False Positives in Candidate Fraud Flags: A Defensible Runbook

The offer is drafted for a senior engineer working on regulated data access. Ten minutes before the final panel, an integrity check flips to "high risk" because the candidate's network looks like a corporate VPN exit node and their webcam feed shows brief compression artifacts. Recruiting wants to keep the slot. Security wants to stop a potential proxy. Legal wants to avoid a defamation-adjacent accusation. Audit wants to know which control made the call and where the evidence is. The fastest path that reduces risk is not a gut decision. It is a predefined step-up path: pause privileged steps, collect a minimal Evidence Pack, run a bounded set of additional checks, and make a documented decision that is consistent across candidates.

False positives create two failure modes: (1) you wrongfully reject strong candidates, and (2) you normalize sloppy decision-making that cannot be defended when a true fraud slips through. Both show up later as audit findings, escalation churn, and brand damage. One data point helps frame why you need a controlled process. Checkr reports that 31% of hiring managers say they have interviewed a candidate who later turned out to be using a false identity. Directionally, that implies identity deception is common enough to warrant controls in many orgs. It does not prove your specific funnel's fraud rate, nor does it specify role type, industry, or the effectiveness of any single detection method. You still need local measurement and adjudication discipline.

Put this in writing before you tune models or add more signals. When ownership is vague, reviewers improvise, and that is where false positives turn into inconsistent treatment. Recommended operating model: Recruiting Ops owns the workflow and SLAs, Security owns control design and monitoring, the Hiring Manager owns job-relevant assessment outcomes, and Legal or Compliance reviews the policy language and adverse-action thresholds. Automation should gate and route, not convict. Systems of truth should be explicit. The ATS is the system of record for status and decisions. The verification service is the system of record for identity and liveness outcomes. The interview and coding platforms are the systems of record for performance artifacts. Everything writes back to the ATS with immutable timestamps and reviewer identity.

A fraud flag is not a single event. It is a classification produced from one or more integrity signals that indicate elevated likelihood of identity mismatch, proxy participation, or policy circumvention. Your governance task is to define what the flag can and cannot do in the funnel. The control objective is simple: do not allow unverified or high-uncertainty identities into privileged steps (live technical interviews, access to proprietary codebases, or offer stages) without either resolving uncertainty or logging an approved exception.

Use a three-lane model that keeps the funnel moving while controlling risk. Start with the conclusion: most flags should not cause rejection. They should cause step-up verification or a short manual review with a standardized evidence template. Step 1: Freeze privileged progression, not the entire candidacy. Move the candidate to a temporary "Integrity Review" stage in the ATS with an SLA (for example, same business day) and a clear internal owner. Step 2: Confirm the basics automatically. Check for low-cost inconsistencies: document match result, face match score banding, liveness pass/fail, and whether the same identity was verified earlier in the pipeline. Record outcomes, not raw biometrics. Step 3: Run step-up verification for medium risk. Examples: a second liveness check, a short voice phrase, or a re-capture under different lighting. Keep it bounded to 2-3 minutes so you do not create candidate drop-off. Step 4: Build an Evidence Pack. Attach time-stamped events, decision points, and reviewer notes. Include what was observed and which policy threshold was met. Exclude raw biometric payloads if your posture is zero-retention biometrics or limited retention. Step 5: Manual adjudication for high risk or unresolved step-up. Require two-person integrity review (Ops plus Security or Compliance) for adverse decisions. This is your control against single-reviewer bias and overconfidence. Step 6: Offer a controlled appeal path. Provide a neutral message and allow a single re-attempt under stricter verification, unless you have strong corroborating evidence of deliberate deception. Step 7: Close the loop. Tag the case as "false positive" or "confirmed fraud" and feed it back into tuning. Track reviewer fatigue signals like queue age and rework rate to prevent drift into blanket rejections.

Below is an example policy-as-config artifact that Security, GC, and Recruiting Ops can jointly approve. It encodes routing, SLAs, Evidence Pack requirements, and an appeal path without embedding sensitive model internals.

These three patterns increase legal risk and make attackers more effective by teaching them your thresholds:

Measure process quality, not vanity conversion. Start with operational metrics you can defend: time-to-resolution for integrity reviews, percent of flags resolved by step-up verification, appeal rate, and adjudication overturn rate. Then add risk signals: number of hires with unresolved identity uncertainty, and counts of repeat attempts per candidate. If you need cost framing, keep it conservative and sourced. SHRM notes replacement cost estimates can range from 50% to 200% of annual salary depending on role. Directionally, that implies a bad hire is expensive enough to justify controls. It does not prove your org will hit the high end, and it does not attribute replacement cost to fraud specifically. Use it as a budgeting context, not a promised savings number.

IntegrityLens AI is the first hiring pipeline that combines a full Applicant Tracking System with advanced biometric identity verification, AI screening interviews, and technical assessments so you can manage the entire lifecycle in one secure platform. For false positives, it matters because you can route flags inside the ATS workflow, step-up verify in under 3 minutes (typical end-to-end document plus voice plus face), and attach Evidence Packs to each decision for audit. TA leaders and recruiting ops use it to keep the funnel moving; CISOs use it to enforce Risk-Tiered Verification and access controls; Legal and Audit get consistent, exportable records. Key capabilities tied to this runbook: