The previous piece argued that verification stops at exactly the point fraud starts, and that the gap is now foreseeable enough to be a standard-of-care issue.
This one is about closing it, and about the objection that every HR leader raises first: that post-hire verification sounds like monitoring, and nobody wants to work for an employer that watches them.
The objection is correct about the risk. It is wrong about the conclusion. There is a narrow, bounded set of post-hire checks that confirm identity and credential continuity without tracking anything about how an employee works. The task is to design that set, draw the line around it clearly, and get the consent right in each jurisdiction.
The principle: continuity, not behaviour
Pre-hire verification answers one question: is this person who they claim, with the history they claim?
Post-hire verification, done properly, answers a narrower one: is the person doing the job still the person who was verified, and are the credentials the role depends on still valid?
That is it. It does not ask how many hours they worked, whether they were productive, what they said in chat, or where they logged in from on Tuesday. Those are management questions, and some of them are surveillance questions, and none of them belong in a verification programme.
Holding that line is what makes the programme defensible to employees, to works councils and unions where they exist, and to data protection regulators. It is also what makes it cheap, because identity continuity is a small number of checks at a small number of moments, not a continuous feed.
The four moments
A post-hire identity continuity programme runs at four points. Each is triggered by an event, not by a schedule.
The first is day one: the identity handshake. Before access is granted, the new employee completes a live identity confirmation that is matched against the pre-hire verification record. In practice this is a short video session with a liveness check and a document match, or an in-person check for on-site roles, run by the verification partner rather than the line manager. It takes minutes. It closes the laptop-farm gap, because the person receiving the credentials has to be the person who was verified, on camera, at the moment of receiving them.
The second is day thirty: the continuity check. A second live confirmation, shorter, matched against the day-one record. This closes the proxy-handover gap, because the most common pattern in the cases that have surfaced is a genuine candidate who attends the first fortnight and then hands over. Day thirty is late enough that the handover has usually happened and early enough that the damage is limited.
The third is the access event: re-verification on change. Promotion, transfer, a new system privilege, a move into a role with financial authority or customer data. Any HR event that moves the employee into a higher risk tier triggers the checks that tier requires, as if they were being hired into it. This closes the access-escalation gap and is the single most under-used control in most organisations, because the HR system and the verification programme are not connected.
The fourth is the credential cycle: periodic confirmation for roles that depend on a licence, a registration, a right-to-work status with an expiry, or a qualification that can be withdrawn. The cadence is set by the credential, not by a general policy: annually for most professional registrations, on the expiry date for immigration status, on the awarding body’s cycle for others. This closes the lapse gap.
Four moments. Two of them happen once. One happens only on an HR event. One happens on a cycle defined by the credential. None of them involves watching the employee work.
What is deliberately left out
A programme is defined as much by what it excludes as what it includes, and the exclusions here should be written into the policy.
No continuous criminal monitoring by default. Some regulated sectors require it, usually through the licensing authority rather than the employer, and for those roles it belongs in the credential cycle. For everyone else, ongoing criminal monitoring raises consent, accuracy and fairness problems that the identity continuity model does not need to take on. The Cifas data on first-year insider risk is real, but the answer to it is access control and event-triggered re-verification, not a standing feed of arrest records.
No activity, location or device monitoring. The Bengaluru case in Sachin’s note was caught by a colleague noticing commit times and camera habits. That is a manager’s job, and it would have been caught sooner by a day-thirty continuity check. It is not a reason to log everyone’s commit times.
No social media screening. The legal exposure here was covered in an earlier package and has not improved.
No open-ended “evergreen” consent that authorises anything the employer later decides to run. The consent should name the four moments and nothing else.
Consent, by jurisdiction
The post-hire checks described above process personal data after the employment relationship has begun, and the lawful basis differs by jurisdiction.
