Your Hiring Checks Verify Documents, Not People

Hiring still runs on checks: a background check, an identity check, a reference check. Each one is meant to reduce the risk of hiring fraud. But most of them are checking the same thing in different ways: whether the paperwork around a candidate holds up.

That used to be enough, because faking the paperwork was difficult. It is not difficult anymore.

The documents behind these checks are now cheap to buy and easy to fake. That means a candidate can be fake while every document attached to them comes back clean.

The documents are now for sale

Start with identity, there is now a huge established market for stolen identities, sold on the dark web. A full identity pack, a government ID, a matching selfie, and the personal details to go with it, sells for as little as $30. US profiles go for $45 to $100.

A 2024 study of two major dark-web markets shows how far this has gone. The best-selling products were not single documents. They were full bundles of a real person’s data, sold as “fullz” or ready-made identity packs. These bundles sold far more than any individual ID or supporting document. About 80% of the listings were digital files, which means they could be copied, edited, and reused again and again.

Most of what sells is US identities. They made up 65% of all sales, and most of those sales were personal-data bundles. In other words, the market is not just selling documents. It is selling the raw material needed to build a believable person.

The market has also adapted to the checks themselves. Packs are designed to pass screening, and newer ones include tools to fake a live video call. Analysts who track this market have warned that asking for more documents and selfies does not solve the problem, because the market simply keeps expanding to match the next check.

That is the issue with document-based verification. Once the document becomes a product, verifying the document is no longer the same as verifying the person.

What a fully documented fake looks like

Cheap documents are only the first layer. The bigger problem is what happens when those documents are plugged into a full hiring operation.

Investigators recently tracked one operation, a North Korean ring run like a company, that turned this into a full system. It sent around 170,000 applications to US employers and turned them into real jobs. It worked because the ring had an answer ready for every stage of hiring.

• Identity - The identities were bought and real, taken from actual US residents, with the photos edited to match whoever would show up on camera. One person often ran several identities at once and applied during US work hours, so the timing looked normal.
• Interview - Software listened to the interviewer and typed out answers on a second screen as they spoke. Voice tools cleaned up the speaker's accent, and rehearsed details, like the local weather, handled the small talk. When someone could not pass on camera, a US-based helper sat in as the employee while the real worker fed them answers from abroad.
• References and employers -  Ring members posed as each other's former managers and coworkers, reading from scripts that matched the dates and titles on each resume. When a past employer needed to exist, the ring set up a real company with a working website. So a reference call or an employment check went straight back to the ring.
• Location and equipment - They used home internet connections and VPNs so their activity looked like it came from inside the US. After an offer, the company laptop was shipped to a US address, where a paid local helper kept it running next to others in what investigators call a laptop farm. The real worker controlled it from overseas. Even a required drug test was handled locally.

Every check a normal hiring process runs was passed.

This is not just a problem for careless employers. Security leaders at Mandiant say that almost every Fortune 500 company has received applications from these workers, and that hundreds have hired them without knowing. When even companies with strong security teams are being fooled at the hiring stage, the problem is in the process itself. It rewards the wrong thing: it lets anyone whose paperwork holds up pass as a real person, when all it proves is the documents are real, not the person.

So…what actually stops it

There is a useful tell in the black market for identities. Raw identity data is cheap, but a pre-verified account, one that has already cleared a live human check, sells for roughly ten times as much.

Even people who defeat these systems for a living find the live, human step the hardest and most valuable to get past. That is the step hiring should be built around, and it is the one it relies on least.

So hiring has to settle a different question: is this a real, specific person, and are they the one moving through the process? Records cannot answer that, because the answer does not live in any document.

The evidence of a person is the life behind them. A real human is an accumulation. Over years they leave a trail across contexts that were never coordinated and have nothing to do with getting a job: a personal email tied to receipts and subscriptions, social accounts with history and real connections, a phone number with a past, a presence in corners of the internet no recruiter will ever look at. The average American carries more than 150 online accounts, and most of them have nothing to do with work. That breadth is the signal, and it is the one thing the market cannot sell.

A fabricated persona is the reverse. It is built to be hired, so it exists where a recruiter looks, in a resume, a profile, a clean work history, and thins out everywhere else. It has no life outside the application, because it was created for the application.

This is the problem we built Tofu to solve. Tofu confirms that a candidate is a real, specific person at the start of hiring, independent of the documents and references arranged around them, so the decision rests on the person rather than the paperwork. If you want to see what might be slipping through your hiring pipeline, come talk to us.