Fraud Mitigation: Best Practices for the Digital Economy 2.0

A new reality for screening providers Everything about the candidate checked out. Their resume reflected the right experience. Their references confirmed it. The background screening process came back clean. From outside, there was no reason to hesitate. So, the company didn’t.  But within weeks, small inconsistencies began to surface. The employee struggled in ways that didn’t match their credentials. Follow-up questions led to vague answers. Eventually, a deeper review uncovered the issue; this wasn’t just a case of exaggeration. It was candidate fraud. And increasingly, it’s not just individuals acting alone.  In a widely reported scheme, foreign operatives posed as legitimate remote IT workers, using stolen identities and AI-assisted interviews to secure jobs at major Fortune 500 companies. Once hired, access was handed off, allowing bad actors to infiltrate corporate systems and generate millions in illicit revenue. In one case, a single individual funneled over $17 million to a foreign operation. These weren’t obvious scams. The candidates passed interviews. They cleared checks. And that’s exactly the point. For background screening and verification providers, this shift presents both a challenge and an opportunity. As candidate fraud becomes more sophisticated, your clients are no longer just looking to verify records – they’re looking to trust identity itself, and they’re looking to you to help them do it. The assumption that no longer holds For decades, hiring has relied on a simple premise: verify the records, resume, and you can trust the candidate. That model worked when identity was easier to validate in person. But in today’s digital-first hiring environment, identity can oftentimes be asserted, not proven. At the same time, identity-based fraud is accelerating. Synthetic identity fraud alone accounts for billions in annual losses, and employers are increasingly encountering candidates whose identities are far more difficult to validate than their resumes. This creates a critical disconnect: Organizations are still verifying records, but those records may be tied to identities that were never legitimate to begin with. Increasingly, they’re turning to their screening partners to close that gap. The reality of candidate fraud 31% of employers have interviewed candidates using a false identity Only 19% feel confident they can detect fraud in hiring 1 in 4 companies report losses of$50K+from fraudulent hires Why candidate fraud is getting harder to see The nature of candidate fraud has fundamentally changed. At one end of the spectrum, companies are still dealing with candidates who falsify resumes, costing businesses time and money when the truth comes to light later. But at the other end, the threat has escalated dramatically. Coordinated fraud rings are now using stolen identities and AI-assisted interviews to place individuals into remote roles, sometimes without ever revealing their identity. And this isn’t slowing down. According to Gartner, by 2028, 1 in 4 candidates could be fake, driven by AI, remote hiring, and identity manipulation. For screening providers, this introduces a new level of complexity. The challenge is no longer just delivering verified records; it’s helping clients surface risks that traditional screening processes were not designed to identify. What traditional screening still gets right None of this diminishes the importance of pre-employment screening. Verifying employment history, education, and background remains a critical part of responsible hiring, and it should. But even the most thorough screening process is designed to answer a specific question: Do the records align with the identity provided? What it does not answer is the question that matters most now: Is that identity real? That gap between record verification and identity validation is where modern fraud operates. And it represents an opportunity for screeners to expand their role from record validation to helping enable stronger identity confidence. The cost of believing everything is working When fraud moves through the hiring process undetected, the consequences aren’t always immediate, but they can be significant. There are financial risks, compliance exposure and potential access to sensitive systems. But there’s also a more subtle —and often overlooked — impact: The assumption that existing processes are working as intended. When fraudulent candidates pass through screening, it reinforces confidence in processes that may not be equipped for today’s threat landscape. Over time, that false sense of security can become a vulnerability. From screening provider to strategic partner As hiring evolves, so do expectations. Employers are no longer just looking for faster background checks - they’re looking for greater confidence in who they’re hiring. This shift creates an opportunity for screening providers to move upstream in the hiring process. By introducing identity verification earlier in the workflow, providers can help clients detect candidate fraud sooner, reduce downstream risk, and strengthen the integrity of hiring decisions.  More importantly, it allows providers to differentiate their offerings in an increasingly competitive market, shifting from a transactional service to a more strategic capability. A shift in thinking: Identity before everything else To address modern candidate fraud, organizations don’t just need better tools; they need a different starting point. Instead of beginning with records, leading providers are beginning with identity. They are asking a more fundamental question earlier in the process:  Is this person who they say they are? Is this person a real, consistent and verifiable person? When that foundation is established, everything that follows becomes more meaningful. Background checks become more reliable. Verification becomes more consistent. And the ability to detect candidate fraud improves, not because the process is longer, but because it’s more informed. In this model, identifying potential fraud becomes proactive rather than reactive. Why identity verification matters more now than ever The shift to remote and digital hiring hasn’t just changed how companies hire – it’s changed how fraud occurs. Today, a significant portion of fraudulent activity targets the employment process, making it a key point of exposure for identity misuse. In fact, 45% of all false document submissions now occur in the employment sector. In many cases, candidates who falsify information still progress through hiring workflows. A study revealed that 70% of candidates who falsify information still get hired. This reinforces today’s reality: Fraud is no longer slipping through the cracks; it’s moving through the front door. How Experian helps close the identity gap Experian® helps background screeners and verification providers bridge the gap between who a candidate claims to be and who they are. By combining identity verification, fraud detection, and verification solutions, Experian enables providers to enhance their existing solutions – without disrupting their workflows. This allows you to extend your value beyond traditional screening, help clients detect candidate fraud earlier, and strengthen confidence in hiring outcomes.   