Identity verification in hiring: a privacy-first approach

Remote hiring made it possible to interview, offer and onboard someone without ever meeting them. That convenience has a cost. In a 2025 survey of 3,000 job candidates, Gartner found that 6% admitted to interview fraud, either posing as someone else or having someone else pose as them1. Gartner also predicts that by 2028, one in four candidate profiles worldwide will be fake1.

Law enforcement has raised the same concern. In a January 2025 warning about North Korean IT workers, the FBI described the use of face-swapping technology during video job interviews and advised employers to implement identity-verification processes during interviewing, onboarding and throughout employment2. Our guide to deepfake and proxy interviews covers how those schemes work in practice.

Verification answers a narrow question: is this applicant a real, unique person who is the genuine owner of the identity they are using? Answering it well means collecting sensitive data from people who have not been hired yet, so the way you do it matters as much as the decision to do it.

The most widely used reference model is NIST Special Publication 800-63A, the US federal guideline on identity proofing. It splits the work into three steps: identity resolution, which settles which unique person is being claimed; identity validation, which confirms the evidence is genuine, authentic and accurate; and identity verification, which confirms that the applicant is the genuine owner of the presented evidence3. NIST also allows proofing to happen remotely, either fully automated or through a live video session with a trained agent3.

In hiring, those steps usually look like this:

• Document check. The candidate presents a government ID, and the system reads it and checks that it looks genuine and consistent.
• Face match. A live image of the candidate is compared with the photo on that ID.
• Liveness. The capture is checked for signs that a real person is present, for example by asking for a head movement.
• Uniqueness. The result is compared with earlier verifications so one identity is not used by several applicants, or one person by several identities.

Identity verification is a different tool from a background check or Form I-9. A background check reports on the history attached to a set of personal details, and Form I-9 confirms employment eligibility after hire. The guide on background checks vs identity verification explains how the three fit together.

A face match uses biometric data, and several legal regimes treat that data as especially sensitive.

GDPR and UK GDPR

Article 9 of the GDPR prohibits processing biometric data for the purpose of uniquely identifying a natural person unless an exception applies4. The first exception is that the person has given explicit consent to the processing for one or more specified purposes4. The UK regulator, the ICO, says that in many cases explicit consent is likely to be the most appropriate condition for biometric recognition5.

The ICO is also clear that consent only counts if it is freely given. It says you must offer a suitable alternative to people who choose not to consent, and that this is particularly an issue for employers, because people who fear adverse consequences may feel they have no choice but to agree5. In hiring, the practical consequence is that declining a face scan should not end a candidacy.

Illinois BIPA

The Illinois Biometric Information Privacy Act covers scans of face geometry6. Section 15(b) says a private entity may not collect a person's biometric identifier unless it first informs them in writing that it is being collected, informs them in writing of the specific purpose and length of term, and receives a written release6. Section 15(a) requires a public written policy with a retention schedule, and destruction once the initial purpose is satisfied or within 3 years of the person's last interaction, whichever comes first6. The Act gives people a private right of action, with liquidated damages of $1,000 or actual damages, whichever is greater, for each negligent violation, and $5,000 or actual damages for each intentional or reckless one6.

This guide is general information about the law, not legal advice. Biometric and privacy rules differ by country and state and change often, so check your own process with counsel.

The legal texts and the NIST guideline point in the same direction. A privacy-first verification process follows a short set of principles.

• Consent before capture. Explain what will be collected, why, and for how long before the camera turns on. NIST requires explicit informed consent to collect and use biometrics, and a stored record of that consent3. See biometric consent in the glossary.
• Collect the minimum. The GDPR requires personal data to be limited to what is necessary for the purpose7, and NIST limits processing to the minimum necessary to validate the identity, link it to the applicant and mitigate fraud3.
• Keep raw biometrics off your servers where you can. Running the face match on the candidate's own device, and keeping only the result, greatly reduces what a breach could expose.
• Store identifiers in a form that cannot be read back. A document number can be kept as a keyed hash, which still detects reuse but does not reveal the number.
• Set and publish retention limits. The GDPR says data should be kept no longer than necessary7, and NIST asks for a documented, publicly available deletion process and default retention period for biometric information3.
• Offer a real alternative. A non-biometric route, such as a person reviewing the ID, gives candidates a genuine choice5.
• Let candidates see and delete their data. NIST recommends supporting deletion of a subscriber's biometric information on request3.
• Never charge the candidate. Verification protects the employer, so the employer should carry the cost.

Verification can fail for ordinary reasons: a worn ID, a poor camera, bad lighting, a recent change in appearance or a disability that makes a movement prompt hard to follow. A process that rejects people automatically will turn those failures into lost candidates and, in some cases, discrimination.

Under Article 22 of the GDPR, people have the right not to be subject to a decision based solely on automated processing, and where such decisions are allowed the controller must offer at least the right to obtain human intervention8. The ICO's guidance asks organisations to consider whether a biometric system is likely to be less accurate for some groups, and gives an example of confirming comparable accuracy across ages and genders5.

In practice, that means a failed or unusual result should go to a human review queue with the reason written out in plain words, so a recruiter can look at the case, contact the candidate and offer another route. Apply the same check at the same stage for every candidate in a role, so no group is singled out.

Data minimisation also applies to timing. Verifying every applicant at the point of application collects sensitive data from many people who will never be interviewed. Verifying shortlisted candidates, before the interviews that matter most, limits the data to people with a real prospect of an offer. A short re-check before the final interview or the first day confirms that the same person is still taking part.

Most teams run hiring in an applicant tracking system such as Greenhouse or Ashby. When you connect a verification tool, decide what it may write back. A good default is the outcome only, as a tag or a short note, with no ID images, document numbers or face data copied into the ATS. That keeps sensitive data out of a system that many people can open, and makes retention easier to manage. Our integrations page and the glossary entry on ATS write-back show what that looks like.

Whether you build or buy, these questions help legal, security and talent teams agree on a process:

1. What does the candidate see before any capture starts, and can they say no?
2. Which data leaves the candidate's device, and which is stored? For how long?
3. Is there a non-biometric alternative, and does choosing it affect the outcome?
4. Can a candidate download or delete their data without contacting you?
5. Does any result reject a candidate automatically, or does a person decide?
6. What is written to the ATS, and who can read it?
7. Is there a published retention and destruction schedule for biometric data?

Elsin is one tool built along these lines. Shortlisted candidates check their ID and face on their own phone after reading what happens and agreeing, and the camera stays off until they do. Face images and video stay on the phone, and Elsin receives only the result and a match score; the ID number is hashed on the device and the server keeps only a keyed hash. Candidates can instead send their ID for a person to review, and that image is deleted when the reviewer decides. Nobody is rejected automatically, verification is free for candidates, and Greenhouse and Ashby receive only the result as a tag and a note. The security page has the details.