Which HR behaviors increase hiring fraud risk?

You reduce hiring fraud risk by verifying who the candidate is before you verify what they can do, keeping the same checks on every requisition, and separating the decision to hire from the decision to grant system access. Most hiring fraud gets through on process shortcuts, not on clever forgery.

That last point is the one hiring teams keep missing. On 30 June 2025 the US Department of Justice announced coordinated actions against a network of North Korean remote IT workers who, from 2021 until October 2024, compromised the identities of more than 80 US persons to obtain remote jobs at more than 100 US companies, many of them Fortune 500. The cost was not a run of bad hires. It was legal fees, network remediation and other losses of at least 3 million dollars. Every one of those companies had a hiring process. What they lacked was identity assurance wired to access issuance.

TL;DR

• Hiring fraud is usually a sequencing problem, not a forgery problem: identity gets confirmed after the offer, by which point the person already has a laptop and a login.
• Four HR behaviors do most of the damage: hiring under deadline pressure, treating the resume as evidence, running a different process per department, and scattering candidate data across tools nobody reconciles.
• No single control catches everything. A background check cannot catch an impostor using someone else's clean record, and a resume check cannot catch a deepfake.
• Fraud surfaces slowly. The typical case runs about 12 months before anyone notices, and tips, not audits, find most of it.
• For remote and privileged roles, split the hiring decision from the access decision and put a verified identity record between them.

How do you reduce hiring fraud risk?

Reduce hiring fraud risk by putting identity verification before the offer, scoring skills with a proctored assessment instead of trusting the resume, running one documented process for every role, and issuing access only after the verified identity matches the person who interviewed. Controls in that order catch impostors early and cost the least.

Order matters more than tooling. A team running the same four steps on every requisition catches more fraud than one that owns expensive verification software and skips it whenever a hiring manager is in a hurry.

1. Verify identity at the shortlist stage, not at onboarding. Check a government ID against a live photo of the person's face, before the first panel interview.
2. Make the candidate demonstrate the skill under observation. A proctored skills assessment produces evidence a stand-in cannot borrow.
3. Keep the process identical across departments. Fraud finds the one team that skips steps, and that is usually the team hiring fastest.
4. Issue credentials against the verified identity, not against the job offer. Almost nobody owns this step, and it is the one that turns a bad hire into a security incident.

Which HR behaviors increase hiring fraud risk?

Four behaviors raise hiring fraud risk more than any others: filling a role against a deadline instead of a standard, accepting resume claims as verified facts, letting each department run its own version of the process, and splitting candidate records across tools that never get reconciled. Each one removes a check rather than adding a risk.

Hiring against a deadline instead of a standard

Speed is not the problem. Speed with a shrinking checklist is. When a requisition is three weeks late, the steps that get dropped are the slow ones: the reference call, the ID check, the second interviewer. Those are also the only steps a fraudulent candidate cannot script in advance.

Treating the resume as evidence

A resume is a claim. It becomes evidence only when something outside the candidate's control confirms it, which is partly why skills-based hiring works: a scored assessment of the actual work is far harder to fake than a job title.

Running a different process per department

Ask five hiring managers how they screen and you often get five answers. That inconsistency is the gap. One documented sequence, same verification steps in the same order, removes the discretion fraud depends on. Structured interviews do the same job inside the interview itself.

Scattering candidate data across tools

With the ID scan in one system, the assessment score in another and interview notes in a third, nobody sees the pattern. A name that does not quite match, a time zone contradicting the stated location, a second face on camera: forgettable alone, obvious together. Fraud survives in the space between tools.

What are the red flags of hiring fraud in a live process?

The clearest red flags are a candidate who resists any identity check, documents whose names or dates disagree, interview audio that does not match the speaker's mouth, answers that sound recited rather than recalled, and sudden pressure to skip steps or keep things quiet. Any two together deserve a pause.

