Cybersecurity for Recruitment Agencies: Protecting Candidates, Clients and Contractor Pay

A recruitment agency sits on one of the richest stores of personal data in any small business, passes people into its clients' organisations every week and runs a weekly payroll for temporary workers, which makes it a target for data thieves, impersonators and payment fraudsters at the same time. Staffing firms and recruitment agencies hold CVs, identity documents, right to work evidence and bank details for thousands of candidates, often in a cloud applicant tracking system (ATS) that every consultant can search and export. This guide is for agency owners, operations and compliance leads, and the IT providers who support them. It covers sector threats, the rules that shape the controls, and a phased programme for agencies of 10 to 1,000 staff.

Key takeaways

• The candidate database is the crown jewel. Bulk search and export rights in the ATS or CRM, held by every consultant, are the single biggest data breach exposure in most agencies.
• Your brand is a scammer's tool. Fake recruiters copy agency names, logos and consultant profiles to harvest jobseekers' documents and money, so domain and profile monitoring is a core control, not marketing hygiene.
• You vouch for the people you place. An agency that submits a fraudulent applicant passes the risk straight to its client, so candidate identity must be bound from first interview to first shift.
• Weekly pay is a weekly fraud window. Bank detail changes, timesheet approvals and umbrella company supply chains are where money leaves, and since 6 April 2026 UK agencies can be liable for an umbrella's unpaid PAYE.
• Your role under data protection law changes by activity. The same record can be held as processor for a client and as controller for your own talent pool, and each needs its own retention rule.

Why recruitment agencies are a distinct risk

An agency protects four assets that interact: the candidate database, client relationships, the brand jobseekers trust, and contractor payroll.

• Volume and sensitivity: a mid-sized agency may hold hundreds of thousands of CVs, plus passport scans, national insurance or social security numbers, criminal record check outcomes for regulated roles, and health information for safety-critical placements.
• Open front door by design: consultants are paid to open attachments and links from strangers, so CV-borne malware and credential phishing reach the heaviest users of the ATS.
• High churn and commission culture: consultants move between competitors.
• Dense integrations: job boards, LinkedIn Recruiter seats, multiposting, video interviewing, screening providers, timesheet portals and payroll bureaux, connected by API keys, OAuth grants or shared logins.
• Trusted channel into clients: agencies email shortlists to hiring managers, upload documents to client vendor management systems (VMS) and, for contract and managed service work, receive client accounts on behalf of placed workers.

Threat picture

The table maps the threats seen against staffing firms to ATT&CK techniques and the first control to put in place. Technique IDs are from ATT&CK v20.

The FBI's Internet Crime Complaint Center (IC3) has described both halves of the impersonation problem. In 2020 it warned that criminals build lookalike company websites, post fake openings and interview by teleconference to collect identity documents, bank details or upfront fees, with an average reported loss of nearly $3,000 per victim. In 2022 it reported applicants using deepfakes and stolen personal information for remote IT and database roles, with background checks showing the details belonged to someone else. The first harms jobseekers who trust your name; the second harms the clients who trust your shortlist.

Regulation and your role under data protection law

Examples are from the UK; EU agencies apply the GDPR equivalents.

Controller, processor or both

The Information Commissioner's Office (ICO) draft guidance on recruitment and selection, dated 9 July 2025, explicitly covers agencies, head-hunters and consultancies. Its consultation has closed, the final version is still to be published and the ICO says it is under review following the Data (Use and Access) Act, so check the current text before relying on it. The draft explains that an agency acting on an employer's behalf is typically a processor, but becomes a controller for data it uses for its own purposes, such as contacting an unsuccessful candidate about other roles, and for records it keeps to meet its own statutory duties under employment agency legislation. Where an agency and a client jointly run a stage, such as first interviews, they may be joint controllers and need an arrangement that says who answers subject access requests.

• As processor: you need a binding written contract with the client (UK GDPR Article 28), you may make day-to-day decisions on storage and deletion within it, and you need the client's prior written authorisation before using a sub-processor such as a screening provider. See the GDPR Article 28 Processor Guide.
• As controller: you set the lawful basis, retention and security for your own talent pool, and if you source candidates from public recruitment platforms you must give them privacy information no later than one month after obtaining their details. The ICO draft treats a private message about a vacancy as direct marketing under PECR and says employers should not search candidates' personal social media profiles.
• Security either way: UK GDPR Article 32 requires appropriate technical and organisational measures, and clients must check that their agencies offer sufficient guarantees, which is what client security questionnaires test.

Agency conduct records

In Great Britain, regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 requires agencies and employment businesses to keep records showing compliance, for at least one year from creation, and for work-seeker and hirer particulars at least one year after the agency last provides services to that person. That sets a floor for retention, not a reason to keep CVs indefinitely.

