Should we block all VPN traffic to stop proxy interviews?

No. Blocking VPNs tends to spike false positives and creates an exception factory. Treat VPN as a medium-risk signal and require step-up verification at interview join or assessment start, then decide based on compounded evidence.

What is the fastest place to add network reputation without slowing the funnel?

At interview join and assessment start. Those moments protect your highest-cost activities (panels and proctored work) and let low-risk candidates move with minimal friction.

Do we need to store IP addresses for audits?

Usually not. For most audit and dispute needs, storing the derived category, timestamps, policy version, and a salted hash of the IP is sufficient. If raw IP retention is required, define a short retention window and strict access controls.

How do we prevent discrimination concerns with geo and network signals?

Use network reputation to route verification steps, not to reject. Document that the control is about process integrity, apply it consistently across roles, and maintain an appeal and fallback flow for legitimate edge cases.

Verification-architecture · Jan 21, 2026 · 10 minute read

Network Reputation Signals That Stop Remote Hiring Fraud

A CFO-ready verification architecture playbook for using VPN, Tor, and proxy detection as a trust-score input without creating funnel drag or privacy debt.

Dr. Aris Vlahos

Chief Scientist, Identity

Aris researches biometric verification, liveness detection, and anti-spoofing at scale.

Network reputation is not a rejection reason. It is a routing signal that keeps expensive interview time reserved for verified humans.

Back to all posts

Quarter-close hiring incident you cannot expense away

You approve a fast-track requisition because the revenue plan depends on it. The candidate clears screening instantly, insists on remote-only, and joins interviews from a "stable" connection. The team loves them. After start date, IT sees logins hopping across IP ranges and geographies. Security opens an investigation and finds the network fingerprints from the interview sessions match known residential proxy infrastructure. Finance now has a payroll clawback, legal exposure, and an avoidable productivity hit. By the end of this playbook, you will be able to treat network reputation as a first-line passive signal that raises or lowers a trust score, triggers step-up verification in under three minutes when needed, and leaves an audit-grade Evidence Pack for every exception.

Why CFOs should care about VPNs, Tor, and proxies

Network reputation is not a cybersecurity hobby. It is a control that protects three things Finance owns indirectly: speed (cycle time), cost (wasted loops and rework), and reputation (a bad hire that turns into an incident). One real-world reference point: Pindrop reports that 1 in 6 applicants to remote roles showed signs of fraud in one hiring pipeline. Directionally, that implies remote funnels can contain material risk even before you get to interviews. It does not prove your company has the same rate, or that every flagged applicant is malicious. It does justify instrumenting low-friction, privacy-preserving signals early in the funnel so you can measure your own baseline.

Can: detect high-risk routing patterns (Tor exits, known data center VPN ranges, residential proxy ASNs) and unstable device-network behavior.
Cannot: prove identity mismatch on its own. Treat it as a risk multiplier that routes the candidate into step-up verification, not an auto-reject.

Default to "fast path" for low-risk sessions so your pass-through rate stays high.
Reserve human review for compounded signals to avoid reviewer fatigue and unplanned recruiting spend.

Signal design: from raw network data to a trust score

Operators get value when signals are consistent, explainable, and tunable. Start with coarse buckets, then refine weights based on false positives and downstream outcomes. Recommended core signals (passive first): device fingerprint stability, IP reputation category (clean, VPN, Tor, residential proxy, unknown), ASN type, geo consistency across sessions, latency jitter patterns during interviews, and velocity (rapid IP switching). Scoring rule of thumb: single weak signals should not dominate. Instead, use compounding logic: "VPN alone" might be medium risk, but "VPN + geo mismatch + repeated device reset" becomes high risk and triggers step-up checks.

Low risk: clean network reputation + stable device + consistent geo. Action: proceed with normal flow.
Medium risk: VPN or unknown reputation with otherwise stable behavior. Action: step-up at interview join or assessment start.
High risk: Tor or residential proxy, or repeated IP switching. Action: step-up immediately before any live interview and restrict retakes until verified.

A policy you can ship: network reputation as a trust-score input

This policy pattern is designed to be auditable. It assigns weights, defines step-up actions, and caps manual review so your recruiter queue does not become an unbounded cost center. Key architecture choice: store derived outcomes and evidence references, not raw IP addresses, unless Legal and Security explicitly require it for a defined retention period.

