How Attackers Walk Through the Front Door of Your Workforce”.
Key questions
Q: How should teams verify candidate identity in remote interviews?
A: Teams should verify candidate identity with live video consistency, matching the person to identity documents, voice, background and behaviour across the interview and onboarding steps.
Q: Why can a candidate pass interviews and still be a hiring fraud risk?
A: A candidate can pass interviews and still be a hiring fraud risk because the person interviewed may not be the person who later does the work.
Q: How does session continuity expose operator substitution in remote hiring?
A: Session continuity exposes operator substitution by comparing who authenticated at the start of hiring activity with who continues the interaction over time.
Practitioner guidance
- Implement multi-stage identity correlation Compare application, screening, interview, offer, and onboarding signals for the same candidate so the organisation can detect a change in device, network, or operator.
- Instrument device and network telemetry in interviews Collect device fingerprint, VPN, latency, and session origin data during live interviews so the team can spot proxy routing and remote-controlled sessions.
- Add onboarding baseline drift checks Require a second comparison at onboarding against the interview baseline and escalate any shift in location, device profile, or identity artifacts.
Bottom line: Remote hiring creates a verification gap that point-in-time identity checks cannot close because the person on screen may not be the person operating the session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Hiring fraud is a verification continuity problem, not a document problem. Background checks and identity documents only validate a moment in time, while the actual risk sits in the live operating environment. When the device, network, and operator can all change between application and onboarding, traditional hiring controls are looking at the wrong layer. Practitioners need to treat continuity of the session as part of identity governance.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: What should organisations do when a hire’s device or network profile changes after onboarding?
A: They should treat the change as a re-verification trigger and review whether the device, network path, and authenticated session still match the approved hire. If the change is unexplained, step up identity proofing, require fresh liveness and device checks, and withhold access until the account and session context are trusted again. This limits proxying and post-onboarding substitution.
👉 Read our full editorial: Hiring fraud is evading remote verification and device checks