Umbrella companies and supply chain fraud

HMRC guidance states that for payments made on or after 6 April 2026, the agency that contracts with the end client is responsible for making sure PAYE is operated correctly when an umbrella company employs its workers, and HMRC can recover any underpayment from that agency; where there is no agency, the end client is responsible. HMRC's labour supply chain assurance guidance adds that the end client may be liable instead where the agency is connected to the umbrella or based overseas, and reminds businesses of corporate offences for failing to prevent the facilitation of tax evasion (Criminal Finances Act 2017) and, for large organisations, failing to prevent fraud (Economic Crime and Corporate Transparency Act 2023). HMRC also describes mini umbrella company fraud, where one umbrella is split into many small companies to abuse small-business reliefs. Umbrella due diligence is now a financial control.

Protecting the candidate database

Treat the ATS or recruitment CRM as a regulated system of record, not a contact list. See the Greenhouse Recruiting Security guide for an example of the platform-level settings to look for in any ATS.

The ICO draft supports this staging: ask for bank and emergency contact details only after an offer, request criminal record information at vetting rather than on the application form, and verify identity with the minimum documents needed (a passport or a driving licence, generally not both), sent by a secure method rather than a plain email attachment.

• Export controls: limit CSV and bulk export to a small group, require a reason, and alert on exports above a threshold (for example more than 500 records in a day). This is the most effective single control against departing-consultant data theft.
• Retention automation: set retention timers per category and per role (processor data deleted when the client contract says, talent pool data reviewed on a fixed cycle with candidate notice). The ICO draft says there is no fixed timescale, retention should be documented per category, and unsuccessful candidates' records are usually kept only for the period in which they could bring a claim unless there is a clear reason. See the Data Retention and Secure Deletion Guide.
• Email is not a document store: route candidates to an upload portal and sweep mailboxes for passport and bank detail patterns.

Defending candidates and the brand from recruiter impersonation

The awareness side is covered in the Job and Task Scams Guide; the agency controls are these.

1. Lock down email authentication: publish SPF and DKIM for every sending service (ATS, multiposter, marketing) and move DMARC to p=reject. See the DMARC, SPF and DKIM Guide.
2. Monitor lookalike domains and profiles: register the obvious variants, watch new registrations containing your brand, and search job boards and social platforms for cloned consultant profiles. See the Domain Portfolio and Lookalike Domain Management Guide.
3. Publish what you never do: state on the careers page and in every first contact that the agency never charges candidates, never sends cheques for equipment and never interviews only by text chat. The FTC lists paying to get a job and depositing a cheque then sending money back as hallmarks of job scams.
4. Run a takedown playbook: collect evidence, report to the platform and registrar, warn candidates, and in the US point victims to ReportFraud.ftc.gov and IC3 as the FBI and FTC advise.

Screening the people you place

An agency is the first filter between a fraudulent applicant and a client's network. Detailed verification techniques are in the Hiring Fraud and Candidate Identity Verification Guide, and nation-state schemes in the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes). What changes for an agency is accountability across the hand-off.

• Bind identity before submission: capture a verified reference image and contact details at registration and check that the same person appears at client interview and on day one, especially for remote IT contract roles.
• Agree who checks what: the client contract or statement of work should state whether the agency or client performs identity, right to work, reference and criminal record checks, and how results and evidence are shared. Gaps here are where fraudulent placements pass.
• Watch the payment trail: requests to pay a contractor into a third party's account, frequent bank changes, or equipment shipped to an address unrelated to the worker are signals the fake IT worker advisories highlight.
• Escalate fast: a suspected impostor triggers the agency's incident process: suspend pay, preserve interview and verification evidence, and check other placements for the same identity or bank account.

Payroll, timesheets and contractor payments

The FBI's 2018 payroll diversion advisory described the pattern agencies still face: phishing for employee self-service credentials, changing the bank account, and adding rules so the employee does not see the change alert. The general controls are in the Payroll Diversion Fraud Guide; the agency-specific ones are below.

• Bank change verification: confirm every bank detail change with the worker on a phone number already on file, never one supplied in the request, and hold the first payment to a new account for review.
• Timesheet approval integrity: client approvers should authenticate to the portal with MFA; approvals by email reply are easy to forge and should not release pay.
• Separate duties: the person who changes worker bank details should not also run the pay file.
• Umbrella due diligence: follow HMRC's mini umbrella warning signs (several companies formed at once with unusual names, business activities on Companies House that do not match labour supply, directors without sector history, short-lived companies), check Companies House on onboarding and at each quarterly intermediary report, and confirm who pays workers and who pays the tax.

