Most Fraudulent Hires Receive Credentials Before Detection
HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.
A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.
- 42% of fraudulent candidates pass screening and get hired; average 5.73 days unmonitored access
- 98% of 500 surveyed US HR executives experienced candidate fraud firsthand
- Only 3% detected same day as hire; 20% undetected up to three weeks
- CISA's updated Insider Threat Guide warns of AI-assisted fake IT job applicants
- North Korean actors use fraudulent remote workers for data theft and extortion
Full article455 words · extracted from infosecurity-magazine.com · click to collapse
Most fraudulent hires receive corporate credentials and internal network access before being detected, according to a new report by HYPR.
Fraudulent candidates successfully navigate pre-hire screening and take up their roles in 42% cases. Just 3% are subsequently detected as fraudulent on the same day as they are officially hired.
Around a third (32%) are discovered within one to three days, 45% within four to six days and 20% go undetected for up to three weeks. This means that fraudulent hires have an average of 5.73 days of unmonitored access to corporate networks, posing significant data security risks to organizations.
Almost all (98%) of 500 US HR executives who were surveyed as part of the study said they had experienced candidate fraud first hand, while 89% expressed heightened concern over hiring fraud in the past two years.
Bojan Simic, CEO and co-founder of HYPR, warned: “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT.”
Among the fraudulent candidates that are detected during the hiring process, 68% are identified by human instinct.
Screening (52%) and interviews (45%) are the most common pre-hire detection points, followed by technical assessments (41%) and onboarding (42%).
“A process that catches fraud at every different stage isn’t really a security funnel – it’s a set of disconnected checks operating in silos. Because no single stage reliably stops candidate fraud, clearing an earlier stage offers no guarantee of identity assurance,” HYPR wrote in the study dated September 15.
The report also highlighted a significant discrepancy between who is responsible for identifying candidate fraud pre hire. About half (53%) of HR executives surveyed took ownership for hiring identity risk before an offer is accepted, while 19% said the talent acquisition team is responsible, 10% for compliance/legal, 10% security and 7% IT.
HYPR said this suggests that many organizations operate with the assumption that IT and security only take responsibility for candidate identity risk post hire.
Hiring Fraud Creates Significant Insider Risk
The report findings, published on September 15, come amid National Insider Threat Awareness Month 2026.
On September 9, the US Cybersecurity and Infrastructure Security Agency (CISA) released an update to its Insider Threat Mitigation Guide, which highlighted how malicious actors are using various AI tools to assist them in applying for and obtaining remote IT jobs to gain privileged access into enterprises.
This has been a tactic extensively used by North Korean actors to gain employment in Western firms in recent years for purposes such as data theft and even subsequent extortion.
Despite these publicized threats, the HYPR report found that around 60% of identity verification and multi-factor authentication budgets are only authorized reactively following a security breach.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fraudulent-hires-credentials/