Candidate identity verification checklist: how to verify identity at every stage
On this page
- What does verifying a candidate's identity need to prove?
- Which roles need which checks?
- The candidate identity verification checklist
- Where does each check come from?
- What should you record?
- What legal guardrails apply?
- How do you introduce identity checks without putting off real candidates?
- Questions people ask
To verify a candidate's identity, check at several stages rather than once. At application, confirm the person and their contact details are real and not reused. At a defined interview stage, confirm on live video that the person matches a government photo ID. Before the offer, confirm that the person you interviewed is the person you are hiring, and verify their history through contacts you find yourself. After the offer, complete Form I-9 through your normal process and send equipment and pay only to details that match the ID. Apply the same steps to everyone at the same stage, record facts rather than impressions, and never ask for documents at the first contact. The copy-ready checklist is below, current as of October 2026.
Why these checks matter, and the signs to watch for, are in how to spot candidate identity fraud. If a check fails, follow what to do if a candidate used a proxy.
What does verifying a candidate's identity need to prove?
Four different questions, answered by different checks:
| Question | Checks that answer it |
|---|---|
| 1. Is this a real person with a real history? | Duplicate search, working contact details, consistent profiles, employers that exist |
| 2. Is the person in the interview the person named on the application? | Live video check against a photo ID, or third-party identity verification |
| 3. Is the person who starts the person who interviewed? | Continuity across rounds, comparison at final round and onboarding |
| 4. Are they eligible to work, and where they say they are? | Form I-9, equipment to the ID address, payroll in their name |
Identity proofing has a formal discipline behind it: NIST's SP 800-63A-4 (July 2025) sets requirements for three identity assurance levels for digital services. Hiring does not need to follow it, but the idea is useful: match the strength of the check to the risk of the role.
Which roles need which checks?
| Tier | Typical roles | Checks |
|---|---|---|
| Standard | On-site or hybrid roles with ordinary access | Application checks, camera-on interviews, photo ID at the in-person round, standard onboarding |
| Remote | Fully remote roles with ordinary access | All of the above, plus a live video ID check at a fixed stage and continuity across rounds |
| High risk | Remote roles with access to systems, source code, customer data or money; contract IT through agencies | All of the above, plus an in-person or third-party verified step before offer, independent reference calls, no system access until checks clear |
Whether an in-person round is worth it for your high-risk tier is weighed in should we bring back in-person interviews.
The candidate identity verification checklist
Copy this into your process document and assign an owner to each stage.
CANDIDATE IDENTITY VERIFICATION CHECKLIST Role: ________
Tier: [ ] Standard [ ] Remote [ ] High risk Owner: _______
A. BEFORE YOU POST
[ ] Posting or invitation says which stage includes an ID check
[ ] Recruiters contact candidates from company email; candidates
can confirm the recruiter on our website
[ ] Accommodation route and an alternative verification route exist
[ ] Decided what we store (outcome only, no ID images by default)
B. APPLICATION
[ ] Phone, email, resume text and portfolio searched in our ATS
for duplicates under other names
[ ] Phone number works; email is not shared with another applicant
[ ] Resume, professional profile and portfolio agree on dates,
titles and photo
[ ] Most recent employer exists (found independently)
[ ] Resume checked for hidden text
[ ] Any ATS fraud flag reviewed by a person, not auto-rejected
C. FIRST LIVE CONVERSATION
[ ] Camera on for video calls (announced in advance)
[ ] Two follow-ups on one specific resume claim
[ ] Open questions on location and education, as for everyone
[ ] Note made of voice and appearance for later comparison
D. VERIFICATION STAGE (second interview or before finals)
[ ] Live video check: background effects off, photo ID of the
candidate's choice held to the camera, name and photo compared
[ ] Hand wave in front of face; if location is in doubt, camera
pointed briefly out of a window
[ ] OR third-party identity verification (selfie matched to ID)
[ ] Outcome recorded: verified / not verified / declined, date, by
E. FINAL ROUND
[ ] Same person as earlier rounds (interviewers compare notes)
[ ] High-risk tier: in-person meeting or verified equivalent
F. BEFORE OFFER
[ ] Employment confirmed through contacts we found ourselves
[ ] Education and required licenses confirmed with the issuer
[ ] References spoken to live, by phone or video
[ ] Background check: standalone disclosure and written
authorization obtained before ordering
[ ] Agency candidates: the agency's verification steps on file
G. OFFER TO DAY ONE
[ ] Form I-9 completed after hire, documents chosen by the employee
[ ] Physical examination, or DHS alternative procedure used
consistently (E-Verify employers only)
[ ] Equipment ships only to the address on the ID, signature
required
[ ] Payroll to an account in the employee's name
[ ] No system access until the background check is complete
H. FIRST 30 DAYS
[ ] Manager confirms the same person appears on camera
[ ] IT alerted to unapproved remote-access tools on work devices
[ ] Changes to bank, address or contact details reviewedWhere does each check come from?
