TL;DR
- Unverified identity costs a 15,000-employee organization $79,000 to $150,000 a week.
- The cost shows up at critical moments, including hiring and onboarding, the helpdesk and password resets, and high-risk approvals.
- The FBI now recommends identity in depth, which means verifying the person at layered checkpoints.
- Left unresolved, it exposes you and costs more over time, through sanctions penalties if you hire a malicious actor, ransom demands after a helpdesk attack, and the cost of a data breach.
Why identity verification belongs in your 2027 budget
Most teams already agree that identity matters. At the critical moments in a workforce, such as a hire, a password reset, or a payment approval, you want to confirm the person taking the action. Almost no one has budgeted for it, and the reason is structural. The cost is spread across IT, security, HR, and finance, and each team sees only its own slice. The login tools already in place also make the problem feel solved.
The tools most organizations already pay for answer a different question. Authentication proves which account is acting. Verification goes a step further and proves which human is acting. Identity providers handle the first well, and in a world where AI can fake a voice, a face, and a document, the second matters even more.
In practice, verification means the person scans a government ID and takes a live selfie on their phone, and the organization gets a clear pass or fail.
Every other control assumes it. Detection, cloud, and AI programs all depend on knowing who is acting, so a strong control built on an unverified person inherits the weakness. The attacks go through people too. The FBI's October alert says no single indicator catches North Korean IT workers reliably, and the FBI and CISA advisory on helpdesk attacks describes callers who research a target's role and place several calls before they ask for a reset. The weak point is a process built on trust.
The FBI recommends what it calls "identity in depth," which means layered identity checks for as long as someone works for you.
Unverified identity costs a large organization $79,000 to $150,000 a week
Nametag's research puts a number on it. For a 15,000-employee organization, unverified identity costs between $4.12M and $7.8M a year, depending on the industry. The research models six industries, and every one of them pays four costs at once.
The four costs are the same in every industry, and each lands on a different team.
- Workforce productivity. Time employees lose to resets, lockouts, and slow credential issuance. This lands on IT and operations.
- Annual loss expectancy. The yearly cost of identity-based breaches, calculated as how likely a breach is multiplied by what it costs. IBM's 2025 report puts the average breach at $4.44M globally and $7.42M in healthcare. This lands on security and finance.
- Operational efficiency. The labor behind identity tickets at the helpdesk. This lands on IT.
- Hiring fraud. The cost of hiring someone who isn't who they claimed to be, including recruiter hours spent on suspect applicants. This lands on HR and security.
The mix shifts by industry. In healthcare, breach exposure is the largest line at $4.97M a year. In manufacturing, workforce productivity leads at $2.97M. The model scales roughly with headcount, and the figures stay illustrative until they are built against your own numbers.
No budget has a line for any of it, which is why the cost is easy to miss.
Hiring and onboarding: A clean background check doesn't say who you hired
Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. In its survey of 3,000 job candidates, 6% admitted to interview fraud.
The risk is already here. On October 13, the Justice Department announced charges against 14 people. Agents searched more than 40 suspected laptop farms in Texas and seized about 187 devices. The scheme reached more than 70 US employers, in sectors that include healthcare and manufacturing.
The FBI's alert explains why a background check isn't enough. Before the workers use a stolen identity to apply, they often confirm that the data will pass employment background checks, and they pay Americans and freelancers to sit interviews on their behalf.
Hiring one of these workers carries legal risk too. Treasury's OFAC fact sheet says hiring or supporting North Korean IT workers poses risks that include legal consequences under US and UN sanctions.
Onboarding is where a clean-looking hire turns into credentials, a laptop, and a payroll account. Verification belongs at the offer, and again at onboarding before credentials issue, so the same person is confirmed at each step.
Helpdesk: A script can't judge a voice
The helpdesk is the one team allowed to reset a password and move an MFA (multifactor authentication) device on request, which makes it a target. The FBI and CISA advisory, updated in July 2025, describes how one group works. It targets large companies and their contracted IT helpdesks. It searches business websites and social media to learn a target's role, then places several calls. The first calls learn what a reset requires. Later calls gather details about the specific employee. The last call convinces a helpdesk agent to reset the password or transfer the employee's MFA to a device the attackers control.
An agent following a script can't judge a voice. The advisory says these calls are enriched with personal information from social media, open sources, and database leaks, so questions about a person's details don't prove who is calling. Verifying the caller turns the judgment call into a pass or fail and takes the guesswork out of every reset.
The stakes run past the reset. The advisory says the group has deployed ransomware, and the authoring agencies do not encourage paying a ransom.
High-risk approvals: A deepfaked CFO moved $25.6 million without a breach
In early 2024, a finance employee at the engineering firm Arup joined a video call with what looked like the company's CFO and other staff. Everyone else on the call was a deepfake, and the employee made 15 transfers totaling about $25.6 million to five bank accounts. The employee realized it was a scam about a week later, after contacting the company's headquarters. Arup told the Financial Times that none of its internal systems were compromised, according to Business Insider.
No system was breached. A person approved a payment for someone who wasn't there. The FBI's December 2024 alert warns that criminals generate videos for real-time video chats with alleged company executives, and that they use AI-generated audio to get into bank accounts.
Approvals are where a fake face or voice turns into money. A check that confirms the approver is the real person at the moment of the request, and records it, closes that path.
How to get identity verification funded in 2027
Six pieces of advice make the case, in the order to use them.
- Name one owner. The cost lands on four teams, and each one sees only its own part. Give identity assurance to a security or IT leader, and have finance review the model each planning cycle.
- Build the number from your own data. The research uses a 15,000-employee baseline, so swap in your headcount, shift pattern, contractor population, and ticket volume. Bring the weekly figure to the meeting. Finance will ask what the control costs, and in Nametag's model the license lands at roughly 2% of the manual cost it replaces.
- Start where your biggest cost is. The mix shifts by industry. If breach exposure leads, start with high-risk approvals. If lost time or ticket labor leads, start with helpdesk resets. If hiring fraud leads, start at the offer.
- Give it one line, split into the three moments. One line keeps the cost visible, and the split lets the plan show progress at each moment.
- Choose verification that covers all three moments. Identity in depth means layered checkpoints. Separate tools for hiring, the helpdesk, and approvals mean three contracts and three places for a check to be skipped. Confirm that it fits the ATS, ticketing tool, and identity provider you already run, and ask where IDs and selfies are stored and how long they are kept.
- Track results from the first quarter. Follow reset time, identity tickets per employee, and recruiter hours spent on suspect applicants. They map to three of the four costs in the model, so the results feed straight back into the budget case.
Here is how the line splits:
Waiting doesn't shrink the problem. The cost accrues every week, the schemes keep adapting, and Gartner expects one in four candidate profiles to be fake by 2028. Left unresolved, unverified identity exposes you and costs more over time, through sanctions penalties, ransom demands, or a breach.
Teams that act now choose the moment, the owner, and the budget. Teams that wait let an incident choose for them. Put identity verification in the 2027 budget before an incident writes the line for you.