On deepfakes the FBI is unusually specific. Its Internet Crime Complaint Center alert I-062822-PSA, published 28 June 2022, reports that during these interviews the actions and lip movement of the person on camera do not completely coordinate with the audio, and that coughing, sneezing or other audible actions are not aligned with what is shown. The alert names the roles involved as IT, programming, database and software positions, some with access to customer personal data, financial data and corporate IT databases, and records that stolen personal data was in several cases discovered by the pre-employment background check itself.

Read that last part again. The background check worked. It found the stolen identity. It just ran too late to matter.

Pro tip: ask one unscripted follow-up in every video interview, phrased so the answer cannot be prepared ("what was the hardest part of that project, and who disagreed with you about it?"). A stand-in reading from notes falls apart on the second clause.

Which solutions reduce hiring fraud risk?

The solutions that reduce hiring fraud risk are identity verification with a face match, proctored skills assessment, structured multi-reviewer interviews, employment and reference verification, and access provisioning tied to a verified identity record. Each catches something different, and the gaps between them are where fraud lives.

No one of these stands alone. Gartner predicted in February 2024 that by 2026, 30% of enterprises would consider identity verification and authentication solutions unreliable in isolation because of deepfakes. In isolation is the operative phrase. Layering is the design, not belt and braces.

Hiring fraud detection methods that actually work

Hiring fraud detection methods fall into three groups: verification at the point of entry, behavioral signals captured during assessment and interview, and post-hire anomaly detection in access logs. The first is cheapest, the second catches the most, and the third finds the cases the other two missed.

The context is sobering. The Association of Certified Fraud Examiners, studying 1,921 cases across 138 countries in its 2024 report, found 3.1 billion dollars of losses, estimated that organizations lose about 5% of revenue to fraud each year, and measured a typical case running roughly 12 months before detection. Tips accounted for 43% of detections, more than half of those from employees.

Twelve months, and a colleague's hunch beats the control environment. For hiring that argues for two things: make entry checks hard enough that fraud does not get in, and make it easy to report a colleague acting oddly without filing a case.

On how strong an entry check needs to be, there is a published standard worth pointing at instead of a vendor's word. NIST Special Publication 800-63-3 defines three identity assurance levels: at IAL1 attributes are self-asserted, at IAL2 remote or in-person identity proofing is required, and at IAL3 in-person proofing by an authorized representative examining physical documents is required. Map that onto hiring and a resume plus a public profile is IAL1. A document check with a live face match is the practical IAL2 equivalent. Anything touching money movement or production infrastructure deserves an IAL3 conversation before the start date, not after.

Identifying security risks in hiring

Identifying security risks in hiring means asking what a successful fraudulent hire could reach, then tightening verification in proportion. A warehouse role and a cloud-infrastructure role carry the same hiring process in most companies and wildly different blast radius.

• Classify the requisition by access, not seniority. A junior contractor with production database credentials outranks a director with none.
• Name an owner for the access decision who is not the hiring manager. The person under pressure to fill the role should not also approve the login.
• Keep one verified identity record that HR, IT and security all read. If the identity confirmed in the interview is not the identity provisioned in the directory, the control does nothing.
• Review first-90-day access patterns on high-risk roles. Credentials used from an unexpected country, at odd hours, for data the role does not need, are the signal that entry checks missed something.

Testlify covers the identity half of that chain and the audit half for teams that need it: SAML single sign-on with identity-provider group-to-role mapping, SCIM provisioning, and on the Enterprise plan and above, audit-log export plus real-time streaming of audit events to a security information and event management provider. Compliance posture covers SOC 2 Type II, ISO 27001, GDPR, CCPA, FERPA and New York City Local Law 144.

Remote hiring fraud risks: what really changes?

Remote hiring fraud risks are higher because the informal verification physical presence provides is gone. Nobody checks a badge, nobody notices that the person at the desk is not the person from the interview, and the candidate controls the camera, the room and the network throughout.

Three things change. The identity check becomes the only identity check, so it has to be real rather than a scanned document emailed over. The interview becomes a recorded artifact, which helps only if somebody re-reviews it. And onboarding goes remote too, so the laptop and credentials travel to an address nobody has visited.