The checklist draws on published government guidance and vendor documentation:
- Duplicate searches and open questions on location and education: the FBI's January 2025 warning recommends cross-checking applicants' resumes and contact details against HR records, asking open-ended questions about location and education, and completing as much of hiring and onboarding in person as possible.
- ID held to the camera, notarized proof, signature delivery and bank documents: the FBI and South Korean guidance of October 2023.
- Background effects off, the hand wave, equipment to the ID address and no access before checks clear: the FBI's July 2025 guidance.
- References by phone or video, not only email: Microsoft Threat Intelligence, June 2025.
- Layered checks across the lifecycle, and no reliance on name-based ban lists: the FBI's October 2026 announcement, which also lists remote-access tools to watch for after hire.
- Third-party identity verification: for example, Greenhouse lets candidates verify through CLEAR with a selfie matched to a government ID, and says a failed check does not automatically disqualify a candidate.
- Profile badges as a signal: LinkedIn's identity verification shows a government ID was checked by a partner (CLEAR in the US, Canada and Mexico; Persona and DigiLocker elsewhere). It does not prove the person on your call owns the profile.
What should you record?
Identity check Candidate: ______ Role: ______
Stage: Verification call / final round / onboarding
Method: Live video with ID / third-party service / in person
Date and by: ______
Outcome: Verified / not verified / declined / rescheduled
Notes (facts): e.g. "Name and photo on ID matched; same person as
screen on [date]." No ID numbers, no images.An outcome is usually all you need. Storing ID images or video stills creates data you must protect and may bring extra legal duties. Keep notes factual and free of guesses about motive or background.
What legal guardrails apply?
- Keep the identity check separate from Form I-9. USCIS tells employers not to request employment eligibility verification documents before hiring and to let each person choose which acceptable documents to present. At the interview stage, let candidates choose which photo ID to show, and do not record citizenship or immigration details.
- Remote I-9 examination has conditions. The DHS alternative procedure is for E-Verify employers in good standing and must be applied consistently at a site; see I-9 remote verification. Where E-Verify shows a photo for certain documents, photo matching compares it with the document.
- Background checks carry notice rules. The FTC requires a standalone disclosure and written permission before you get a consumer report, and notices before and after any adverse action. See the FCRA background check process.
- Biometrics may need consent. Illinois' Biometric Information Privacy Act requires written notice and a written release before collecting biometric identifiers such as a scan of face geometry. If a verification tool matches faces, check how it works and where. See BIPA and hiring tools.
- Consistency protects everyone. Run checks by stage and role, never because of a name, accent or nationality; the EEOC's national origin guidance applies, and offer accommodations for candidates who cannot use video.
This checklist is general guidance, not legal advice; rules vary by state and country.
How do you introduce identity checks without putting off real candidates?
Real candidates have their own reasons to be wary, since scammers impersonate employers to collect personal data. Tell them early what will happen and why, show that your recruiters are who they say they are, and keep the check short:
"As part of our process, every candidate who reaches the second
interview does a two-minute identity check on camera: background
effects off, and a photo ID of your choice held up to the camera. We
note that it matched; we don't keep a copy. If you'd prefer another
way to verify, or need an adjustment, just let us know."More on protecting candidates from fake recruiters using your name is in recruitment scams impersonating your company, and on verifying work history in how to verify employment history.
Questions people ask
How do you verify a candidate's identity in a remote interview?
At a stage you announce in advance, hold a short live video check: camera on, background effects off, and a government photo ID of the candidate's choice held up to the camera, compared with the person and with earlier rounds. FBI guidance also suggests asking the person to wave a hand in front of their face, which may disrupt AI-generated video. A third-party service that matches a selfie to an ID is an alternative.
When should you ask a candidate for photo ID?
Not at the first contact. Ask at a defined interview stage, such as the second interview or before final rounds, and tell candidates in advance. Keep this identity check separate from Form I-9: USCIS tells employers not to request employment eligibility documents before hiring, and to let each new hire choose which acceptable documents to present.
Is LinkedIn verification enough to confirm a candidate's identity?
No, though it is a useful signal. LinkedIn's identity badge shows that a partner such as CLEAR or Persona checked a government ID for that profile. It does not show that the person on your video call is the profile's owner, so still compare the person with their ID at a live check.
Can we keep a copy of a candidate's ID or a screenshot of their face?
Keep as little as possible. For an interview-stage check, recording the date, method and outcome is usually enough. Copies of Form I-9 documents follow their own retention rules, and collecting biometric data such as face geometry can require written notice and consent in some states, including Illinois. Check with counsel before storing images. This is not legal advice.