Hiring fraud is the identity risk that arrives before an employee's first day. Most organizations don't measure it. Most balance sheets don't carry it. And yet the cost is real, growing, and in some cases catastrophic.
Our research report, What Unverified Identity Costs Enterprises Every Year, quantifies that cost across three dimensions. Here's what we found.
The fraud rate has climbed. The legal exposure has climbed faster.
According to a Gartner survey, candidate fraud makes up roughly 25% of application volume in remote technology roles in 2026. Most of that comes from automated AI-generated applications and resume fraud. A smaller and far more dangerous fraction comes from sophisticated identity impersonation.
Mandiant's M-Trends 2026 report documents that North Korean IT worker operations remained a persistent insider threat throughout 2025, with a median dwell time of 122 days before detection. Some cases persisted undetected for over a year.
The U.S. Treasury, FBI, and DOJ have all been explicit about the threat. State-sponsored operatives are using AI-generated profiles, deepfake interview tooling, and U.S.-based laptop farms to embed themselves into Western corporate payrolls. A single 2025 federal case named 309 U.S. companies that had unknowingly placed North Korean operatives on payroll, including Fortune 500 companies in technology, aerospace, automotive, and media.
The bill comes in three parts.
The first is application authenticity. Investigating suspect applicants including cross-referencing profiles, verifying employer history, validating headshots, runs to roughly 2,600 recruiter hours per year at a typical enterprise. At a fully loaded rate of $43 per hour, that's approximately $112,000 annually. The organization absorbs that cost whether or not it catches a fraudulent hire.
The second is fraudulent hire economics. A fraudulent hire draws a salary against the 122-day median dwell time, runs through a ramp period where productivity is effectively zero, and leaves a vacancy that has to be backfilled. Salary paid runs to roughly $625,000. Productivity loss and vacancy costs add another $415,000. Total annual cost for a typical enterprise: roughly $1.08 million.
The third is OFAC sanctions exposure. Civil penalties for paying a sanctioned individual are strict liability under federal law. Intent does not matter. Awareness does not matter. The penalty runs up to $377,000 per paycheck issued, and every paycheck is treated as a separate violation. A single fraudulent placement over the 122-day median dwell time generates roughly nine paychecks before detection. That is a maximum exposure of $26.7 million per event, before any criminal exposure or remediation cost.
Has your organization priced this exposure?
Our research breaks down the cost of hiring fraud and other identity risk dimensions across six industries.
