.png)
How to Protect Your Business from Fake Job Applicants
Article Summary: Fraudulent job applicants use false or stolen identities to get hired, receive company equipment, and gain access to business systems. Identity and employment checks help confirm who you’re hiring, while controlled equipment delivery and job-specific permissions limit what a new worker receives. Recruiters, hiring managers, and IT need to share concerns throughout the process.
When you need a developer to finish a website project, it’s a relief to find someone with the right experience. The interview goes well, they can start soon, and you want them working.
Your team sets up their accounts and arranges any company equipment they’ll need. With a remote hire, you could be doing that for someone you’ve only met online.
Fraudulent applicants have used that process to get hired under stolen or fabricated identities. Microsoft has investigated cases where they gained access to employers’ internal systems.
Recruitment fraud
Some fraudulent applicants are skilled IT workers who complete real assignments. They use false identities or conceal who is doing the work, while the employer pays for their services and provides access to company systems.
One well-documented example involves North Korean IT workers obtaining remote jobs under false identities. The UK government’s advisory describes workers seeking employment with businesses in the UK, US, and elsewhere, including through freelance contracts.
In some cases, workers have used their access to steal confidential information. Microsoft has documented theft of software code and demands for payment to prevent its release.
Identity and reference checks
Suppose a candidate says they worked for a company you recognize. They give you the name and email address of a former manager, and a reference arrives soon afterward.
IMAGE SOURCE: https://www.pexels.com/photo/person-in-white-long-sleeve-shirt-holding-a-clipboard-with-resume-5989933/
Before accepting that reference, your hiring team can contact the employer through its official channels, using details they find independently of the candidate. They can then confirm the referee’s connection to the company and check the employment details. If you need to contact their current employer, agree on the timing with the candidate first.
Some fraudulent applicants use professional-networking accounts belonging to real people, complete with years of genuine activity. The FBI has documented this use of other people’s accounts. Confirm the employment details with the employer or another appropriate original source.
Stolen identity details can trace back to a real person's records. The screening provider needs to explain how it verifies the documents belong to the applicant you’re speaking to, and how it checks for alterations.
If the report only says “passed,” ask: “How did you confirm that the person we’re speaking to owns the identity you checked?”
Your HR advisor or screening provider can help choose checks that fit the role and local requirements. Candidate documents contain personal information, so collect and store them through your approved process rather than passing copies around interviewers’ inboxes.
Interviews and work samples
In 2024, cybersecurity company KnowBe4 disclosed that it had hired a worker using a stolen identity after several video interviews and background checks. In its follow-up account, the company said it detected suspicious activity on the issued laptop and that the worker never accessed customer data or confidential company information.
The person on camera can also be a paid substitute. The FBI has documented people being hired to attend interviews on someone else’s behalf. You could be assessing someone who won’t be doing the job.
For the skills assessment, have the candidate explain a decision they made on a past project, what went wrong, or how they would approach a similar problem in your business. A website developer, for example, could talk you through how they would investigate a broken booking form. Someone with the relevant technical knowledge should assess the answers.
Give the candidate a short work sample using sample data in a test environment. That lets you judge their ability without giving them access to live company systems, customer records, or administrator accounts.
If an interviewer has an unresolved concern about who the candidate is, they should pass it to the person handling identity checks before the worker gets access. A name, accent, or nationality should never substitute for those checks.
Recruiters and equipment delivery
When an agency tells you a contractor has been vetted, you need to know what that included. Did they check identity, or did the agency review a resume and speak to references? Your agreement should identify who performs each check and how it approves replacements or subcontractors.
If the agency later sends a replacement, that person needs the agreed checks and their own account before joining the project. Reusing the original contractor’s login leaves activity recorded under the wrong name. IT should also review the original account and remove access that is no longer needed.
In some fraud schemes, the company laptop is delivered to a third party who keeps it online for a worker elsewhere to control remotely. Microsoft describes these arrangements as laptop farms.
Before shipping the laptop, the hiring manager should confirm the delivery address through your hiring process. They should also give IT the approved worker’s details and confirm the required checks are complete before enabling access. IT can then compare that record with the person and device being set up, and send any unexplained changes back to the manager.
A manager might agree to a changed address in a private message while finance receives new payment details. If each person handles their part without telling the others, nobody reviews the changes together. The hiring record should capture those requests and who approved them.
New-hire account access
Once the identity checks are complete, IT can set up access for the work you hired the person to do.
For the website project, that means approving the contractor’s website access without also adding them to folders containing payroll or unrelated company records. The NCSC’s identity and access guidance explains matching access to the individual’s role and checking identities before granting it.
When a new worker sets up multifactor authentication, they can use it to sign in even if they gave you a false identity. MFA helps protect the account from unauthorized sign-ins; the hiring checks still need to establish who should receive it.
IT should set up and manage company devices, and keep a record of the remote-support tools the business uses. That record helps them investigate unfamiliar remote-access software installed after the worker starts.
An unfamiliar tool installed by the new worker needs to be checked against their job and the approved setup. IT should investigate those differences before drawing conclusions about fraud.
When an alert flags a large download, your IT provider can investigate the account activity while the project manager checks whether those files were needed for the assignment. Microsoft describes reviewing new-hire sign-ins and data access. Decide who will review these alerts and who can approve or restrict access.
Suspected hiring fraud
If a check raises an unresolved identity concern before the person starts, pause equipment delivery and system access while it’s reviewed. Keep the application and screening records available to the people handling the review.
For somebody already working in the business, involve your IT provider and the person responsible for HR promptly.
Microsoft recommends preserving evidence and coordinating an investigation through a trusted group. IT can assess whether access needs to be restricted or a device isolated, while checking what the account has accessed and whether any other access was created.
Don’t wipe the laptop or delete the account as a first response. Those actions can remove evidence needed to understand what happened. Keep the investigation separate from informal conversations or accusations.
Bring your legal advisors into the response when fraud or data theft is suspected, so they can assess any reporting obligations and the appropriate contact with authorities in your country.
And if you don’t have an IT provider, you can always reach out to us, and we’ll help you out.
—
Comments