Implementation steps that preserve speed and defensibility

Define the measurement points: capture network reputation at application submit, interview join, and assessment start. Verification is a continuous state, so you detect changes instead of trusting the first event.
Normalize vendor outputs: if you use multiple reputation sources, map them into a single internal taxonomy (clean, vpn, tor, residential-proxy, unknown) so thresholds do not drift across teams.
Add step-up checks only when risk justifies it: IntegrityLens-style Risk-Tiered Verification means low-risk candidates see minimal friction. Medium and high risk candidates see document + face + voice verification, typically 2-3 minutes end-to-end, before the interview starts.
Build fallbacks that keep throughput high: handle legitimate travel, corporate VPN policies, and ID scan failures. Offer a live fallback path (for example, assisted verification) with a tight SLA so strong candidates do not churn.
Wire Evidence Packs automatically: log the trust score, signal categories, policy version, timestamps, and reviewer actions. Finance cares because this is what survives audit findings and dispute escalations.
Tune weekly, not yearly: track false positive rates, manual review volume, and stage conversion deltas by risk tier. Adjust weights and triggers cautiously and keep a policy changelog.

Corporate VPN exception: allowlisted org domains or invitation-only roles can permit VPN but require liveness.
Traveling candidate: if geo changes but device is stable, route to a light step-up instead of a hard block.
ID scan failure: provide an alternate doc capture flow and prevent infinite retries that can be exploited.

Queue cap: if manual review backlog exceeds your SLA capacity, degrade to a safer automated step-up, not a recruiter guessing game.
Two-person rule for rejections: require Security sign-off when rejecting based on network-related signals plus identity mismatch evidence.

Anti-patterns that make fraud worse

Auto-rejecting all VPN traffic, which drives legitimate candidates to workarounds and inflates false positive rates. - Letting recruiters adjudicate technical network evidence in Slack, creating inconsistent decisions and zero audit trail. - Storing raw IP history forever "just in case," which increases privacy and breach impact without improving detection quality.

Where IntegrityLens fits

IntegrityLens AI, "Verify Candidates. Screen Instantly. Hire With Confidence.", is built to make network reputation actionable inside the hiring funnel, not bolted on as a security sidecar. - ATS workflow: stage gates and routing rules based on trust score and risk tier. - Biometric identity verification: document + voice + face with typical 2-3 minute completion, before interviews. - Fraud detection: passive signals (device, network, behavior) and step-up triggers tied to Evidence Packs. - AI screening interviews: available 24/7 to reduce scheduling delays while keeping identity state consistent. - Technical assessments: 40+ programming languages with policy-based access and retake controls. Used by TA leaders, recruiting ops, and CISOs who need one defensible pipeline instead of tool sprawl.

What to show Finance: controls, not hype

A CFO does not need another dashboard. You need a control that is measurable and defensible. Operational metrics to review monthly: percent of candidates routed to step-up, manual review volume, SLA adherence, false positive rate (appeals upheld), and downstream quality flags (for example, onboarding access anomalies). Governance framing: publish a short policy that network reputation is used to protect process integrity, not to infer protected traits. Document the appeal flow and ensure consistent application across roles.

We reduced identity and proxy-interview exposure by adding passive network checks and targeted step-up verification.
We preserved candidate experience by keeping the fast path default and applying friction only when risk compounds.
We maintain audit readiness through Evidence Packs and controlled retention.

Sources

Pindrop: "Why your hiring process is now a cybersecurity vulnerability" (stat: 1 in 6 remote applicants showed signs of fraud) https://www.pindrop.com/article/why-your-hiring-process-now-cybersecurity-vulnerability/

Questions to settle before you turn it on

What is your acceptable false positive rate for VPN-related step-ups, and who signs off on changes? Which stages will you treat as "trust resets" (for example, assessment retakes or interview reschedules) that require re-checking network reputation? What is your maximum manual review backlog before you switch to automated step-up to protect SLA and recruiter time?

Related Resources

Key takeaways

Network reputation is a high-leverage passive signal that can trigger step-up checks without accusing candidates.
Treat "bad network" as a risk multiplier, not a standalone rejection reason, to avoid false positives and discrimination risk.
Instrument verification as a continuous state across the funnel, not a one-time gate at application.
Define ownership and SLAs so Finance can forecast throughput and control reviewer fatigue.
Use privacy-preserving storage: keep derived risk and evidence hashes, not raw IPs or biometric media.

Network reputation trust-score policy (risk-tiered)YAML policy config

Drop-in policy structure for classifying VPN, Tor, and residential proxies, scoring trust, and triggering step-up verification while capping manual review load.