There is a fair counterargument: heavy verification reads as suspicion, and good candidates walk. The answer is to scale the check to the role's access rather than apply maximum friction to everyone, and to tell candidates plainly what you check and why. Candidates object far less to a uniform, documented check than to one that appears to single them out. Our notes on verifying candidate identity in remote hiring cover the mechanics.

What can you legally check, and what can you not?

What you can check is limited by consumer-reporting and anti-discrimination law, not by what verification technology makes possible. In the United States, using a third party to compile a background report makes it a consumer report, which triggers written candidate consent, specific pre-adverse and adverse-action notices, and record-disposal duties.

The US Federal Trade Commission sets out employer duties attached to using consumer reports under the Fair Credit Reporting Act. The Equal Employment Opportunity Commission covers the other half: background checks must be applied consistently and must not screen out protected groups without a job-related justification. Running a deeper check on one candidate because something felt off is exactly the pattern both bodies exist to catch.

Outside the US the same logic arrives through data-protection law. Under GDPR, biometric face-match data is a special category, so it needs an explicit lawful basis, a stated retention period and a real route for the candidate to withdraw consent. Verification data nobody ever deletes is a breach waiting for a date. Testlify deletes face-verification data after 30 days, lets a candidate withdraw consent at any time, and removes video and audio responses after 6 months; the GDPR compliance page has the detail.

The Testlify Assessment Integrity Framework

The Testlify Assessment Integrity Framework protects assessment validity through identity checks, proctoring controls, AI-assistance detection, suspicious-behavior signals and reviewable evidence, while final judgment stays human-led. Six layers: identity assurance, environment control, behavior monitoring, AI-assistance detection, reviewable evidence, and configurable strictness matched to the role's risk.

In the product that means photo ID verification with a face match against the document, face detection with single-presence and different-person checks, periodic webcam snapshots, tab-switch and multi-monitor detection, copy-paste tracking, AI-tool and browser-extension detection, and three presets (Standard, Strict, Custom) so a warehouse assessment is not run at treasury intensity. Dual-device proctoring turns the candidate's phone into a second camera capturing both the candidate and the laptop screen, and it is a hard gate: the assessment will not start until mobile monitoring is active.

On the interview side, conversational AI interviews run one-way or two-way with automatic multilingual transcripts and auto-scoring a human reviewer can override. Video violation detection flags inconsistencies in the feed, such as the webcam being off, no face detected, or multiple faces appearing, and the report presents that as a possible identity issue rather than a verdict.

That distinction is worth defending. Reviewers see a three-tier flag: green for a clean session, yellow meaning some behavior was not ideal and a quick manual review is recommended, red for confirmed cheating. Automatic termination is a separate, opt-in setting with a threshold the recruiter chooses. A flag is evidence for a person to weigh, not proof of intent, and a candidate should never be rejected on a flag alone. Teams that forget that generate false accusations, which cost more trust than the fraud did.

Your first week: a staged control checklist

If you own hiring at a company between 20 and 200 people with no dedicated fraud function, this sequence buys the most protection for the least disruption. Run it on your next three requisitions before rolling it out.

One caveat on all of it: these controls reduce risk, they do not remove it. A capable fraudster with a genuine stolen identity who can actually do the job will pass most of this, which is why the day-1-to-90 review stays on the list. The goal is to make your process the expensive one to attack, and to shorten the 12 months it otherwise takes to notice.

Hire with verified evidence, not assumed trust

Testlify runs the identity and integrity half of this: ID verification with face match, 20-plus proctoring measures with configurable strictness, AI and conversational video interviews with human-override scoring, and 100-plus ATS integrations so the evidence lands in the system your team already works in rather than a separate tool nobody opens. Book a demo and bring your riskiest open role, and we will walk the controls against that access level. You can also see how online proctoring behaves at each preset before committing to one.

Frequently asked questions