Language

10 Sep 2024in Business use cases

Identity Verification for New Employees: Who Needs It & Why?

Jan Stepnov

Identity Verification Expert, Regula

Imagine a company expanding its remote workforce, only to find that a new hire used a stolen identity to access sensitive systems. It may sound like a plot from a movie, but it’s a real risk. A Reddit post shared this experience:

quote

The company I work for hires a number of remote employees. We have now had 2 occasions where someone has applied for a job, provided a valid driver's license, but after the fact we've found that the driver's ID was actually a stolen identity. The first one we only discovered after we sent a W-4 to the address listed, and the guy responded that he had never worked for us, and even though the name/address was the same, it wasn't him.

The second occurrence, we caught early, as we were about to ship a work laptop to a new employee, and they asked us to ship it to a different address than what was on their ID. We did some snooping, and found a person with the exact same name, but has a different address. However, one of their previous addresses the "real" person lived at is what the fraudster has on his driver's license. The actual person doesn't look anything like the fraudster. We did a normal background check, and it passed. They also have the SS# of the real person.

Dr-Xan

These aren’t isolated incidents. Identity fraud is rising, especially with remote work and digital nomadism becoming the norm. Whether it's ensuring that a worker is eligible to work or preventing underage hiring, identity verification is becoming the norm too.

In this post, we discuss the types of companies where it’s recommended to verify employee identity, as well as how to implement it in practice.

Why do companies need identity verification for new employees?

When hiring, companies routinely ask new employees to provide ID documents and fill out forms with their personal information. However, these documents, and even entire sets of personal data can sometimes be fake or stolen. In any case, this poses serious risks to businesses.

Verify remote workers

Without in-person interactions, it's easier for bad actors to use fake or stolen identities to gain access to company systems or confidential information. In sectors that handle sensitive data, such as Finance or Healthcare, this process is particularly vital to avoid costly breaches. 

Aside from that, there’s a common practice to ship devices needed for work to remote hires. Companies could ship valuable hardware like laptops to fraudulent employees, with no way to recover the assets. Effective remote identity verification plays a big role in this scenario.

Make sure an employee is eligible to work

In many countries, employers are required by law to verify that an employee is legally eligible to work. In the U.S., the I-9 process matches an individual’s identity documents with their Social Security Number (SSN) to confirm work authorization. Tools like E-Verify help companies streamline this process. Similarly, in the UK, employers must report employees for tax purposes using National Insurance numbers. Any discrepancy in these numbers could signal an issue.

However, illegal immigrants may use someone else’s SSN to gain employment. In some cases, individuals share a name and SSN with others, complicating the employment process and making it harder to identify fraud.

Sometimes, companies establish additional internal security measures to follow. Here’s an example from Regula’s experience: Uber in Poland checks the identity of drivers, not only during the onboarding process but also every time they get behind the wheel of a taxi.

Prevent illegal hiring of underaged people

In a real case involving Hyundai suppliers in Alabama, a 16-year-old used fake documents to work illegally from the age of 14. The hiring agencies involved faced penalties for a child labor violation and failing to verify the boy’s age. Hyundai, for its part, announced it would divest its majority stake in the parts maker where the employment of child workers was reported, highlighting the impact of weak IDV processes for businesses.

Prevent confidential data leaks

Unauthorized employees with fake identities could gain access to sensitive company information, posing a major risk to the organization. By verifying each new hire's identity, companies can ensure that only trusted individuals have access to confidential systems and data.

What tools are used to verify employee identity?

Here, we won’t mention any particular government service for cross-checking tax numbers and similar data, since they differ from country to country. Below is a typical set of technical tools and practices employed by industry leaders who need to ensure their employees are the people they claim to be.

Automated ID document verification

Automated systems significantly accelerate data entry and reduce the risk of human error, particularly when HR personnel may not be familiar with foreign document types. This is especially important for global hires, such as digital nomads, where identity documents vary greatly from country to country. Automated systems extract and verify data to ensure all the details are correct and match with each other, as well as external databases when applicable.

Automated ID document authentication

These systems conduct a range of authenticity checks, from basic validations—such as spotting "sample" watermarks on a fake document—to more advanced techniques like verifying holograms, UV elements, and other security features. 

For remote hiring scenarios, it’s essential to have a document liveness detection feature that can verify if a document is real and exists in the physical world, and isn’t just a manipulated digital copy.

Biometric verification

Biometric verification ties an identity document to its holder by analyzing unique physical characteristics, for example, by using facial recognition. This is an increasingly popular method of remote identity verification that ensures the person presenting the document is the rightful owner. Liveness detection again plays a crucial role in remote-first scenarios, preventing fraud by detecting masks, pre-recorded videos, and deepfakes. 

Biometrics are used not only during remote onboarding but also for ongoing authentication, and are often integrated into a multi-factor authentication (MFA) flow to enhance security during daily operations.

How to implement remote identity verification for verifying new employees

When starting the process of implementing remote identity verification for new hires, it’s important to address several key factors. These considerations will guide your choice of solution and ensure smooth implementation.

→ Assess the volume of verifications. First, determine the number of identity verifications your company will need to perform on a monthly or yearly basis. Are you only verifying employees during onboarding, or do you require ongoing checks, such as for managing access to sensitive data or restricted areas in your office? Understanding your verification needs will help define the scale of the solution you choose.

→ Regulatory requirements. Identify any regulatory requirements your business must comply with. For example, industries like Finance and Healthcare often have strict identity verification mandates, such as adhering to Know Your Customer (KYC) regulations. In some cases, you may also need to retain personal data for specific periods, adding another layer of complexity to the solution. Compliance is non-negotiable, so the solution you choose must meet these legal obligations.

→ Available resources. What internal resources do you have? For example, does your company have an in-house IT team that can help with the implementation and ongoing maintenance of the system? If not, you may prefer a solution that requires minimal technical setup, such as a fully managed, cloud-based option. Companies with stronger technical capabilities may opt for a more customizable on-premises solution or an SDK (Software Development Kit) that integrates seamlessly with existing systems.

Once these initial questions are answered, you’ll have a clearer idea of what kind of IDV solution is best suited to your company:

  • Cloud vs. On-Premises
    Cloud-based solutions are typically easier and faster to deploy, requiring minimal infrastructure. They offer scalability, making them ideal for companies with varying verification needs. On-premises solutions, on the other hand, offer more control and are preferred in industries that require heightened security or compliance with specific data residency laws.

  • SaaS platforms vs. SDKs
    An out-of-the-box solution provides everything you need with minimal configuration, making it suitable for businesses seeking quick deployment and ease of use. SDKs offer more flexibility and customization, allowing you to integrate IDV into your existing platforms or workflows. However, SDKs require more technical knowledge and development resources.

The cost and the implementation of an IDV solution will vary depending on the type of system you choose, the volume of verifications, and whether additional features (e.g., biometrics and liveness detection) are required.

Bottom line

Unlike KYC, which is driven by regulatory requirements, the initiative to verify new hires often stems from internal security needs and risk management. If you’re reading this, chances are your company has already experienced issues with unverified employees and realizes the importance of remote identity proofing.

Regula’s identity verification solutions are designed to meet a wide variety of identity-related needs across industries. Whether you operate in highly regulated sectors like Banking and Airlines, or you simply want to streamline your processes, Regula offers solutions tailored to your specific requirements. If you prefer, Regula’s team and solutions can help you verify your hires too. Get in touch with Regula to discuss your challenges.

Implement ID Verification for Employee Onboarding

Learn more

On our website, we use cookies to collect technical information. In particular, we process the IP address of your location to personalize the content of the site

Cookie Policy rules