Every verification programme in the world has the same shape. It starts at the application and ends at the offer. The file is built, the checks come back, the decision is made, and the file is closed.
On the start date, the employer hands a verified person a laptop, a set of credentials and access to its systems. And from that moment on, nobody checks anything.
This piece is about what happens in the period that follows, and why the industry’s own data now says it is where the fraud lives.
The numbers
Checkr’s Hiring Hoax 2026, published on 17 October, surveyed 3,000 US managers involved in hiring. The headline findings are about the application stage: 86% of organisations experienced at least one type of hiring fraud in the past year; 40% of managers have personally interviewed a candidate later revealed to be using a fake identity, up from 31% in 2025; 68% believe candidates are better at faking identity with AI than employers are at catching it, up from 62%.
The organisational response has been real. Formal fraud training among HR teams rose from 17% to 71% in a year. And yet only 23% of managers are extremely confident their process would catch a fraudulent candidate.
The finding that matters for this piece is about where the effort goes. Sixty-three percent of organisations focus their fraud prevention before the hire. Six percent focus it after. Forty-four percent have no formal, written process for verifying identity after someone starts.
And more than a third of hiring managers believe there is a fraudulent employee on their payroll right now.
Put those together and the picture is clear. The industry has spent two years hardening the front door, and the back of the house is unlocked.
What lives in the gap
The post-hire gap is not one fraud. It is at least four, and they have different shapes.
The first is the proxy handover. The candidate who passes every check, because every check was run on a real person with real credentials, and who then hands the job to someone else. The Bengaluru engineer in Sachin’s note is one version. The North Korean IT worker scheme is the industrial version: real US identities, stolen or rented, used to obtain remote technical jobs, with the company laptop shipped to a “laptop farm” where remote-access software let operatives in China or North Korea do the work. The US Department of Justice has now secured at least eight sentences in five months against laptop farm operators; the two sentenced in April placed workers in more than 100 companies using 80 stolen identities, and companies incurred at least $3 million in remediation costs. Microsoft Threat Intelligence warned in March that the operatives now use AI to shorten the time it takes to build each identity.
In every one of those cases, pre-hire verification succeeded. The identity was genuine. The fraud was in who turned up.
The second is the lapse. A credential that was valid at hire and is not valid now: a professional licence that was revoked, a right-to-work status that expired, a qualification that was withdrawn by the awarding body. Nothing about the employee changed at hire; something changed afterwards, and the file was already closed.
The third is the drift. An employee who was honest at the interview and becomes an insider risk later, through financial pressure, coercion, or opportunity. Cifas’s Insider Threat Database data showed that 38% of employees filed for dishonest conduct against their employer had been in post less than a year, up from 21% two years earlier. The first year is the risk window, and the first year is also the period when the pre-hire snapshot is treated as current.
The fourth is the access escalation. An employee hired into a low-risk role, screened at the low-risk tier, who is promoted or moved into a role with financial authority, customer data or system privileges, and who is never screened at the new tier because nobody connects the HR event to the verification programme.
Four different problems. One common cause: the verification file has a closing date, and the risk does not.
Why the industry built it this way
This is not a failure of competence. It is a legacy of how verification was commercialised.
Background checks were sold as a pre-employment product. The buyer was talent acquisition, the trigger was the offer, and the deliverable was a report. Every system, every contract, every consent form and every SLA was built around that single moment. The HR information system treated the report as an onboarding document to be filed. The vendor treated the case as closed on delivery.
The remote-work shift broke the assumption underneath that model: that the person who was verified would walk into an office, be seen by a manager, and sit at a desk the company controlled. For an on-site hire in 2015, the physical workplace was a form of continuous identity verification that nobody needed to design. For a remote hire in 2026, it is gone, and nothing replaced it.
The AI shift broke a second assumption: that identity was hard to fake at scale. It was. It is not now.
So the programme that was adequate when it was built is now adequate for a world that has ended, and the data above is what that looks like.
The foreseeability problem
There is a legal dimension to this that is sharpening.
The New York State Bar Association’s analysis of fake job candidates makes the argument that being deceived into hiring an AI imposter is now a foreseeable risk in remote hiring, and that organisations are expected to plan for foreseeable high-impact threats even where they cannot prevent every incident. It notes that the imposter being a state-sponsored actor is itself foreseeable.
Foreseeability is the hinge of negligence. Once a risk is foreseeable and the means of mitigating it are available and reasonable, failing to mitigate becomes a question of standard of care. The laptop farm prosecutions, the vendor surveys, the Microsoft warnings and the bar association commentary are, collectively, building the record that this risk is known.
For an employer who suffers a proxy-handover incident in 2027 and has to explain to a regulator, a customer or a court why identity was verified at day zero and never again, “that is how everyone does it” is a weaker answer than it was in 2024.
What this is not
It would be easy to read this piece as an argument for monitoring employees. It is not, and the distinction matters enough to state plainly before the next piece builds on it.
Confirming that the person doing the job is the person who was verified is identity continuity. Tracking what the person does, when they work, what they type and who they talk to is behavioural surveillance. The first closes the gap described above. The second creates a different problem, damages trust, and in most jurisdictions runs into data protection and employment law.
The post-hire gap can be closed with a small number of identity and credential checks, consent-based, triggered by events rather than running constantly. That is the model the next piece sets out.
The reframe
A background check has always been described as a snapshot. The phrase is accurate and the industry has treated it as a compliment: a clear, point-in-time picture.
The data above says the snapshot is the problem. Fraud is not a point in time. The proxy takes over at week two. The licence lapses at month eight. The insider goes bad in year one. The promotion comes at month eighteen.
A programme that verifies once and closes the file is a programme that has decided, structurally, not to know about any of that. Sixty-three percent of employers have made that decision without noticing they made it.
The question for the other 37% is what the next ninety days should look like.
