Look for access growth that does not match role expectations, unusual communication patterns, and SaaS notifications tied to payroll or export changes. The pattern matters more than any single event, because the fraud usually appears as normal onboarding followed by abnormal activity.
How fake hires turn access into a foothold
A fake hire is usually not interesting because of one login or one account. The signal is the shape of the access trail: it starts like routine onboarding, then expands into permissions, mailbox access, SaaS exports, payroll changes, and related systems that should not all be touched by the same person so early. That pattern is what makes the case materially different from ordinary employee setup.
One early clue is privilege creep that outpaces the job description. If an account starts with a standard role but quickly gains admin-like visibility, delegated access, or workflow approvals without a clear business reason, the access path is being normalised rather than justified. In mature environments, legitimate access growth is usually bounded by role, manager approval, and a measurable task need.
A second clue is cross-system access that creates unnecessary reach. Fake hires often use the cover of onboarding to accumulate access across identity, collaboration, HR, finance, and cloud tools, because those platforms are less likely to be challenged when requests arrive close together. The practical question is not whether each request looks plausible in isolation, but whether the combined access set creates an unusually broad operational footprint.
Behavioral and operational signs that deserve attention
Unusual communication patterns are often more revealing than the permissions themselves. Watch for requests routed through informal channels, sudden pressure to approve exceptions, or interactions that avoid the normal manager, HR, or ticketing path. In a real employee lifecycle, the request pattern tends to be consistent with the role; in a fake hire, the human process often feels improvised even when the account activity looks orderly.
Also look for mismatches between access activity and work output. A genuine new hire usually needs time to ramp up and will show a narrow set of early actions tied to training, setup, or assigned tasks. A suspicious account may instead focus on broad data visibility, export functions, or account changes that have a clear downstream value for fraud, such as altering payment details or moving payroll destinations.
Notifications from SaaS platforms can be especially useful because they often reveal the exact action rather than the intent. Password resets, MFA enrollment changes, profile edits, export jobs, forwarding-rule creation, and payroll or bank-detail updates are all legitimate in some contexts, but they become stronger indicators when they cluster around a newly onboarded user and do not fit the role.
What separates suspicious growth from ordinary onboarding
The deciding factor is usually sequence and consistency. Normal onboarding has a predictable arc, with access added in response to documented tasks, training milestones, or manager-approved needs. Suspicious accumulation has a different rhythm: the account keeps expanding, exceptions are granted quickly, and the new access is immediately converted into visibility, export capability, or financial control.
That is why single events are rarely enough. One unusual SaaS notification can be a false positive, but repeated access expansion across adjacent systems is harder to dismiss. If the account begins to touch payroll, finance approvals, account recovery, or export-heavy tools without a strong business reason, treat the pattern as a fraud indicator rather than a simple helpdesk issue.
Risk and Threat Considerations
Fake hires are dangerous because they exploit trust in the onboarding process. Once the account is treated as ordinary, attackers or insiders can use routine approvals, delayed reviews, and the appearance of legitimacy to expand access before anyone notices the role and the permissions no longer match.
Failure mechanism: the account gains incremental access through normal-looking requests, then uses that access to reach higher-value systems such as payroll, finance, or export functions before access review catches up.
Impact: the organisation can face fraudulent payments, data exposure, account takeover, and a larger blast radius because the access trail appears administrative until the damage is already underway.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Fake-hire access growth is fundamentally a least-privilege failure. |
| IA-2 — Identification and Authentication (Organizational Users) | Suspicious onboarding depends on whether the claimed user is real and authenticated. | |
| AU-6 — Audit Review, Analysis, and Reporting | Detecting access accumulation depends on reviewing clustered changes and abnormal events. | |
| Recommendation — Limit each new account to the minimum access needed for its documented role. Require strong identity verification before expanding any new employee account. Review access and SaaS activity for unusual sequences tied to newly onboarded users. | ||
| CIS Controls v8 | CIS-5 — Account Management | The issue centers on excessive and abnormal account growth during onboarding. |
| Recommendation — Track, approve, and periodically validate all account changes for each user. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Fake hires abuse legitimate-looking accounts to blend in while access expands. |
| Recommendation — Hunt for legitimate-account abuse when access growth appears normal but behavior does not. | ||
Practitioner Guidance
What to verify: compare each access change against the person’s role, start date, manager approval, and expected training stage. If the access package is broader than the job requires, treat that as a control failure even if every individual change looks authorised.
Decision rule: if a new account touches payroll, exports, forwarding, recovery, or admin-adjacent settings before it has a clear operational need, escalate immediately and validate the human identity, hiring record, and access approvals before granting anything more.
What practitioners underestimate: the most useful signal is often the combination of small events across systems, not a single high-severity alert. A fake hire usually leaves a messy sequence of normal requests that only becomes obvious when you line up the access growth, the communication path, and the business purpose.
Practitioner takeaway: Treat abnormal access accumulation as a lifecycle anomaly, not just an account anomaly. The earlier you challenge access that outruns the role, the more likely you are to stop fraud before it reaches payment, export, or recovery controls.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org