How should organisations prevent fake candidates from reaching onboarding?

Why This Matters for Security Teams

Fake candidates are not just a recruiting problem. They are an identity assurance failure that can lead to insider risk, payroll fraud, credential theft, and premature access to corporate systems. The risk increases when interviews, background checks, and offer letters are treated as sufficient proof of identity. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which is a reminder that identity assurance gaps often persist long after onboarding decisions are made.

For security teams, the important shift is to treat candidate verification as a trust gate, not a paperwork step. That means verifying the person behind the application, checking for synthetic or stolen identity signals, and making sure the hiring workflow does not create a back door into production access. Controls from NIST SP 800-53 Rev 5 Security and Privacy Controls are relevant here because identity proofing, access approval, and auditability need to be linked, not handled as separate tasks. In practice, many security teams encounter candidate fraud only after onboarding has already triggered account creation and privileged provisioning.

How It Works in Practice

The strongest approach is layered and risk-based. Start before offer acceptance, then repeat verification at the point where employment status changes into account creation, badge issuance, and system access. A standard HR workflow is rarely enough on its own because fake candidates often rely on convincing documents, remote interviews, or delegated participation by a real person who is not the eventual worker. The goal is to prove that the candidate is the same person across the full hiring path, not just during a single interview.

Practical controls usually include document authenticity checks, liveness testing, cross-channel verification, and anomaly review for mismatched geolocation, device fingerprints, or job history. Where roles are remote, privileged, or tied to finance, infrastructure, or customer data, current guidance suggests adding enhanced review and manual escalation. If the role later requires access to secrets, API keys, or admin consoles, the hiring process should be paired with least-privilege provisioning and a separate approval step. That is consistent with the broader NHI governance picture described in the Ultimate Guide to NHIs, where weak identity hygiene often becomes an access problem.

• Verify government-issued identity documents with fraud detection, not visual review alone.
• Use liveness and session integrity checks for remote interviews and onboarding.
• Compare application details against trusted sources, prior records, and risk signals.
• Delay system access until identity proofing is complete and employment status is confirmed.
• Escalate any mismatch between interview behaviour, location, documents, and compensation setup.

For regulated environments, map the workflow to NIST SP 800-53 Rev 5 Security and Privacy Controls so that identity proofing, separation of duties, and audit records are enforceable rather than informal. These controls tend to break down when hiring is outsourced across multiple vendors because no single party owns the end-to-end fraud signal.

Common Variations and Edge Cases

Tighter verification often increases hiring friction, requiring organisations to balance fraud resistance against candidate experience and time-to-hire. That tradeoff is especially visible in high-volume recruiting, global hiring, and contract-to-hire programs, where manual review can slow legitimate candidates. Best practice is evolving, and there is no universal standard for how much evidence is enough for every role.

High-risk positions usually justify stronger checks than general staff roles. For example, access to payroll, customer support tooling, cloud consoles, or source code should trigger higher assurance than a low-privilege internal role. Remote hiring also creates a real exception case: a candidate can be authentic and still represent elevated risk if the device, network, or payment details suggest account-sharing or impersonation. That is why security, HR, and legal teams should define which anomalies are disqualifying, which require review, and which can be accepted with compensating controls. NHI Management Group’s research shows that 90% of IT leaders say properly managing NHIs is essential for zero trust, which underscores the value of linking identity assurance to downstream access governance in the Ultimate Guide to NHIs.

Where the process often fails is with subcontractors, referrals, and urgent backfill hiring, because shortcuts are introduced precisely when scrutiny should be highest.

Related resources from NHI Mgmt Group

• How should organisations prepare to accept the EUDI Wallet in onboarding flows?
• How should organisations reduce identity theft risk in digital onboarding?
• How do organisations prevent governance drift when third parties are involved?
• How should security teams prevent fake remote workers from gaining broad access?