In the United States, the Fair Credit Reporting Act permits a pre-hire disclosure and authorisation to cover ongoing checks if it is written to do so, and most compliance guidance recommends a standalone authorisation that expressly covers post-hire verification rather than relying on the pre-hire form. State law adds requirements, and several states restrict what may be checked post-hire. The identity continuity checks, which do not involve a consumer report at all, sit outside most of this; the credential cycle may not.
In the United Kingdom, the lawful basis under UK GDPR for post-hire identity confirmation is usually legitimate interests, with a documented assessment, or contractual necessity for roles where continuity of identity is a condition of the work. Right-to-work follow-up checks for time-limited permissions are a statutory requirement. The principle of transparency means the four moments are described in the privacy notice the employee receives, and the data minimisation principle is the legal expression of the “continuity, not behaviour” rule.
In India, the DPDP framework (covered in detail in the first package of this series) treats the employee as a data principal and the employer as a data fiduciary. Section 7(i) recognises employment purposes as a legitimate use, and identity continuity sits close to the core of that. But the safer basis, and the one that leaves a record, is itemised consent that names the four moments. The erasure duty applies: the day-one and day-thirty identity records should be retained only as long as they serve the purpose, and the credential cycle should overwrite rather than accumulate.
In the Gulf, the UAE and Saudi personal data laws both require a lawful basis and transparency, and employment contracts under the respective labour laws can carry the post-hire verification terms. Ministry records (MOHRE in the UAE, Qiwa in Saudi Arabia) provide an independent source for credential and status checks that does not depend on the employee’s own documents.
In every jurisdiction, the pattern is the same: name the checks, state the purpose, get the consent or document the basis, and delete what is no longer needed.
Connecting the HR system to the programme
The hardest part of this model is not the checks. It is the trigger.
The access event (promotion, transfer, privilege change) is an HR system event. The verification programme lives with the vendor. In most organisations there is no connection between the two, which is why the access-escalation gap exists.
The fix is a short list of HR events that generate a verification task. Role change to a higher tier. Addition of financial approval authority. Grant of privileged system access. Move from fixed-term to permanent. Transfer into a regulated function. Each is defined once, mapped to the tier it moves the employee into, and wired to open a case with the verification partner.
This is the same role-tiering exercise that the DPDP and US playbooks in this series both depend on. An employer who has built the tiers once can use them three times.
What the employee sees
The test of whether the programme has stayed on the right side of the line is what the employee experiences.
At offer, a clear notice: we confirm identity on day one and day thirty, we re-verify when your role changes, and we confirm credentials your role depends on when they come due. We do not monitor your activity.
On day one, a five-minute video session with the verification partner before credentials are issued.
On day thirty, a two-minute repeat.
On promotion, the checks appropriate to the new role, explained as such.
On a credential date, a request to confirm the registration is current.
That is the whole of it. An employee who reads that notice does not feel watched. They feel that the employer takes seriously who it lets into its systems, which, for the honest majority, is reassuring: it means the colleague on the other side of the Slack channel is who they say they are.
The cost conversation
Post-hire verification is an additional spend, and the honest case for it is about what it replaces.
The DOJ put the remediation cost of one laptop farm scheme at more than $3 million across the affected companies. Checkr’s 2025 survey found 23% of managers reporting losses above $50,000 from hiring fraud in a year, and 10% above $100,000. Those are the costs of the gap.
The cost of closing it, for a mid-sized remote workforce, is two short identity sessions per hire plus event-triggered re-verification for the minority of employees whose roles change. It is a fraction of the pre-hire package, because it reuses the pre-hire record rather than rebuilding it.
An employer who has spent two years hardening the front door, and who now has 71% of its HR team trained on hiring fraud, has already made the expensive investment. The post-hire programme is what makes it count after Monday.
The file does not close
For as long as the industry has existed, a verification case has had a closing date. The report is delivered, the decision is made, the file is archived.
The model in this piece replaces the closing date with a small number of reopening events. The file is still a snapshot. It is just taken more than once, at the moments when the risk is highest, and never in a way that watches how the person works.
The fraud does not end at the offer. The verification should not either.
