Recruitment becomes part of the attack surface

Remote hiring has removed geographic barriers, but it has also created new opportunities for identity fraud. When interviews, documents, signatures and onboarding all happen at a distance, employers may have fewer physical cues to confirm who is on the other side. Deepfakes, manipulated documents and stolen identities raise the risk, particularly when a role quickly leads to access to code, infrastructure, personal data or financial tools.

The new problem: legitimate credentials for a false identity

The most challenging scenario is not an attacker breaking a password, but a false identity passing recruitment and receiving valid credentials. Technically, the access looks legitimate because the organization granted it. Recruitment therefore becomes part of the attack surface. CHRO and CISO should jointly design onboarding for sensitive roles and define what identity assurance is required before accounts, equipment or privileged permissions are issued.

What an employer should verify

Robust verification can combine identity documents and authenticity checks. Biometric mechanisms require particular caution in Spain because biometric identification/authentication can involve special-category data and high-risk processing; they should only be used where a specific lawful basis and the applicable Article 9 GDPR condition are established, with necessity and proportionality demonstrated. Screening can then compare relevant parts of the declared history, such as education or employment. Each layer answers a different question: is this a real person, are they who they claim to be, and is the declared history consistent? The combination should match risk rather than create unnecessary friction for every applicant.

More control where access is more sensitive

Roles with access to code repositories, cloud administration, master credentials, financial information or large volumes of data deserve stronger controls. A role with limited exposure may need a lighter process. This risk-based approach can improve security and candidate experience at the same time by concentrating friction where potential impact is higher and avoiding disproportionate controls where they add little value.

A secure candidate experience

Candidate security matters too. A professional process explains what will be checked, obtains consent where required, uses secure channels and limits retention. This reduces uncertainty and helps distinguish legitimate verification from fraudulent data requests. For international employers, a clear multilingual experience can also support the employer brand: security and respect for privacy do not have to conflict.

Want to integrate Human Risk Management into your risk model?

Validato helps organizations design modular, proportionate background checks for candidates and employees, with international reach and data governance in Switzerland and the EU. Contact us to discuss which screening level fits your higher-risk roles.