Where identity fits

Agency incidents usually start with a recruiter's identity, not a server. Put every recruiting platform behind single sign-on with phishing-resistant MFA, so a consultant's leaving date disables ATS, job board and LinkedIn Recruiter access in one step rather than relying on shared seat passwords. Send assignment end dates to clients so accounts issued to placed workers are removed on time. The API keys and service accounts linking the ATS to job boards, screening and payroll can read the whole candidate base, so give each an owner, the narrowest scope, vaulting and rotation. See the Phishing-Resistant MFA Guide.

Implementation roadmap

1. Weeks 1 to 4, stop the obvious losses: enforce MFA on email, the ATS, job boards and payroll; introduce callback verification for all bank detail changes; remove bulk export from all but a named group; move DMARC to quarantine. Pilot each change with one desk first.
2. Months 2 to 3, map the data: build a record of processing that distinguishes processor and controller activities; set retention per category and client contract; inventory integrations and their credentials; agree check responsibilities in client contracts.
3. Months 3 to 6, harden and certify: move to single sign-on, phishing-resistant MFA for administrators and payroll, DMARC at p=reject, a candidate upload portal, and certify against Cyber Essentials (UK), whose five controls (firewalls, secure configuration, security update management, user access control and malware protection) match what clients' questionnaires ask. See the Cyber Essentials Guide.
4. Months 6 to 12, monitor and rehearse: alert on exports and mailbox rule creation, run lookalike domain monitoring, and rehearse a ransomware scenario that lands the day before pay runs, including a manual payroll fallback.

Rollback: retention automation is the change most likely to cause harm if wrong. Run deletion in report-only mode for one cycle, review what would be deleted with compliance, then enable it with a short recoverable window.

Decision guidance

Clients in finance, healthcare and government will expect the right-hand column. A high-volume temporary desk may use lighter checks for low-access roles if the decision is documented and stronger checks apply wherever a placement receives system access.

Detection and measurement

Log ATS exports and searches, mailbox rule creation and forwarding, bank detail changes, sign-ins to recruiting platforms from new countries or outside working hours, and new registrations resembling your domain.

• MFA coverage: percentage of recruiting, email and payroll accounts on MFA (target 100 percent, phishing-resistant for administrators).
• Bulk exports: number of exports above threshold per month, and the share with a recorded business reason.
• Bank change verification rate: share of bank detail changes verified out of band before first payment.
• Retention compliance: records past their retention date at month end, trending to zero.
• Impersonation response time: median days from detection of a lookalike domain or cloned profile to takedown.
• Placement verification: percentage of placements with identity verified before client submission.

Framework mapping

Common failure patterns

• Everyone can export everything: ATS defaults or historic convenience leave bulk export with every consultant, so one phished account or departing recruiter takes the whole database.
• Passports in inboxes: identity documents and bank details received by email are never deleted, so a mailbox compromise becomes a reportable breach of thousands of documents.
• Bank changes by email: a convincing message changes a contractor's account, and the agency learns of it when the worker asks where their pay went.
• Keeping talent pools forever: old candidate records kept without notice or review multiply breach impact; the ICO draft treats a talent pool as a new purpose candidates must be told about.
• Assuming the client checks: agency and client each believe the other verified identity, and a fraudulent contractor receives client credentials.

Practitioner checklist

• Enforce MFA on email, ATS, job boards, LinkedIn Recruiter, timesheet and payroll systems, with phishing-resistant methods for administrators.
• Restrict bulk export to a named group and alert on large exports.
• Collect bank, identity and criminal record data only at the stage that needs it, outside the main candidate profile.
• Document processor and controller activities, sign Article 28 terms with clients, and authorise sub-processors.
• Set and automate retention per data category, respecting the one-year agency records floor.
• Verify every worker and supplier bank change by callback to a number on file.
• Run umbrella company due diligence against HMRC's mini umbrella warning signs and Companies House.
• Enforce DMARC at p=reject and monitor lookalike domains and cloned consultant profiles.
• Agree in each client contract who performs identity, right to work and reference checks.
• Rehearse ransomware recovery with a manual payroll fallback before peak pay periods.

Standards and references

• ICO: Employment practices and data protection, recruitment and selection (draft)
• ICO: Responsibility for data protection compliance during the recruitment process
• legislation.gov.uk: Conduct of Employment Agencies and Employment Businesses Regulations 2003, regulation 29
• HMRC: PAYE rules for labour supply chains that include umbrella companies from 6 April 2026
• HMRC: Mini umbrella company fraud
• FBI IC3: Cyber Criminals Use Fake Job Listings to Target Applicants' Personally Identifiable Information
• FBI IC3: Cybercriminals Utilize Social Engineering Techniques to Obtain Employee Credentials to Conduct Payroll Diversion
• FTC: Job Scams

This guide summarises regulatory guidance and is not legal advice. Related NHI Mgmt Group resources: Hiring Fraud and Candidate Identity Verification Guide · Personnel Security and Background Screening Guide · Small Business Cybersecurity Basics Guide · AI Agents in HR Guide