Identity Verification

Why identity verification has become a hiring problem

When interviews and onboarding were in person, identity was checked almost by accident. Remote hiring removed that. Recruiters now see proxy candidates (one person interviews, another starts), lip-synced or deepfake video interviews, stolen identities used to pass background checks, and organized schemes. US federal agencies have publicly warned about fraudulent remote IT workers using stolen or borrowed identities to get hired by US companies.

The cost goes beyond a bad hire. A fake employee may get access to customer data, systems and payroll. That is why identity checks are now treated as part of preventing candidate fraud, not only as onboarding paperwork.

How it works

Most modern checks combine three layers:

1. Document verification. The candidate photographs or scans a passport, driver's license or state ID. Software checks security features, fonts, barcodes and machine-readable zones for signs of tampering.
2. Biometric match and liveness. A live selfie or short video is compared with the ID photo. Liveness checks (turn your head, follow the dot) catch printed photos, screens and many deepfakes.
3. Data checks. Name, date of birth and address are compared with credit header data, phone records or an SSN trace, usually through a background screening provider.

The result is a pass, a fail or a referral for human review. For high-volume programs, automated identity verification handles most candidates in a few minutes, with recruiters reviewing only the exceptions.

Where to verify in the funnel

Checking once at onboarding is not enough if a different person did the interview. A layered approach works better:

• Before or at the first interview: a light ID and selfie check, then face match in the video interview.
• During assessments: face consistency checks within proctored tests.
• At offer: full document and data check, often as part of the background check.
• Day one: confirm the person logging in or walking in is the one who interviewed, then complete Form I-9.

Some teams use AI-assisted screening and verification to keep the same identity thread from application through first day.

Identity verification vs Form I-9

They overlap but are not the same. Form I-9 confirms identity and work authorization for the employment relationship, and the rules are strict: the employee chooses which acceptable documents to present from the Lists of Acceptable Documents, and employers cannot demand specific documents or more documents than required. Asking for "a passport only" or extra documents because someone looks or sounds foreign can be unfair documentary practices under immigration law.

Pre-hire identity checks sit outside the I-9 and can ask for a photo ID, but keep them separate from I-9 document review and apply the same check to every candidate in the role.

Privacy and legal notes

Face matching uses biometric data. Illinois BIPA requires written informed consent and a published retention and destruction policy before collecting it, and Texas and Washington have their own biometric laws. Several states' privacy laws treat biometrics as sensitive data. Under GDPR, biometric data used to identify a person is special category data. If the check is run by a consumer reporting agency, FCRA rules may also apply. Keep data only as long as needed and tell candidates clearly what is collected. Rules vary by state and country.

Common mistakes

• Verifying only at onboarding, after the proxy has already passed the interview.
• Auto-rejecting on a failed match. Bad lighting, old ID photos and name changes cause false failures; route them to a person.
• Applying stricter checks to candidates based on accent, name or nationality.
• Keeping ID images indefinitely.
• Forgetting remote onboarding touchpoints such as equipment shipping addresses, which are a common fraud signal when they do not match the candidate's stated location.