Why do remote interviews not prove that a candidate is who they claim to be?

Why a remote interview is not an identity proofing event

A remote interview is a live interaction, not an assurance process. It can show that a person answered questions on a given day, but it does not establish that the person presenting in the call is the same individual who will later complete forms, receive equipment, or enter production systems.

The weakness is continuity. Identity trust breaks when the hiring flow treats one successful video call as proof for every later checkpoint. If the interview, document review, device handoff, and account creation are not independently rechecked, the organisation has only verified a moment, not the full chain of identity and access.

That distinction matters because a candidate can pass a conversation while still failing the checks that actually bind a real-world person to a role, a workstation, and an account. The interview is one signal in a broader trust decision, not the trust decision itself.

Where the failure shows up in hiring and onboarding

The practical failure usually appears after the interview, when assumptions harden into process. A recruiter may assume the same person will appear for onboarding, an IT team may ship a laptop without a fresh check, or a manager may approve access because the interview felt convincing. Each step widens the gap between social confidence and verified identity.

Remote hiring also creates more room for substitution and delegation. Someone else can sit in the interview, a different person can complete paperwork, and another actor can later use the credentials, device, or workspace that were provisioned on the basis of the first interaction. The risk is not only deception at entry, but mismatch across the whole employee lifecycle.

That is why a strong process separates human judgement from verification. Interview feedback should inform the hiring decision, but it should not be treated as evidence that the onboarding identity, device possession, and system-access identity are all the same.

What actually has to be revalidated

The control point is not “did they interview well?” but “does the same verified person keep showing up at each trust boundary?” Good practice is to revalidate identity at the moments where the risk changes: before equipment is issued, before credentials are activated, before privileged access is granted, and before any exception is made to normal onboarding.

That usually means checking more than one signal. A person can be real, but still not be the person the organisation intended to hire. A process that binds identity to documents, possession, and later access reduces the chance that a convincing interview masks a weak handoff later in the workflow.

For organisations that want a reference point for stronger identity controls, NIST SP 800-63 Digital Identity Guidelines is useful for thinking about assurance, while NIST Cybersecurity Framework 2.0 helps frame the governance and protective controls around that lifecycle.

Risk and Threat Considerations

A remote interview becomes risky when an organisation treats it as proof of identity rather than one checkpoint in a larger verification chain. That can lead to hiring fraud, credential issuance to the wrong person, and early access being granted before the organisation has validated who is actually behind the screen.

Failure mechanism: The attacker or impostor only needs to satisfy the interview once, then exploit weak follow-up controls such as unverified document submission, unattended device shipment, or account activation based on trust rather than revalidation.

Impact: The organisation may onboard an unauthorized person, expose internal systems and data, and create a durable access path that is harder to unwind after the fact than it was to prevent at intake.

Practitioner Guidance

What to verify: Treat the interview as insufficient unless the same person is rechecked at each downstream checkpoint that matters for employment, provisioning, and access. The practical test is whether the organisation can still defend the identity decision after documents, delivery, and system access are all in motion.

Decision rule: If a later step can create real access, credentials, or asset custody, require an independent verification step at that point rather than relying on the interview record. If the process cannot revalidate identity, limit what that person can receive or access until the gap is closed.

Practitioner takeaway: A remote interview is evidence of participation, not proof of identity continuity, so the safest hiring process is the one that keeps re-establishing trust at every point where the decision becomes operationally expensive to reverse.

Related resources from NHI Mgmt Group

• How should teams evaluate remote onboarding for AMLR compliance?
• When does a remote IDV flow become a regulated trust-service issue?
• How should OT teams define the environment when IT, cloud, and remote access affect production?
• Should organisations treat remote vendor access as part of OT governance or separate IT access?