Do You Know Who Your Employees Really Are?

You’re probably familiar with “Know Your Customer,” in which you ensure that you know who your customers really are.

What about “know your employee”?

When you are hiring new employees, whether they will work remotely or in an office, you need to know who they are.

But you may not know who is really behind that profile, that resume, or even that job interview.

Fraudulent identities and employment

Let’s say that someone applies for a job with your company and provides the web address for their LinkedIn profile. This is not a verified identity. It’s easy to create fake LinkedIn profiles, and many fraudsters are doing just that. In October 2022, Krebs on Security reported on a glut of bot profiles that was plaguing LinkedIn. These profiles, which purport to represent executives at established companies, can mislead people. Did you use LinkedIn to find Chief Information Security Officers (CISOs) at companies? Did you use a search engine? Did you refer to a magazine listing of Fortune 500 CISOs? You may have been fooled; all of these sources accepted fake LinkedIn profiles as legitimate.

Or maybe someone shows up for a job interview. This is not a verified identity either. Perhaps one of the candidates for an open position at your company performs very impressively in the interview process and is offered a position. On the first day on the job, someone else shows up who is not as impressive. When this happened at one unnamed company, both Human Resources and Legal became involved before the new employee abruptly quit, returned his equipment, and disappeared.

But at least in that episode SOMEONE showed up for the interview. What if there is no “someone”? What if you are interviewing a deepfake for your open position? As the FBI warns, deepfakes can “include a video, an image, or recording convincingly altered and manipulated to misrepresent someone as doing or saying something that was not actually done or said.”

So who is behind the deepfakes? In a joint advisory, the FBI, Justice Department, and State Department warned that North Koreans were attempting to apply for information technology (IT) jobs without disclosing their true nationality.

Regardless of the intent of the fraudulent job applicants, anyone who successfully lands a position fraudulently is going to obtain access to your company’s data—technical information, financial information, and personal identifiable information (PII) of legitimate employees.

And you don’t know who is accessing your company’s data.

Three ways to verify job applicant and employee identities

The solution is to verify your job applicants and your employees so that you know they are who they say they are.

Employers do some of this already, but to positively verify an identity, you need to do more than check references or complete an I-9 form. Here are three recommendations:

Check the person’s identification documents

Perhaps someone in Human Resources can ask the job applicant for their driver’s license and make a photocopy of it, but Human Resources employees usually are not trained in identity document fraud.

However, artificial intelligence (AI) and machine learning (ML) solutions can analyze identity documents to ensure that they are legitimate and not fraudulent. Does the identity document contain the security features from the government issuing authority? Is the information on the identity document consistent? Has someone altered or tampered with the identity document? AI and ML can detect this.

Check the person’s biometrics

Again, the person in Human Resources can glance at the presented driver’s license and see if it matches the face of the person presenting the driver’s license. But again, Human Resources employees are usually not trained in facial comparison.

AI and ML can be applied to facial recognition also. Algorithms can either perform one-to-one comparisons, in which a single face (for example, from a driver’s license) is compared against a single face (for example, from a live person), or one-to-many comparisons of a single face against a gallery of faces. And if the person presenting a live face is remote, liveness detection algorithms can discern whether the presented face is a live face or some type of fake. Algorithm vendors can submit their algorithms to testing authorities, including the U.S. National Institute of Standards and Technology (NIST) for facial recognition and iBeta for liveness detection.

Check the person against Systems of Record

While ID document checks and biometric checks are helpful, they are not the only means to positively verify an identity. Additional checks against government and enterprise systems of record can verify information presented by the job applicant. Systems of record can answer these types of questions:

• Is the driver’s license presented by the applicant valid? If it was valid previously, is it still valid today?
• If the applicant presented an identification number such as a Social Security Number, does that identification number belong to the applicant, or to someone else?
• If the applicant claims to have lived at a particular address for over five years, do records support this claim? Does the address actually exist?

Only by completing these System of Record checks, accompanied by the biometric and ID document checks, do you truly know who your job applicants are.

The Incode Omni solution for employee verification

The Incode Omni Platform can positively verify and authenticate job applicants and employees, ensuring that they are who they say they are.

Incode Omni is fast and easy to use. All of the application tasks can be performed on an applicant’s or employee’s smartphone. Steps such as ID document capture and face capture are automated, making it as easy as possible for the applicant. For example, Incode Omni uses passive liveness detection that requires no action on the applicant’s part, rather than the more complex active liveness detection. Ease of use is critical if you don’t want your job applicants to abandon the process as too cumbersome.

Incode Omni is accurate. Our facial recognition algorithm is tested by NIST, and our liveness detection algorithm is tested by iBeta. More importantly, our solution is tested by our customers. Incode Omni onboarding is up to five times faster than competitors, and one of our clients realized a 99% reduction in fraud by using Incode Omni.

Once an applicant is verified and you know that the person is who they say they are, any future interactions with the applicant (or the eventual employee) can be authenticated quickly by a single glance of the face. This ensures that the person who interviewed for the job is the same one that shows up to work on the first day.

The employer isn’t the only one who benefits from Incode Omni. There are two benefits for job applicants:

• Incode Omni was designed for privacy from the outset. This protects the PII of applicants. For example, Incode Omni does not use manual reviewers to check applicant submissions. All applications are processed automatically with AI and ML, away from prying eyes. What if a job applicant’s identity is verified by a manual reviewer—and the manual reviewer fraudulently steals the applicant’s identity?
• Incode Omni offers “one identity, everywhere” to its users. Most job applicants aren’t hired after the first job application and may apply for jobs with dozens or hundreds of different employers. How painful is it for applicants to verify identities with every employer? However, for every employer who uses Incode Omni, the applicant only must undergo the identity verification once. Once the applicant’s identity is verified with one employer, verification with all employers who use Incode Omni is automatic. (Employers also benefit from the rapid verification of identities of already-enrolled applicants.)

Do you want to know who your job applicants and employees are? Download our literature sheet for a summary of Incode’s employee verification solution.