Recruitment Fraud Signals That Require Follow-Up, Not Accusations

Suspicion is not an identity finding

Hiring teams are facing two very different problems. One is ordinary resume inflation, such as exaggerated project ownership. The other is an adversary using another identity to reach sensitive systems. These warrant different checks, different specialists and different evidence thresholds. Neither should be inferred from a polished resume, an unfamiliar accent, a background gap or a strange video connection.

The UK Information Commissioner guidance on pre-employment vetting says intrusive third-party inquiries should be justified by a specific risk and that ordinary questions should first be put to the candidate. It also requires a fair opportunity to explain discrepancies. That is a useful civilian baseline: the starting point is a proportionate recruitment question, not a search for reasons to suspect every applicant.

A recruiter should distinguish three observations in the case record: what the source visibly says, what a tool suggests, and what an independent check has actually established. An AI-generated writing style may be an editing choice. A timeline overlap may reflect consulting. A failed directory search may mean the directory is incomplete. Each needs a different next step, and most are not identity findings.

Build three lanes before investigating

These lanes prevent a parsing defect from becoming an allegation, and a genuine identity concern from being buried in an ordinary skill-matching queue. Assign each case a status such as unreviewed, clarification requested, substantiated inconsistency or resolved. Avoid the label fraud unless an authorized process establishes it.

Five signals and their innocent explanations

Employment record not found. A business may trade under a different name, shut down or provide verification only through a payroll partner. A missing website is not proof the person invented a job.

Inconsistent timeline. Contract work, concurrent employment, month-only dates and extraction glitches can create apparent overlaps. Compare the original document before asking for an explanation.

AI-polished writing. Editing tools can improve grammar without changing the truth of the work history. The 2026 LREC resume-detector study found large performance differences for off-the-shelf tools on resumes, cautioning against using a generic AI-authorship score as an integrity verdict.

Unusual interview delay. Audio routing, accessibility tools and poor bandwidth can explain pauses. An observable connection problem should prompt a neutral technical retry, not a personality judgment.

Different accounts or contact details. People change employers, names, phone numbers and public profile settings. Independently verified conflicts can matter, but an inconsistent handle alone is weak evidence.

The proportional follow-up sequence

1. Capture exactly what was observed. Include the source document, the specific field and the date. Do not turn an inference into a fact.
2. Check the data pipeline first. Reinspect the raw resume and parsing output. Confirm you are comparing the correct candidate profile.
3. Choose the lowest-intrusion clarification. Ask a focused question that a genuine applicant can reasonably answer. Offer accessible alternatives.
4. Use independent verification only when needed. Seek proper notice, authorization and a lawful basis. Do not scrape unrelated personal information.
5. Escalate material identity concerns to trained staff. A recruiter should not improvise a forensic interview or circulate raw identity documents by email.
6. Record the outcome and allow correction. Preserve distinctions between unresolved, contradicted and verified information.

Case study: the apparent contradiction that was not fraud

A synthetic applicant lists software engineering work between March 2023 and June 2025, plus advisory consulting beginning in January 2025. A naive timeline rule flags overlapping jobs. The source resume confirms both engagements, and the applicant explains that the advisory project was part-time. The concern is resolved through a simple clarification. No identity verification was justified by the dates alone.

In a different, high-access remote contract, independently validated identifiers point to conflicting individuals. That is no longer just a CV consistency issue. An authorized security team can conduct role-appropriate identity proofing, documenting what was checked and minimizing collection. The NIST 2025 identity proofing guidance provides technical concepts, but it does not automatically turn an ordinary recruiting website into a regulated identity provider.

Consider the alternative cost of escalation. Asking for an unnecessary identity document can expose personal information, deter legitimate applicants and create retention obligations. On the other hand, a role that includes privileged production access may justify established security onboarding after the normal job-related assessment. The policy should state who authorizes that stage, which data may be collected and how a candidate can challenge an error. Do not delegate these decisions to a resume-screening score.

Who owns the decision and who can challenge it?

Separate recruiter observations from approved verification findings and from the final employment decision. HR owns job relevance, privacy specialists own permitted data handling, and security staff handle security incidents. Candidate communication should be factual and allow response. Where a third-party background report is used in the United States, FTC and EEOC guidance explains additional Fair Credit Reporting Act steps that may apply.

Measure false flags and reversals, not merely the number of suspicious applicants. If one source repeatedly marks legitimate applicants as suspicious, retire that check until it is validated. An honest verification workflow is successful when it resolves uncertainty with the least unnecessary harm.

Build a small review log with the precise disputed statement, the original source, the method attempted, the reviewer and the outcome. Keep a category for inconclusive searches and one for corrected extraction errors. If a disputed point is resolved, update the active candidate profile so the original flag does not repeatedly surface as if it were new evidence. A useful operational measure is the share of flags that survive human review, coupled with the number of legitimate applicants delayed by avoidable checks.

Questions recruiting leaders should be able to answer

Does an AI-generated resume prove deception?

No. Source text style cannot establish whether claims are true. Verify material job-related assertions through appropriate evidence instead.

Should every remote applicant pass biometric identity verification?

No blanket conclusion follows from the documented threat. Assess necessity, proportionality, accessibility, applicable law and the sensitivity of access before using intrusive checks.

What does an inconclusive result mean?

It means available sources do not resolve the question. It does not mean an adverse fact was established. Record the exact gap and choose a proportionate follow-up.