Our clients are increasingly experiencing HR identity fraud—when an imposter (sometimes from a foreign adversary nation like North Korea) poses as a candidate for a remote job, often in the information technology space, in order to obtain access to company information or divert funds for a nefarious purpose.
The website Hypr recently issued its “first annual report analyzing hiring and employee fraud in 2026.” The 2026 State of HR Identity Fraud Report outlines the increase of hiring fraud and identifies that a shocking 98% of the 500 U.S. HR executives surveyed “have experienced candidate fraud firsthand.” The report examines how HR identity fraud is detected, how long it takes to identify it, and how to mitigate the risk through established processes.
While 90% of HR leaders have heightened concern over hiring fraud in the last two years, surprisingly, 68% of hiring fraud is discovered by a basic gut instinct—that is, when someone in the process felt something was “off,” as opposed to having established security controls in place.
The survey showed that 42% of cases are not caught pre-hire, and that “less than 3% are flagged the same day.” In addition, only a third are detected between one and three days, “45% require four to six days, and 20% go undetected for up to three weeks, averaging 5.73 days of unmonitored access.” This means that “by the time a red flag is raised, the fraudulent hire has already been provisioned with corporate credentials and internal network access.”
Part of the issue in failing to detect fraud is that there is no single point of supervision, as companies have outsourced a significant amount of work to vendors. “It’s a set of disconnected checks operating in silos. Because no single stage reliably stops candidate fraud, clearing an earlier stage offers no guarantee of identity assurance.” The internal team has specific obligations in the hiring process, and other functions are outsourced. This fragmentation allows threat actors to “infiltrate the onboarding process while accountability is transitioning between teams.”
The survey found that “42% of hiring fraud is detected only after employment begins. Among those post-hire cases, discovery takes an average of four to six days—by which point 98% of fraudulent hires have already been issued company credentials.” This means that the imposter had access to company data for a significant amount of time, which could include proprietary data, sensitive personal information, customer information or employee information. This unauthorized access requires an internal investigation and could lead to required notifications to individuals or customers.
The survey says that “24% of organizations spend one to three months resolving a single fake hire; while the rest lose one to three weeks. Almost no one clears an incident in under a week.”
The conclusion is “Most organizations already possess the core capabilities to solve this challenge. What remains missing is a unified, continuous owner for identity across the moments where HR, IT and Security currently hand it off to one another.” Reorganizing the hiring process to establish a single point of truth and responsibility for HR identity so threat actors can’t insert themselves into the hand-off process is worth serious consideration.