What to do when a new hire is not the person you interviewed
On this page
If the person who started work is not the person you interviewed, secure first and decide second. Have security quietly limit the new hire's access and preserve logs, stop any equipment or payroll changes, then compare the person with the Form I-9 documents and your interview recordings or notes. Bring HR, legal and security together to decide the employment action, tell the staffing agency or client if one is involved, and report suspected organized schemes to the FBI at ic3.gov. Do not confront the person until that plan exists. This reflects FBI and USCIS guidance as of October 2026 and is not legal advice.
This page starts where what to do if a candidate used a proxy in an interview stops: that playbook covers a suspicion during the hiring process, before anyone has system access. After the start date the order changes, because the person is now inside your systems.
Which situation are you dealing with?
"Not the person we interviewed" covers three different problems. Work out which one you have, because the evidence and the risks differ.
| Situation | What you notice | What it usually means | First concern |
|---|---|---|---|
| Proxy interview | The starter matches their ID documents, but cannot do what "they" described in interviews; the voice or face differs from the recordings | Someone else sat the interviews for the real hire | Misrepresentation and capability |
| Bait and switch | The person in interviews matched the candidate, but someone different turned up using the same identity | Identity fraud, possibly with stolen or forged documents | Security, Form I-9 and identity |
| Hidden worker | The person on camera is the hire, but the work, logins or writing style point to someone else doing the job | The job is being subcontracted or run remotely by another person | Security, data access and contract |
The FBI has described all three. Its July 2025 announcement warns that "sometimes an individual is employed to pass the initial interview, but the on-the-job work is completed by a different individual," and its October 2026 announcement says North Korean IT workers increasingly take jobs and then hire freelancers to do the work "for a fraction of the total salary." Whether or not an organized scheme is behind your case, the response that protects you is the same.
What should you do in the first hours?
- Tell security before anyone talks to the person. The FBI's January 2025 announcement reports that North Korean IT workers, after being discovered, have extorted companies by holding stolen data and code hostage, and its October 2026 announcement reports that, after termination, some have made death threats against former managers and their families. Access should be limited before the person learns of the concern.
- Preserve evidence. The FBI asks victims to "evaluate network activity from the suspected employee and their assigned device(s)." Keep logs, repository activity, and messages; do not wipe the laptop.
- Freeze changes. No new equipment shipments, no address changes and no bank account changes until this is resolved. The FBI tells employers to watch for changes in address or payment platforms around onboarding.
- Limit who knows. HR lead, employment counsel, security, the hiring manager, and the agency contact if there is one. Rumors that reach the person tip them off; rumors that reach the team can defame someone who turns out to be innocent.
- Plan for safety. If anyone receives a threat, the FBI's advice in October 2026 is to call 911.
How do you compare the person with your records?
You are looking for facts that two or more people can check, not impressions.
- Form I-9. At hire, the employer examines documents to see whether they reasonably appear to be genuine and "relate to the person presenting" them, according to USCIS's Handbook for Employers. Ask who did the examination, whether it was in person or by remote examination, and whether copies were kept. If copies exist, compare their photos with the person now working.
- E-Verify, if you use it. Photo matching applies when an employee presents a U.S. passport or passport card, a Permanent Resident Card or an Employment Authorization Document. E-Verify's own photo matching page says the employer compares the photo E-Verify shows with the photo on the document, "not with the actual employee." So photo matching tests the document, not who interviewed.
- Interview recordings and transcripts. If you recorded with consent and still hold the recordings under your retention policy, compare voice, appearance and specific claims. If you did not record, collect each interviewer's notes as written, before anyone discusses the case. Whether and how recording is lawful is covered in is it legal to record a job interview.
- The first-round interviewer. A short video call with the person who ran the screen, framed as a routine check-in, is often decisive.
- Specific knowledge. Ask about details only the interviewee could know: "In your second interview you described the reporting rebuild; walk me through who approved the schema."
- Payroll and accounts. The FBI suggests comparing payment accounts across employees and flagging matching banking details, and checking whether the same phone numbers or emails appear on other applications.
Write the comparison down in neutral terms: what was compared, by whom, and the result. Leave out labels and guesses about nationality or motive. The EEOC's national origin guidance is a reminder that accent and appearance are not evidence.
Who decides, and what are the options?
