October 03, 2025

Inside Socure's Identity-First Hiring Test: Early Lessons on How Socure Identified and Then Stopped Fake Applicants

Corporate America is under siege from a surge of impostors, fraudsters armed with AI-polished résumés, stolen identities, and deepfake interviews. These “synthetic employees” are slipping past legacy background checks with ease, leaving companies exposed to payroll leaks, data theft, and reputational fallout.

This damage is apparent even at the recruiting process. Recruiters, overwhelmed by applicant floods, often can’t tell the difference between a genuine candidate and a fabricated persona. Moreover, genuine candidates risk being passed over by a fabricated persona with a too-good-to-be-true application. And unfortunately, Socure was not immune from this new kind of attack.

Socure’s HR team knew something unusual was up when they witnessed a surge in suspicious applicants. Instead of letting the problem slip downstream, Socure decided to use its own medicine and address the problem. The Socure team utilized our identity-first controls at the top of the funnel, employing our Workforce Verification solution, which is orchestrated in real-time by RiskOS. This process linked applicant activity through SocureID and enhanced detection with passive device and behavioral telemetry from Digital Intelligence.

The fake applicant surge that Socure was experiencing was burdensome. For hard‑to‑fill roles, application volumes jumped from the low hundreds into the thousands, a 3,000%‑plus spike that buried genuine candidates under noise and created hours of wasted review time per fraudulent profile.

In the first week alone, the solution flagged over 1,200 potentially fraudulent submissions, allowing the HR team to focus on genuine candidates. Just as important, Socure’s models are regularly reviewed for potential bias under a rigorous model governance program so our HR teams could be confident with the results. In the end, real candidates are reviewed quickly while minimizing time and interviews wasted on fake candidates.

What changed wasn’t just the presence of a new tool; it was the placement of trust.

Identity checks moved left, from late‑stage I‑9 or background screening to the moment a resume enters the system. The flow starts simply: score phone, email, address, device, and session behavior to establish identity confidence with no added friction, then let RiskOS decide whether to escalate based on the HR teams’ preferences. Flagging fraudulent applicants without punishing real candidates created clean handoffs to HR and recruiting teams.

The second shift was persistence. Verified identities are durable references, ensuring the individual who interviews is the same person who shows up for work, while making it easier to detect repeat attempts with altered credentials or identity manipulation throughout the hiring process. Over time, the persistent graph view distinguishes legitimate variance (new phone or address) from coordinated fraud, and it carries forward into sensitive lifecycle events like payroll setup or access recovery.

For global hiring, the verification layer spans more than 190 countries, giving organizations high assurance while keeping genuine international candidates moving smoothly when roles require it.

The early lessons weren’t obvious at first, but they were invaluable. Identity-aware hiring is proving to be more than just a control, it’s a discipline that adapts to each organization. Signal thresholds can flex for different job types or geographies, while passive signals highlight risks that no résumé screen could ever catch, such as emulator use or suspicious IP behavior.

Just as important, the models are designed—and tested—to minimize bias, ensuring that legitimate candidates move forward quickly while risky attempts are flagged. Recruiters stay focused on people, not fraud investigations, reducing wasted interviews, protecting compliance, and improving the candidate experience.

Socure’s RiskOS, a unified fraud, compliance, and risk-decisioning platform that orchestrates signals, rules, and case management, enabled teams to refine policies as signals matured, codifying what should escalate versus what should simply be logged. That separation of concerns proved as critical as the models themselves, keeping recruiters out of fraud investigations and driving consistency without trapping them behind hard stops.

The third lesson was about narratives, not technology. “Fake applicant” stories often focus on North Korean laptop farms and sanctioned networks. The patterns Socure observed included those, but also commercial deception, credential laundering, and organized identity manipulation designed to take advantage of the various gaps in the HR process. When identity is treated as an assumption and not a variable, the attacks may go unnoticed. When identity is scored, correlated, and persisted, they look like signatures.

A fourth learning: background checks remain necessary as a final step after the job is accepted, but they’re not designed to answer the first question, are you a real person, and are you who you claim to be? The most useful posture turned out to be complementary. Upfront identity screening filtered out synthetic or manipulated applicants before background checks, interviews, or offers, and late‑stage checks validated history and credentials for the identities that made it that far. The result was money saved, fewer rescinded offers and less reputational damage and time wasted from late discoveries.

Operationally, the most valuable outcome wasn’t a single metric; it was a return to normalcy. Recruiters spent fewer hours in review limbo. Hiring managers saw fewer deepfake interviews or ghost candidates. Compliance had audit trails of decisions, escalations, and fallbacks. And the organization could talk plainly about identity trust without forcing HR into being an identity expert.

Socure explored how Workforce Verification could extend beyond inbound hiring, with learnings showing that periodic portfolio reviews via portfolio scrubs may help surface synthetic or manipulated identities already on the books. In these scenarios, backward document verification or step-up authentication can be applied where appropriate. Continuous identity signals can support trust maintenance as people change devices or contact channels, helping organizations align ongoing events with the same assurance applied at the point of application.

Identity‑aware hiring is a governance choice blueprinted into technology so it’s automatic. The stack, RiskOS for real-time orchestration, SocureID for persistence, Digital Intelligence for passive telemetry, and DocV for high‑assurance checks, keeps the mechanics fair and consistent. But the program lives or dies on policy discipline: clear thresholds, measured friction, and evidence logged in language auditors and leaders understand.

Socure’s internal rollout didn’t end the attacks, it filtered them out. Fake applicants are now flagged at the point they enter the system, saving recruiters hours of manual reviews and enabling them to find the real candidates faster. But the change in posture, identity before everything, has held. And in an environment where one in four applicants could be fake within a few years, the most conservative choice might be having recruiters read resumes again.

Posted by

Mark Bahl

Mark Bahl

Mark Bahl is a Product Marketing Manager at Socure, where he leads Go-To-Market strategy for the Socure Compliance portfolio. Mark works cross-functionally to drive successful product launches, produce strategic industry insights, and craft impactful thought leadership and enablement content. Deeply passionate about the compliance and risk space, Mark is committed to advancing innovation and helping organizations build trust, ensure transparency, and achieve regulatory excellence.