98% of fraudulent hires have company credentials by the time they’re caught
A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report.
“Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT,” said Bojan Simic, CEO of HYPR. “Human intuition is not a security control. Sceptics might point to low reported numbers, but the lack of purpose-built verification technology means the industry is simply blind to the problem; there are vastly more fraudulent workers embedded in organizations than current data reflects.”
Fraud detection remains fragmented
98% of HR leaders have experienced candidate fraud firsthand, while 96% believe their organization would detect it. When fraud evades pre-hire detection, fraudulent hires can receive corporate credentials and internal network access before they are identified.
Where organizations identified candidate fraud (Source: HYPR)
Screening and interviews are the most common detection points, along with onboarding, active employment, and technical assessments. Companies identified an average of 2.2 checkpoints across fraud incidents, showing that fraud is detected through disconnected checks at different stages without a consistent primary barrier.
Identity verification tools are often limited to specific events, such as account creation, sensitive transactions, and account recovery. Outside these checks, fraudulent hires may go undetected, leaving companies dependent on employees and other manual processes to identify suspicious behavior.
Recruitment platforms and applicant tracking systems have started embedding identity verification and anti-fraud features into their workflows, targeting the application and screening stages where synthetic agents and AI-generated candidates are prevalent.
Across identity-based and AI-driven attacks, third-party security tools detect only 53% of threats. The remaining cases depend on manual discovery through employee reports, internal audits, and external alerts. Even where automated controls are mandated, nearly half of threats depend on manual discovery.
Confidence gaps
Leaders responsible for identity and hiring technology were less confident in their organizations’ ability to detect fraud. IT and telecommunications, the most technically equipped sector in the study, relied on manual observation more heavily than any other group surveyed.
Education showed the largest gap between concern about hiring fraud and confidence in existing defenses. Manufacturing and utilities reported high levels of both concern and confidence, which HYPR linked to in-person hiring and face-to-face identity checks. Sales, media, and marketing was the only sector where confidence exceeded concern and relied heavily on employees to identify and report suspected fraud.
Identity risk handoffs
Ownership of pre-hire identity risk is often better defined on paper than in practice. HR typically takes responsibility during recruitment, while IT and security tend to step in once a new hire receives access.
The period between these points has no defined owner.
Attackers can exploit this transition by entering an organization while responsibility is shifting between teams. The exposure can continue after hiring, especially when fraud is discovered only after credentials have been issued.
Cost of hiring fraud
Most companies require at least one to three weeks to resolve a hiring fraud incident, creating financial and operational costs through delayed hiring, backfilling, lost productivity, security exposure, compliance risks, and team disruption.
By the time post-hire identity fraud is detected, 98% of fraudulent hires have already received company credentials.
Companies have taken several measures in response to hiring fraud, including implementing identity verification technologies, taking an average of 2.52 actions in response to an incident.
Identity security investment also tends to be reactive. Organizations often increase spending after a breach rather than before an incident occurs. Around 60% of identity verification and MFA spending is triggered by a security breach.
