Being a great background check company doesn't make you a great fraud detection company

Every week I talk to recruiting and security leaders, and the thing I hear most is "we already run background checks." This fall Checkr launched a fraud detection suite, First Advantage is selling identity checks as early as the interview, and ID.me has an exclusive partnership with Sterling that names interview fraud as a focus. So now I hear a second version: "our background check vendor does fraud now."

I get the appeal. One vendor, one contract, and they see every hire anyway. But fraud detection and background checks are very different, and being a great background check company doesn't make you a great fraud detection company.

What does a background check actually check?

A background check starts with what the candidate hands you: a name, a date of birth, a Social Security number, a work history. The provider looks those up in criminal records, past employers and degrees. If the records are clean and they match, the report is clean.

It also needs the candidate's permission. Under the Fair Credit Reporting Act you give the applicant written notice and get written permission before you order the report (FTC). That's a big part of why it runs on the finalist, at the end of the funnel.

Background checks fail against coordinated fraud. Last November we onboarded a customer who was one interview round away from making an offer. The candidate had a ten-year-old LinkedIn, a valid email and a working phone number. Tofu flagged him, so the recruiter messaged the LinkedIn profile on the application directly. The reply was immediate: "I never applied to your company."

The name was real. The work history was real. The record was clean, because it was his record. A background check would have passed him.

The government cases look the same. In July 2025 Christina Chapman was sentenced to 102 months in prison for running a laptop farm for North Korean IT workers. They got jobs at 309 U.S. companies using 68 identities stolen from people in the United States (U.S. Department of Justice). That's about 4.5 companies for every stolen name, and every one of those names had a real history behind it.

And every candidate that got hired at these companies likely went through a background check with one of the above named companies… and still got through.

Why checking records doesn’t make you immediately good at identity

Building a good tech stack to verify people against databases quickly doesn't mean you're adept at identity. A database tells you whether a history is true. Identity asks something else: is the person applying the person behind the name?

Identity is largely behavior driven. How someone applies, what they apply to, when, from which device and network, and which other applications share their phone number or email. None of it lives in a court record. Earlier this year our resume fraud detection flagged 67,000 possible impersonations between January 1 and the start of March, real identities being used by someone else. And some owners rent their names out on purpose, pass the checks themselves and hand over the job.

Is a big screening company's distribution an advantage?

Yes. Being a very large company with distribution is 100% a competitive advantage. They're already in almost every hiring process, with the contract, the ATS integration and the budget line.

But applicant fraud sits at the top of the funnel, and a background check company plays largely at the end. That means it has missed considerable context: the hundreds of thousands of applications, the interviews and the patterns across them. And launching a product two years after applicant fraud detection came into demand leaves a considerable gap in the information it has collected across the funnel.

So we've ruled out that being a background check company makes you immediately good at fraud detection. Why?

What data does fraud detection use at the application?

Move fraud detection to the top of the funnel and every vendor starts with the same data. A background check company can't use its background check data there unless it wants to put every applicant through FCRA notice and an opt-in, before a recruiter has even replied. That’s too much friction for such an early part in the process. So they’re left to use the same information as everyone else.

At the application, that's:

• Phone number
• Email address
• IP address and network
• Resume data
• Other proprietary signals, but nothing that sits behind an "I give you consent to check this information" wall. Otherwise they're offsides.

The data not every vendor can get

One more input matters a lot, and that's device data: which device an application came from, what else that device has touched and the behavior of it.

To capture it you need to be embedded in the company's careers page, or sit at the point where the applicant clicks the button. Vendors serving companies directly don't do this 99% of the time, because the engineering team on the other side doesn't give them access, or they don't have SDKs for it.

Vendors that also power hiring platforms through an API are in a different spot. The API sits where the application is submitted, so it sees the device. Tofu actually does this: our Fraud API runs inside the application flow of the platforms that use it.

Two years of ground work

So if every company launched today, nobody would be truly further ahead, except on distribution. Some companies have massive distribution, and that's a competitive advantage.

Now put the vendors on a timeline. We started in mid-2024. The larger players are launching now, at the end of 2026.

That leaves over two years of ground work, and what a vendor did with it decides how much it knows about any one applicant:

• A vendor that only sells direct builds a network as fast as it wins customers, but without device data. On a given person it knows roughly what the next vendor knows with some consortium based info.
• A vendor that sells direct and runs an API collects device data through every platform the API lives in. If those platforms have real distribution, that vendor has more on each candidate, pound for pound.
• Then take into account who was fast to market, who acquired customers quickly, and how big they are. All of that dictates how much more information one vendor has on a candidate than another.

But none of this information comes from a background check.

Some of these companies might even tell you they have a resume database used in conjunction with ID verification

However since people typically stay in jobs for one to two years and update their resumes when they move, any resume you have from two or three years ago is largely stale and an unreliable document, considering now that AI is 3 years old and a majority of genuine people are heavily using it to write resumes.

Which means a company like Checkr, First Advantage or ID.me starts with no more information on a given applicant than anyone else. They have the distribution but not the information.

So what decides who catches fake candidates?

So starting fall 2026, being a big background check company is...not as much of an edge as you'd think.

So then it becomes a race to acquire customers, and then UX and all the other things that make a product enjoyable are really important. And traditionally, very large companies are slow and bloated when it comes to launching truly beautiful products that delight.

Here's what we built. We check every applicant at the application, inside your ATS, with nothing extra for the candidate to do, and flag what we find with the reasons behind it. In interviews, we analyze Zoom, Google Meet and Teams calls as they happen (deepfake detection). At Tailscale, 0 fake candidates advanced to hiring managers or further after they started using it (Tailscale story).

It isn't perfect, and I won't pretend it is. Real people can look odd on paper: a VoIP number, a brand-new email, a VPN on hotel Wi-Fi. So we show you how we got to every flag, and we never reject anyone on your behalf. Your team makes the call.

What to ask a background check vendor selling fraud detection

1. What happens when the identity is real but the person using it doesn't own it?
2. What data do you use at the application, before the applicant has agreed to a background check?
3. Do you see device data at the point of application, or only what the employer forwards to you?
4. How long have you been catching fraud at the top of the funnel, and across how many companies?
5. Does it check the live interview, on the video platform your team already uses?

If the answer to the first one is an ID and selfie check, ask the second one again.

Keep your background check

Criminal history, employment and education verification, and the FCRA process are jobs we don't do, and you need them. Run the background check on your finalist. Check everyone before that, starting at the application (how Tofu works).

And if you hire a handful of people a year, in person, mostly through referrals, your background check is probably enough. I'd rather say that than sell you something you don't need.

But being a large background check company does not instantly mean being great at fraud detection. It’s helpful. But not an absolute.

If you're hiring remote and any of this sounds familiar, come talk to us.