Identity Farming: Lock One Identity to One Candidate

You usually do not catch identity farming in the first week because every individual step looks valid. The farm succeeds by staying below thresholds and exploiting tool boundaries: ATS sees a candidate, assessment sees a session, video tool sees a participant, and none of them agree on "who" completed the work. Watch for these operator signals: - Many candidate records with different names but a tight cluster of devices, networks, or timing. - High assessment velocity: start to submit times that are consistently optimized, even across different seniority levels. - "Perfect" handoffs: AI screen responses that read like one voice across multiple candidates, followed by inconsistent live interview performance later.

Identity farming creates three kinds of funnel leakage that show up in RevOps metrics even if HR never labels them as fraud: - Capacity burn: interviewer time gets spent validating a persona, not evaluating a person. - Conversion distortion: you optimize your funnel on fake signal, then wonder why offer accept or ramp metrics degrade. - Customer trust debt: if a bad hire mishandles data, misses delivery, or triggers an audit finding, Sales inherits the conversation. One hard stat to calibrate risk appetite: 31% of hiring managers say they have interviewed a candidate who later turned out to be using a false identity (Checkr, 2025). Directionally, this suggests the problem is not rare in manager experience. It does not prove prevalence in your industry, nor that every case is identity farming versus other identity issues.

If you do not name owners, identity farming becomes a blame carousel across TA, Security, and hiring managers. Recommended operating model: - Recruiting Ops owns workflow design in the ATS and the SLA for exceptions. - Security owns risk policy, retention rules, and audit readiness. - Hiring managers own final decisions, but only using Evidence Pack artifacts, not gut feel. What gets automated vs reviewed: - Automated: passive signal scoring, duplicate cluster detection, and step-up triggers. - Manual review: only the high-risk tail, with clear dispositions (approve, step-up, reject, request retry). Sources of truth: - ATS is the record of candidacy, stage, and decision. - Verification service is the record of identity state transitions and evidence hashes. - Interview and assessment systems are the record of session integrity signals (joined-from, timing, proctor flags).

Identity farming is best stopped by binding identity to each high-leverage moment, not by repeating the same check everywhere. Think in layers, with passive signals as the first line of defense and step-up checks reserved for risk. Layer 1: Passive signals (low friction) - Device fingerprint consistency across candidates (same device, many identities). - Network anomalies: repeated IP ranges, hosting providers, VPN patterns, impossible travel signals. - Behavior telemetry: copy-paste bursts, tab switching, focus loss, unusually uniform response times. Layer 2: Session binding (moderate friction) - Re-auth at assessment start: quick face match and liveness to confirm the verified person is present. - "Same person" check at submission: lightweight voice or face confirmation when risk stays elevated. Layer 3: Step-up verification (high friction, rare) - Document + face + voice bundle when cluster detection indicates farming behavior. - Human review with side-by-side evidence, not raw biometric storage. Important: verification is a continuous state. A candidate can be Verified at apply, Elevated during assessment, and Cleared again after a successful step-up. Treat it like access management.

• One verified human must map to one ATS candidate record at a time. Multiple records linked to the same biometric match is an automatic Elevated state, not an instant rejection. - Ensure AI screens and coding assessments emit consistent session IDs and device/network metadata so you can correlate across tools. - Before assessment start and before submission. This prevents the farm from swapping in the real person after the work is done. - If ID will not scan or liveness fails, offer a guided retry and a scheduled live verification slot. Do not strand legit candidates in limbo. - Reviewers need a decision tree: what evidence is sufficient, when to request re-capture, when to escalate to Security, and how to document outcomes. - Weekly exception report: top device clusters, repeated network blocks, highest risk stages, and time-to-clear elevated candidates.

This example policy shows how to detect likely identity farming clusters and trigger step-up verification only when warranted. It assumes IntegrityLens events land in your analytics warehouse or SIEM via idempotent webhooks.

• Treating verification as a single gate at apply, then assuming the same person took the test. - Auto-rejecting every anomaly, which trains fraudsters and increases false positives that hurt funnel velocity. - Letting evidence live in screenshots and Slack threads instead of an ATS-linked Evidence Pack.

IntegrityLens AI is built for teams who need one defensible hiring pipeline instead of stitched-together point solutions. It combines ATS workflow + biometric identity verification + fraud detection + AI screening interviews + coding assessments, so identity state follows the candidate across stages. In this architecture, TA leaders and recruiting ops teams configure the workflow and exception SLAs, while CISOs define policy thresholds and audit controls. IntegrityLens supports Risk-Tiered Verification, Evidence Packs tied to the ATS record, Zero-Retention Biometrics options, and Idempotent Webhooks to feed your warehouse or SIEM. The goal is simple: keep the default path fast, and only slow down candidates when passive signals justify it.

For RevOps, the win is not catching every bad actor. It is running a process that is fast, consistent, and explainable under scrutiny. Track these metrics weekly: - Step-up rate by role and source (to spot targeted attacks or mis-tuned thresholds). - False positive rate from manual review outcomes (to prevent over-blocking). - Time-in-elevated-state (to protect candidate experience and conversion). - Cluster recurrence: repeated device/network groups after controls ship (to validate deterrence). - Evidence Pack completeness rate (audit readiness).