Deceased identities in hiring, and why screening misses them

What a background check actually confirms

A standard pre employment screen confirms that a name, date of birth and Social Security number belong together, checks criminal records across relevant jurisdictions, and verifies employment and education history. Every one of those checks passes cleanly for a deceased identity, because the identity is genuine and the history is genuine.

Right to work verification has the same characteristic. It confirms the documents presented are consistent and valid on their face. It is not designed to confirm that the person standing in front of you is the person the documents describe, and in a remote process there is nobody standing in front of you at all.

So the screen comes back clear, the offer goes out, and a fraudulent worker is inside the perimeter with a badge, a laptop and a payroll record.

What changed with remote hiring

Distributed hiring removed the incidental controls that used to catch this quietly. Somebody used to hand over a passport in person. A local reference happened to know the family. A first day involved walking into a building.

In a fully remote process the identity is a set of documents and a video call, and both are reproducible. The volume of applications also went up, which pushes screening toward automation, which pushes it toward exactly the checks a deceased identity passes.

The exposure for an employer

The obvious cost is payroll paid to somebody who is not who they claim to be. That is rarely the largest cost.

The larger exposure is access. A hired identity carries system credentials, customer data access, financial system permissions and often physical access. In regulated industries it may also carry a licensed or registered role that was granted on the strength of a fraudulent identity, which becomes a supervisory problem as well as a security one.

There is a third layer. Contractors and vendor staff frequently receive access with lighter screening than employees. If the deceased identity check is only applied to direct hires, the gap simply moves.

• Payroll and benefits paid against a fraudulent identity
• System and data access granted to an unverifiable person
• Physical access credentials issued to a fabricated worker
• Licensed or registered roles held under a stolen identity
• Contractor and vendor populations screened to a lower standard

Where to put the check

At offer stage, alongside the existing background screen and before any credential is issued. This is the point where the cost of stopping is lowest and the cost of proceeding starts to climb sharply.

Run it against the same identity elements the screen already collects, so there is no additional data capture and no additional candidate friction. A deceased result at this point is not a hiring decision about a living candidate, it is a signal that the identity presented does not belong to the person presenting it, and it should route to security rather than to the hiring manager.

Then run a periodic sweep across the active workforce and the contractor population. Somebody hired legitimately three years ago is a different exposure to somebody hired last week, and a sweep is the only thing that finds an identity that was substituted after onboarding.

Handling a match without creating a problem

This needs a defined path, because handled clumsily a false positive is a serious matter for a real candidate.

Route matches to a security or investigations function, not to the hiring manager. Confirm through a second identity element before any action. Do not communicate a suspected deceased match to the candidate as an eligibility decision, and do not treat it as an adverse action question without taking a view on which framework applies to the way you are using it.

The volume here is genuinely low, which means the review cost is genuinely low. That is the argument for setting the threshold conservatively and having a human look at everything before anything happens.

Common questions