Designed for audit: includes policy versioning, evidence fields, and privacy-preserving storage guidance. Store derived categories and hashes, not raw IPs, unless explicitly approved.

policy:
  id: "netrep-trust-score-v1"
  version: "2026-01-21"
  purpose: "Use network reputation as a passive signal to route candidates into step-up verification when risk compounds."
  retention:
    store_raw_ip: false
    store_ip_hash: true
    ip_hash_salt_rotation_days: 30
    store_netrep_category: true
    store_vendor_evidence_ref: true
  inputs:
    events:
      - application_submitted
      - interview_joined
      - assessment_started
    signals:
      - name: ip_reputation_category   # clean|vpn|tor|residential-proxy|unknown
      - name: asn_type                 # residential|datacenter|hosting|unknown
      - name: geo_consistency          # consistent|minor-drift|mismatch
      - name: ip_velocity_10min        # count of distinct ip_hash values
      - name: device_fingerprint_stability # stable|reset|unknown
  scoring:
    base_trust_score: 100
    weights:
      ip_reputation_category:
        clean: 0
        unknown: -10
        vpn: -20
        tor: -60
        residential-proxy: -70
      asn_type:
        residential: 0
        datacenter: -15
        hosting: -25
        unknown: -5
      geo_consistency:
        consistent: 0
        minor-drift: -5
        mismatch: -25
      ip_velocity_10min:
        "0-1": 0
        "2-3": -15
        ">=4": -35
      device_fingerprint_stability:
        stable: 0
        reset: -20
        unknown: -10
  tiers:
    low:
      min_score: 80
      actions:
        - allow_stage_progression
        - attach_evidence_pack
    medium:
      min_score: 55
      actions:
        - require_step_up_verification:
            method: "doc+face+voice"
            expected_time_minutes: 3
            enforce_before: ["interview_joined", "assessment_started"]
        - limit_retries:
            max_verification_attempts: 2
        - attach_evidence_pack
    high:
      min_score: 0
      actions:
        - require_step_up_verification:
            method: "doc+face+voice+live-liveness"
            enforce_before: ["interview_joined"]
        - route_to_manual_review:
            queue: "identity-risk"
            sla_minutes: 60
            backlog_cap: 30
            overflow_action: "auto-step-up-only"   # prevents recruiter guessing
        - attach_evidence_pack
  decisions:
    rejection_rules:
      - name: "Do not reject on network alone"
        rule: "network_signals_only == true"
        action: "prohibit_rejection"
      - name: "Reject requires compounded evidence"
        rule: "(tier == 'high') AND (verification_outcome in ['failed','mismatch'])"
        action: "allow_rejection_with_security_approval"
  evidence_pack:
    fields:
      - candidate_id
      - req_id
      - policy_id
      - policy_version
      - timestamps
      - trust_score
      - tier
      - netrep_category_history
      - ip_hash_history
      - vendor_evidence_refs
      - verification_outcomes
      - reviewer_actions

Outcome proof: What changes

Before

Recruiting and Finance saw unpredictable funnel drag from ad hoc fraud checks, plus expensive late-stage surprises when suspicious network behavior was discovered after interviews or after onboarding started.

After

Network reputation became a passive, always-on input to a trust score. Step-up verification was triggered only for medium and high risk sessions, and every exception produced an Evidence Pack that Security and Legal could review without digging through disparate tools.

Governance Notes: Legal and Security signed off because the design is privacy-first (derived categories and hashed identifiers, not indefinite raw IP storage), access to Evidence Packs is role-based, retention is explicit, and candidates have a documented appeal path when step-up verification fails due to legitimate constraints (travel, corporate VPN, document scan issues).

Implementation checklist

Classify network outcomes (clean, VPN, Tor, residential proxy, unknown) and assign a default risk weight.
Define step-up paths for medium and high risk (document + face + voice, plus live liveness if needed).
Set an explicit manual review SLA and a backlog cap to prevent recruiter work queues from exploding.
Add fallbacks for travel, corporate VPNs, and ID scan failures that keep legitimate candidates moving.
Log every decision into an Evidence Pack with timestamps, policy version, and reviewer actions.
Run weekly threshold tuning based on false positive rate, pass-through rate, and downstream performance flags.

Questions we hear from teams

Should we block all VPN traffic to stop proxy interviews?: No. Blocking VPNs tends to spike false positives and creates an exception factory. Treat VPN as a medium-risk signal and require step-up verification at interview join or assessment start, then decide based on compounded evidence.
What is the fastest place to add network reputation without slowing the funnel?: At interview join and assessment start. Those moments protect your highest-cost activities (panels and proctored work) and let low-risk candidates move with minimal friction.
Do we need to store IP addresses for audits?: Usually not. For most audit and dispute needs, storing the derived category, timestamps, policy version, and a salted hash of the IP is sufficient. If raw IP retention is required, define a short retention window and strict access controls.
How do we prevent discrimination concerns with geo and network signals?: Use network reputation to route verification steps, not to reject. Document that the control is about process integrity, apply it consistently across roles, and maintain an appeal and fallback flow for legitimate edge cases.

Ready to secure your hiring pipeline?

Let IntegrityLens help you verify identity, stop proxy interviews, and standardize screening from first touch to final offer.

Try it free Book a demo

Watch IntegrityLens in action

See how IntegrityLens verifies identity, detects proxy interviewing, and standardizes screening with AI interviews and coding assessments.