Why do remote hiring and GenAI-assisted fraud increase identity risk for workforce access programmes?

Why This Matters for Security Teams

Remote hiring changes identity assurance from a mostly physical problem into a document, video, and workflow problem. GenAI lowers the cost of producing convincing passports, pay slips, reference letters, and synthetic interview footage, so onboarding teams can no longer assume that a polished application reflects a real person. Current guidance from NIST AI 600-1 GenAI Profile and the OWASP Non-Human Identity Top 10 points to a broader lesson: identity trust has to be continuous, not a one-time onboarding event.

This is not just an HR fraud issue. Once a fraudulent worker account is issued, that identity can be used to access payroll, internal systems, collaboration tools, source code, ticketing, and privileged support channels. For security teams, the risk is compounded by rushed exceptions, weak proofing, and pressure to reduce time-to-hire. NHI Management Group research shows how often identity-related controls fail when they are not designed for persistence and revocation: in the Ultimate Guide to NHIs, 91.6% of secrets remained valid five days after notification, which illustrates how slowly many organisations remove trust once it has been granted.

In practice, many security teams encounter fraudulent access only after the account has already been used to move into internal systems, rather than through intentional onboarding review.

How It Works in Practice

The practical failure mode is simple: static onboarding controls were designed for a world where humans were easier to verify and easier to supervise. Remote hiring removes in-person corroboration, while GenAI makes forged artifacts and synthetic presence cheap enough to scale. That means traditional checks such as document upload, one-time video calls, or email-based approval chains are no longer sufficient on their own. Security teams need layered proofing, stronger binding between the person and the account, and lifecycle controls that continue after day one.

Best practice is evolving toward a mix of identity proofing, device assurance, and ongoing attestation. At onboarding, teams should validate government ID, verify liveness, and corroborate applicant data through independent sources where allowed. After access is granted, privilege should be tied to job role, manager approval, and device posture, then revisited on a schedule. The NIST SP 800-53 Rev 5 Security and Privacy Controls remains relevant here because identity assurance, access enforcement, logging, and revocation all need to work together, not as separate checks.

• Use stronger identity proofing for remote hires, especially where payroll, customer data, or source code access is involved.
• Separate hiring approval from systems provisioning so a single compromised workflow cannot create broad access.
• Apply step-up verification for first login, sensitive actions, and privileged requests.
• Re-attest employment, role, and device trust during probation, promotion, and transfer events.
• Monitor for anomalous behavior that suggests identity compromise, account sharing, or synthetic enrolment.

For teams that want a deeper baseline on identity sprawl, the Ultimate Guide to NHIs and the Top 10 NHI Issues both show how quickly weak lifecycle control becomes a governance problem. These controls tend to break down in high-volume hiring environments because manual review cannot keep pace with document fraud, exception handling, and rapid provisioning.

Common Variations and Edge Cases

Tighter verification often increases hiring friction, requiring organisations to balance fraud resistance against candidate experience and time-to-start. That tradeoff becomes sharper for contractors, offshore staff, and seasonal workforces, where speed is often prioritized and local identity documents may be harder to validate. There is no universal standard for this yet, but current guidance suggests using risk-based proofing rather than one rigid process for every role.

Some environments need extra caution. Customer support teams, finance roles, and developers with code or production access should receive stronger checks than low-risk internal roles. Where workforce access is federated through an identity provider, the risk often shifts from onboarding paperwork to account takeover and session abuse, so MFA, device trust, and conditional access matter as much as initial proofing. Where the hiring process is outsourced, the organisation still retains accountability for access granted under its name.

NHIMG’s research on the 52 NHI Breaches Analysis is a useful reminder that weak lifecycle control, not just weak initial issuance, is what turns an identity mistake into a breach. The same logic applies here: if verification ends at onboarding, fraud can persist until routine recertification, offboarding, or anomaly detection catches it. In high-turnover or globally distributed organisations, that delay is often too long.

Related resources from NHI Mgmt Group

• Why do remote workers create more risk for identity and access management programmes?
• Why do AI-driven attacks increase risk for identity and access management programmes?
• Why do third-party access paths increase identity risk across enterprise programmes?
• Why do agentic AI and automated workflows increase fraud and access risk when identity assurance is weak?