Topic starter
19/08/2026 3:25 pm
TL;DR: AI-generated deepfakes, stolen identities, and impersonation tactics are making candidate fraud scalable enough to bypass conventional onboarding controls, according to Ping Identity, which argues that verified onboarding is needed to restore identity assurance across the worker lifecycle. The core issue is that legacy hiring checks assume a human can reliably confirm who is behind the screen, and that assumption no longer holds.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “Verified Onboarding Stops AI-Driven Candidate Fraud Before It Starts”.
By the numbers:
- More than 300 U.S. companies have unknowingly hired sanctioned foreign adversaries.
Key questions
Q: What breaks when organisations rely on one-time identity checks?
A: One-time checks break when the identity can keep acting after the original trust decision is no longer valid.
Q: Why do remote and contractor hiring flows increase candidate fraud risk?
A: Remote and contractor flows remove physical checkpoints and often split ownership across recruiters, HR, IT, and third parties.
Q: How can security teams tell if onboarding controls are not providing real assurance?
A: A weak onboarding programme shows up when fraud is only discovered after interview completion, device issuance, or access grant.
Practitioner guidance
- Strengthen identity proofing at the first hiring touchpoint Use government ID verification, biometric matching, and liveness detection before interviews, offers, or device issuance to establish who the candidate actually is.
- Carry verified identity forward as a trust anchor Bind the verified candidate to a reusable credential or biometric so later interviews, Day 1 checks, helpdesk recovery, and access changes confirm the same person.
- Orchestrate onboarding across HR, IT, and security Map each verification and approval step so no handoff can issue access before identity proofing is complete and logged.
Bottom line: Candidate fraud now exploits the gap between identity proofing and actual worker start, which means onboarding has become a security control point.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
Verified onboarding is now an identity security control, not an HR convenience. The article shows that candidate fraud can progress all the way from interview deception to post-onboarding abuse before traditional checks notice anything wrong. That makes hiring a governed identity event, not a paperwork milestone. Practitioners should treat worker entry as the start of an assurance lifecycle, not the end of verification.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Who should own verified onboarding across HR, IT, and third-party hiring channels?
A: Ownership should be shared, but accountability must be explicit. HR, recruiting, security, and IT each control different checkpoints, and without a named owner for identity assurance, gaps appear at the handoffs where impostors are most likely to slip through.
👉 Read our full editorial: AI-driven candidate fraud exposes the limits of onboarding checks