Behind the Mask: Spotting Healthcare Impostors

The threat is bigger than a fake resume

Healthcare hiring fraud is no longer limited to an embellished resume or a questionable reference. In the webinar, Behind the Mask: Spotting Impostors in Healthcare Hiring, First Advantage leaders Irina Kovach, Global Chief Product Officer, and Aaron Cook, Chief Strategy and Transformation Officer, joined cybersecurity expert James McQuiggan to examine applicants who deliberately use stolen or synthetic identities, fabricated work histories, forged credentials, and AI-generated documents to appear qualified for a role.

The tools are becoming faster and more convincing. Generative AI can help fraudsters build coherent resumes, employment profiles, reference networks, and interview personas in far less time than before. Remote hiring, urgent staffing needs, telehealth growth, and highly automated onboarding can create additional openings when speed becomes the overriding priority. The risk is already showing up in healthcare hiring, with 44% of healthcare employers reporting identity misrepresentation and 79% reporting falsified employment histories.¹

The high stakes in healthcare

Healthcare organizations face a particularly consequential mix of risks. An impostor may seek access to systems, protected information, prescription drugs, billing processes, or a role that requires qualifications they lack. The potential effects can extend to patient care, compliance, liability, workforce trust, and organizational reputation.

Traditional background checks can leave an identity gap

A conventional background check and identity verification answer related but different questions. A background check searches for records associated with the identifying information provided. Identity verification helps determine whether the person presenting that information is its rightful owner. If a fraudster uses a real person’s data or a synthetic identity, the history may look clean even though the applicant isn’t who they claim to be.

That distinction also explains why common hiring checks should not be treated as interchangeable. A Social Security number (SSN) trace can surface names and address history associated with an SSN, but it does not establish that the applicant owns the number. Consent-Based Social Security Number Verification (CBSV) can match a name, date of birth, and SSN against Social Security Administration records. However, it still does not bind the record to the live person presenting it. Form I-9 and E-Verify support employment authorization and compliance processes, but they are not comprehensive identity-fraud screening tools.

Healthcare credentials introduce another layer

A license lookup may confirm that a license exists and is active, but the employer must still connect that credential to the applicant. Work history and references also require independent confirmation. Fraud networks may supply coordinated references or point recruiters to fabricated employers. Once someone is hired, a one-time license or sanction check can become outdated if a record is later suspended, revoked, or added to an exclusion list.

The practical response is not to discard these checks. Use each one for its intended purpose and connect them in the right sequence. Beginning with identity can improve the quality of the data sent into the background check, while automated digital workflows can help keep the experience fast for legitimate candidates.

Build a layered, identity-first defense

The speakers used an onion to illustrate the value of layered defenses: No single layer is foolproof, but several independent layers make deception harder to sustain. A healthcare organization can translate that idea into a practical hiring and workforce risk program:

1. Use data intelligence to test the profile. Compare biographic, telecom, device, IP, and geolocation signals across unrelated sources. A single anomaly is not proof of fraud; the value comes from triangulating patterns and escalating meaningful inconsistencies.
2. Bind the identity to a live person. Use document authentication, a selfie or liveness check, and face matching where appropriate and permitted. Compare the live applicant with an authenticated government-issued ID before beginning the background check.
3. Verify credentials at the source. Confirm licenses, education, employment, and references through independent channels rather than relying only on applicant-supplied documents, contact details, or websites.
4. Equip people to notice inconsistencies. McQuiggan’s advice was simple: “Be curious.” Train recruiters and hiring managers to ask natural, role- and resume-specific follow-up questions. Pauses, scripted answers, or details that do not fit the claimed history are prompts for review, not automatic proof of fraud.
5. Continue monitoring after hire. Use ongoing license, sanction, and exclusion monitoring, and define risk-based points for identity re-verification, such as a role change, access expansion, or material profile update.

Identity-first verification is a foundation, not a guarantee. The strongest programs define which signals trigger manual review, who owns the escalation, how candidates can resolve discrepancies, and when checks repeat. By connecting identity, background screening, credential verification, human judgment, and ongoing monitoring, healthcare organizations can make it more difficult for an impostor to move from a convincing profile to being granted access.

Frequently Asked Questions