HR owns the employment decision, counsel advises on how, and security decides what access the person keeps in the meantime. The usual outcomes:
| Finding | Typical action | Watch out for |
|---|---|---|
| Same person after all | Restore access, close the matter, remove the concern from the file | A cleared suspicion should not follow the employee |
| Proxy interview: the starter is who their documents say, but someone else interviewed | Employment decision under your policies and any contract, based on the misrepresentation | State law, contracts, and FCRA notice steps if a background report played a part |
| Bait and switch: the starter is using someone else's identity | Remove access, end the employment, report | Form I-9 consequences; the person whose identity was used may be a victim |
| Hidden worker: someone else is doing the job | Remove access, investigate data exposure, then the employment decision | What data and code left the company, and through which devices |
Two legal points to raise with counsel. First, federal law makes it unlawful to continue employing someone "knowing the alien is (or has become) an unauthorized alien" (8 U.S.C. 1324a(a)(2)); an identity switch may or may not mean that, which is why the I-9 facts matter. Second, if any part of the decision relies on a report from a background screening company, the FTC says you must give a pre-adverse action notice with a copy of the report and a summary of rights before acting; see the FCRA background check process. Do not use an SSA number check to make the decision, either; SSA's SSNVS may not be used for punitive action, as explained in can employers use SSNVS to screen applicants.
Who needs to be told?
- The staffing agency, if the person came through one. Same day, facts only, and ask what identity checks they ran before the assignment. The FBI's January 2025 guidance tells companies to verify that third-party staffing firms conduct robust hiring practices and routinely audit them.
- Your client, if you are the agency and the person is on assignment. Their security team needs to act on their systems, not yours.
- The FBI, for suspected organized schemes, at ic3.gov or a local field office. The October 2026 announcement asks for any street address that received a work device, names, phone numbers, emails, bank accounts, IP addresses and profile links, plus images, messages and documents.
- The job board or professional network the application came through.
One caution: the name on the application may belong to a real person whose identity was stolen, and the FBI warns that relying on name-based lists risks harming identity theft victims. Record the devices, phone numbers, emails and documents tied to the incident instead.
What should the record say?
Employee: [name as hired], start date [date], role [role]
Concern: Raised [date] by [name]: [observed fact, e.g. voice and
appearance differ from recorded interview on [date]]
Access: Restricted [date/time] by [security contact]
Comparison: I-9 documents reviewed by [name]; recording of [round]
reviewed by [names]; result: [match / no match]
Decision: [action] on [date] by [HR lead], advised by [counsel]
Notified: Agency [date]; client [date]; FBI IC3 [date, reference]How do you stop it happening again?
- Make day one a checkpoint. The person who turns up, on camera or in person, is compared with the interview record and the identity documents by someone who met the candidate.
- Verify at more than one stage. The FBI's October 2026 guidance calls for "identity in depth": layered checks through the employment lifecycle rather than a single indicator. The stage-by-stage version is the candidate identity verification checklist, and the signs to watch for are in how to spot candidate identity fraud.
- Check where remote hires work. Shipping equipment only to the address on the ID, and the other location checks, are in how to verify a remote candidate's location.
- Keep one thread across rounds. The same recruiter at screen and final, and interview records that later interviewers actually read, make a switch visible before an offer.
- Write it into agency contracts. Identity checks before assignment and a photo match on day one; see how to verify staffing agency workers.
Questions people ask
What should we do if the person who started isn't the person we interviewed?
Do not confront them first. Have security quietly limit system access and preserve logs, then compare the person with the Form I-9 documents and your interview recordings or notes, and bring HR, legal and security together to decide. If an organized scheme is suspected, report it to the FBI at ic3.gov. Tell the staffing agency or client if one is involved. This is general guidance, not legal advice.
Can we fire a new hire who had someone else do their interview?
Often yes, but how depends on your policies, any contract, state law and whether the decision relies on a background check report, which brings Fair Credit Reporting Act notice steps. Base the decision on documented facts, such as a failed identity check or records that do not match, and involve HR and employment counsel before acting.
Should security or HR act first when a new hire may be an impostor?
Security first. The FBI has reported North Korean IT workers copying company code and extorting employers after being discovered, and in October 2026 it reported death threats against former managers after termination. Restrict access and preserve evidence before anyone tells the person what you suspect, then plan the conversation with HR, legal and security.
Does E-Verify photo matching catch a new hire who is not the person we interviewed?
Not directly. E-Verify photo matching asks the employer to compare the photo E-Verify displays with the photo on the document the employee presented, not with the employee. It can expose a forged document, but if the documents are genuine and belong to the person who started, the problem is the interview, and only your interview records can show it.