Identity verification is the process of confirming that a person is who they claim to be. Employers perform it constantly and mostly without noticing: at hire, when a caller asks for a payroll change, when the help desk unlocks an account, when a former employee requests records. Fraud concentrates wherever one of those moments is handled casually.
The unifying principle across all of them is the same: verify against something the requester did not supply.
At hire. Employment eligibility verification confirms identity and work authorization from documents the employee presents. Remote hiring has strained this — document inspection over video is weaker than in person, and cases of someone other than the interviewed candidate showing up to do the job are no longer exotic. Consistent process rigor is both the defense and the legal requirement: the same steps for every hire, since selective extra scrutiny is unlawful document abuse.
At every change request. A request to update banking details, contact information, or tax withholding is an identity claim. The verification standard is out-of-band confirmation — a call to the number already in the system, never to one provided in the request — because the request channel is exactly what an impostor controls.
At the help desk. Account unlocks and password resets are identity decisions, and attackers know the help desk is often the softest verifier in the building. Resets granted on name and date of birth — both publicly discoverable — convert the support function into the intrusion route. Callbacks to numbers on file, or verification through a manager, close it.
After employment. Former employees legitimately request pay records and tax documents, and impostors request them too, since a W-2 is an identity theft kit. Verification here is harder — the person is no longer in the building — which argues for delivering documents to addresses already on file rather than to addresses supplied in the request.
The failures share a shape: confirming information the requester chose. Replying to the requesting email. Calling the number in the signature block. Matching a date of birth the caller recited. Accepting knowledge of internal details — project names, colleague names — as proof, when a compromised mailbox supplies all of it.
Knowledge-based verification generally has decayed badly: the answers to standard security questions — addresses, birthdays, mother's maiden name — are in breach corpora and public records. Possession-based verification — reaching the person through a channel already on record — is what still works.
A quiet dependency: every later verification leans on the contact details captured at onboarding. If the phone number in the HRIS is wrong, stale, or was entered by the impostor during a fraudulent hire, the callback control dials the attacker.
Two disciplines protect the foundation: capture personal contact details during onboarding through the employee directly — not through forms an intermediary could alter — and treat subsequent changes to those details as verification-worthy events themselves, confirmed to the previous address, since updating contacts first is the standard prelude to updating banking second.
Verification tooling — ID document scanning, selfie matching, biometric login — is increasingly available in HR platforms. Two cautions accompany it. Biometric data is regulated in a growing set of jurisdictions with notice, consent, and retention requirements, and violations carry statutory damages in some states; deployment needs its own compliance review. And automated document checks are a layer, not an oracle — synthetic identities and quality forgeries pass them at meaningful rates, so the process around the tool still matters.
Not every interaction warrants the same rigor. A sensible tiering:
The no-exceptions clause is what makes the high tier hold, because the pressure to skip verification is itself the signature of the fraud it prevents.
Employer's Guardian helps employers build verification into onboarding and the change processes that depend on it through onboarding documentation compliance.
This article provides general educational information, not legal advice. Verification and biometric requirements vary by jurisdiction. Consult qualified counsel before changing hiring or verification processes.