Synthetic Identity Fraud in Hiring, Explained

Synthetic identity fraud creates a false identity or persona by combining authentic identifying data, often stolen, with fabricated information. In hiring, that might mean pairing a legitimate Social Security number with a false name, invented work history, manufactured credentials, or an AI-generated profile. As stolen data, generative AI, and deepfake technology become more accessible, these schemes are becoming easier to build, scale, and use against employers and digital labor platforms.

The gig economy is particularly vulnerable. Platforms often verify and onboard large numbers of workers quickly and remotely, with little or no in-person interaction. If a fraudster uses identifying information belonging to someone without a reportable criminal history, a criminal records search may accurately return no records. What it does not establish is whether the identity belongs to the person presenting it.

So, how can organizations uncover what a records search alone may not reveal? We took a deeper look at the issue in our first episode of the Know Your People podcast. Former FBI counterintelligence operative Eric O’Neill explains how identity fraud operates, why traditional background checks may not expose it, and what additional steps organizations can take. He begins with a remarkable FBI case that demonstrates how easily trust can be exploited and why verifying identity is only the beginning.

Listen to “An FBI Lesson in Verifying Identity.”

A lesson from inside the FBI

In 2001, Eric O’Neill worked undercover to help catch Robert Hanssen, a veteran FBI agent who had spent more than two decades spying for the Soviet Union and Russia. Hanssen used his trusted position to steal and share some of the nation’s most sensitive intelligence. O’Neill gained his confidence, uncovered critical evidence, and helped bring his espionage career to an end. The case revealed a fundamental weakness: Hanssen was exactly who he claimed to be, making his case different from synthetic identity fraud. But for O’Neill, it illustrates a related weakness: trust established once can become a blind spot when it is not reassessed.

What is a synthetic identity in hiring?

In hiring, a synthetic identity is a candidate or worker profile that blends stolen personal information with fabricated professional details. It may include:

• A real identity, or identifying information such as a Social Security number, belonging to someone with a clean record.
• An invented career history supported by a polished résumé, online profile, and convincing references.
• A fabricated employer created for the scheme, complete with a professional-looking website, email addresses, and working phone numbers.

Each element may appear credible on its own. Together, they create a false candidate who may pass basic screening checks without revealing the person’s true identity.

Why can the background check come back clean?

A traditional background check searches for records associated with the identifying information provided. If a fraudster deliberately uses the identity of someone with no criminal history, the search may accurately return no records.

The missing piece is ownership. Finding no record associated with an identity does not establish that the identity belongs to the person presenting it. Answering that question requires an additional identity verification step that validates the identity document and connects it to the live applicant. This distinction helps explain how an impostor can pass a conventional background check without being the person the organization intended to screen.

How to identify synthetic fraud

O’Neill’s practical guidance for hiring teams centers on verifying information through sources the applicant does not control. That principle should be applied throughout the employee lifecycle, not only during the background check.

Pre-hire: Establish who is applying

Identity verification should begin before the background check so the organization has greater confidence that they are screening the right person. This may include validating an identity document, comparing it with a live selfie, and using liveness detection to determine whether a real person (not a photo, recording, or deepfake) is completing the process.

Hiring teams should also independently verify the applicant’s claims by:

• Contacting references independently. Reach references through the organization’s main number, official website, or a verified professional profile and not only via the contact information supplied by the applicant.
• Validating previous employers. Confirm that each organization is legitimate through business registration records, credible third-party sources, and an established public presence. A polished website alone is not proof.
• Verifying education at the source. Contact the institution or use an authorized verification service to confirm the credentials claimed.
• Looking for inconsistencies. Differences among identity documents, application details, professional profiles, and interview responses may warrant further review.

Onboarding: Confirm it is the same person

Passing a pre-hire check does not eliminate the risk of substitution. Someone other than the screened applicant may attempt to complete onboarding or begin performing the work.

A second identity check at onboarding can help confirm that the person receiving platform access is the same person who applied and was screened. Organizations should also review unexpected changes to contact, tax, or payment information and confirm that required documents belong to the worker being onboarded.

Ongoing: Reestablish trust when risk changes

Identity is not necessarily a one-time question. In the gig economy, accounts may be shared, rented, sold, or taken over after the original worker has been approved.

Risk-based reverification can help platforms confirm identity at important moments, such as account reactivation, a new device login, a significant profile change, or other unusual activity. Periodic checks may also be appropriate for higher-risk roles or access levels.

Together, these layers complement the background check by helping organizations verify that an identity exists and that it belongs to the person applying, onboarding, and completing the work.

From screening once to establishing ongoing trust

Hanssen’s case and modern synthetic identity schemes involve different threats, but they share a lesson: trust cannot be treated as permanent. A criminal records search may reveal what is associated with the information provided. Identity verification helps establish who is behind that information, while independent checks and risk-based reverification help maintain confidence over time.

For gig platforms, the goal is not to add friction to every interaction. It is to apply the right verification at the moments when risk changes.

Listen to “An FBI Lesson in Verifying Identity.”

Frequently Asked Questions