The short answer: Most small businesses secure the network and forget the door where new people come in. A fraudulent candidate can pass an interview, get an offer, receive a laptop and work email, and be inside company systems before anyone verifies who they are. The fix is not more suspicion of applicants. It is one coordinated workflow: verify identity before provisioning access, start new hires with limited permissions, assign one person to own the HR-to-IT handoff, and remove access on the same schedule you grant it.
1. The part of the story nobody plans for
You have a strong candidate. The interviews went well. References checked out. The offer is signed. HR sends over a start date.
Someone creates an account, orders a laptop, and sends the new hire their credentials. That is a normal, well-run onboarding process. Nothing in that sequence necessarily involves anyone confirming that the person receiving access is the person the company intended to hire.
The access arrives before the doubt does.
The same sequence can happen with contractors and remote hires. Remote work makes one part of it easier to overlook: equipment can be shipped to an address no one has confirmed belongs to the new hire.
This is not a reason to treat candidates as suspects. It is a reason to make identity verification part of onboarding, just like setting up a mailbox or confirming a start date.
2. The short answer
The risk lives in the handoff. HR manages identity risk before the hire. IT and security typically take responsibility once accounts and devices are being set up. If nobody owns the transition between those steps, a request can be treated as legitimate before the person behind it has been verified.
A practical fix is to make the sequence explicit: verify identity first, provision only the access needed to start, record what is granted, and name the person responsible for closing the handoff.
3. What the research actually found, and what it does not say
HYPR’s September 15, 2026 State of HR Identity Fraud Detection is vendor-backed research. That matters when interpreting its findings.
The report found that 98% of fraudulent hires in the cases it examined had received active corporate credentials and internal network access by the time they were detected. It also found that 68% of cases were uncovered through human observation and intuition rather than automated controls. The research combined surveys of 500 U.S. HR leaders and 950 IT security decision-makers across the U.S., EMEA, and APAC.
Be precise about what the 98% figure means: it describes a fraction of detected fraud cases, not the share of all job applicants who are fraudulent. It does not mean 98% of applicants are fake. Most applicants are not fraudulent, and this is not a reason to judge candidates by appearance, background, or assumptions.
The report points to an ownership void. HR manages identity risk before the hire. IT and security usually assume responsibility once credentials are issued. The gap is the handoff between them.
Security tools can miss that window because the person may not yet be an employee in the systems those tools monitor. And account-provisioning processes generally act on an internal request. If the request appears approved, the system does what it was asked to do.
The issue is not that HR or IT is failing. It is that the process often has no named owner between the two.
4. Why small businesses are more exposed
A large company may have dedicated recruiting staff, a formal HR system, and an established background-check process. A 12-person business may have an owner forwarding a resume to the person who handles accounts and devices.
That is not carelessness. It is what happens when a small team has to keep the business moving. But a handoff made through a quick conversation or email is easy to miss, and difficult to audit later.
The potential impact can also be broader in a small company. With fewer people and simpler systems, a new employee may receive access to much more than their specific role requires. Hiring fraud can also be relatively cheap and scalable for an attacker who can apply to many openings.
| What the fraudster needs | Why your current process gives it to them |
|---|---|
| A plausible resume and interview presence | Interviews are conversations, not identity checks. |
| A work email address | It may be created on request, before identity verification. |
| A laptop shipped to an address | Nobody may confirm the address belongs to the person. |
| Credentials to internal systems | They may be provisioned early to make day one easier. |
| Access to payroll, banking, or client data | Small companies may grant broad default permissions. |
5. The five things that close the gap
You do not need a large security department to fix this. You need a consistent process.
-
Verify before you provision. Complete identity verification, and any applicable background check, before creating the account. This is the highest-value change because it closes the gap before access exists. It may add a short delay to onboarding. That is better than granting access first and asking questions later.
Use the same verification process for every candidate, consistently and in line with applicable laws. The tool is verification, not judgment. It should not become a reason to single out applicants or make assumptions about them.
-
Ship equipment to a verified address. Confirm the shipping address through your normal verification process. On day one, confirm receipt with the new hire directly, in person or by video. This is a straightforward way to make sure the device reached the person it was intended for.
-
Limit access at first. For the first 30 days, start with email, calendar, and the system the person needs to do their job. Add other access when a manager requests it in writing. This limits the damage if a hire is fraudulent, and it also reduces the risk of mistakes while a legitimate new employee is still learning.
-
Name one owner for the HR-to-IT handoff. Pick one person responsible for making sure identity verification is complete, the right accounts are requested, and access is recorded. Put the steps on a checklist. Do not leave them to whoever happens to remember.
-
Require multi-factor authentication from the first login. Enroll the new hire on day one using a device or method your company controls. A password by itself should not be enough to enter business systems.
One more safeguard: Separate the permission to read financial information from the permission to change bank details or approve payments. Those actions should require a second set of eyes, especially for a new hire.
6. The mirror: onboarding and offboarding are the same problem
The gap that lets someone in can also let access remain after they leave. If onboarding is informal, offboarding may be informal too.
Here is a practical test: can you list every system a departing employee or contractor could access, when that access was granted, and when it ended?
If you cannot answer that for someone who left in the last year, your onboarding and offboarding processes both need attention. This is a process check, not a reason to panic. The point is to make access visible and manageable.
7. Which stage are you in?
- Stage one: Onboarding happens through messages. Someone sets up what seems necessary on day one. There is no checklist, verification step, or record of what access was granted.
- Stage two: There is a rough process, and one person usually handles hires and departures. The details live in their head and inbox. It works until they are away.
- Stage three: There is a written day-zero checklist, identity verification before provisioning, limited initial access that expands on request, one named owner for the HR-to-IT handoff, and a final access review when someone leaves.
You do not have to build a complicated system to get to stage three. A shared checklist and a clearly responsible person are a good start.
8. Where we come in
We handle account creation, device setup, multi-factor enrollment, and access removal. The useful part is not a particular product. It is having an owner and a record for the handoff. When someone joins, access is granted on a schedule and documented. When someone leaves, it is removed the same day, and we can show you what they had.
For a small business that needs to show an insurer or auditor who could reach what, and when, that record matters. Our cybersecurity and managed IT services support businesses looking for Managed IT services Phoenix owners can rely on without building an internal IT department.
9. Takeaways
- Verify identity before creating an account, not after.
- Give new hires limited access for the first 30 days, then expand it on written request.
- Name one person to own the HR-to-IT handoff, and give them a checklist.
- Require multi-factor authentication from the first login.
- Test yourself: can you list every system a person who left last year could access, and when that access ended? If not, fix onboarding and offboarding together.
If you want a second set of eyes on your onboarding and access process, book a short intro call. We can talk through what you have in place and where a simple handoff checklist could help.