The result is not just better screening, it’s a stronger strategic position in your clients’ hiring ecosystem, one that reduces risk while improving speed and confidence. Candidate fraud isn’t an edge case anymore. It reflects a broader shift in how identity works in a digital world. And while traditional screening remains essential, it may not be sufficient on its own. Because if identity is uncertain, every subsequent check is built on unstable ground. But when identity is established earlier in the process, everything that follows becomes more dependable. Don’t just verify the candidate records, verify the identityLearn how Experian helps screening providers embed identity verification at the start of the hiring journey to help detect candidate fraud earlier, reduce risk, and strengthen screening outcomes.  Explore Experian’s Fraud Prevention Playbook for Pre-Employment Screening FAQs

Model inventories are rapidly expanding. AI-enabled tools are entering workflows that were once deterministic and decisioning environments are more interconnected than ever. At the same time, regulatory scrutiny around model risk management continues to intensify. In many institutions, classification determines validation depth, monitoring intensity, and escalation pathways while informing board reporting. If classification is wrong, every downstream control is misaligned. And, in 2026, model classification is no longer just about assigning a tier, but rather about understanding data lineage, use case evolution, interdependencies, and governance accountability in a decentralized, AI-driven environment. We recently spoke with Mark Longman, Director of Analytics and Regulatory Technology, and here are some of his thoughts around five blind spots risk and compliance leaders should consider addressing now. 1. The “Set It and Forget It” Mentality The Blind Spot Model classification frameworks are often designed during a regulatory remediation effort or inventory modernization initiative. Once documented and approved, they can remain largely unchanged for years. However, model risk management is an ongoing process. “There’s really no sort of one and done when it comes to model risk management,” said Longman. Why It Matters Classification is not merely descriptive, it’s prescriptive. It drives the depth of validation, the frequency of monitoring, the intensity of governance oversight and the level of senior management visibility. As Longman notes, data fragmentation is compounding the challenge. “There’s data everywhere – internal, cloud, even shadow IT – and it’s tough to get a clear view into the inputs into the models,” he said. When inputs are unclear, tiering becomes inherently subjective and if classification frameworks are not reviewed regularly, governance intensity can become misaligned with real exposure. Therefore, static classification is a growing risk, especially in a world of rapidly expanding AI use cases. In a supervisory environment that continues to scrutinize model definitions, particularly as AI tools proliferate, a dynamic, periodically refreshed classification process can demonstrate institutional vigilance. 2. Assuming Third-Party Models Reduce Governance Accountability The Blind SpotThere is often an implicit belief that vendor-provided models carry less governance burden because they were developed externally. Why It Matters Vendor provided models continue to grow, particularly in AI-driven solutions, but supervisory expectations remain firm. “Third-party models do not diminish the responsibility of the institution for its governance and oversight of the model – whether it’s monitoring, ongoing validation, just evaluating drift model documentation,” Longman said. “The board and senior managers are responsible to make sure that these models are performing as expected and that includes third-party models.” Regulators consistently emphasize that institutions remain responsible for the outcomes produced by models used in their decisioning environments, regardless of origin. If a vendor model influences credit approvals, pricing, fraud decisions, or capital calculations, it directly affects customers, financial performance and compliance exposure. Treating third-party models as inherently lower risk can also distort internal tiering frameworks. When vendor models are under-classified, validation depth and monitoring rigor may be insufficient relative to their true impact. 3. Limited Situational Awareness of Model Interdependencies The Blind Spotfeed multiple downstream models simultaneously. Why It Matters Risk often flows across interdependencies. When upstream models degrade in performance or introduce bias, downstream models inherit that exposure. If multiple material decisions depend on the same data transformation or feature engineering process, concentration risk emerges. Without visibility into these dependencies, tiering assessments may underestimate cumulative risk, and monitoring frameworks may fail to detect systemic vulnerabilities. “There has to be a holistic view of what models are being used for – and really somebody to ensure there’s not that overlap across models,” Longman said. Supervisors are increasingly interested in understanding how model risk propagates through business processes. When institutions cannot articulate how models interact, it raises broader concerns about situational awareness and control effectiveness. Therefore, capturing interdependencies within the classification framework enhances more than documentation. It enables more accurate tiering, more targeted monitoring and more informed governance oversight. 4. Excluding Models Without Defensible Rationale The Blind SpotGray-area tools frequently sit outside formal inventories: rule-based engines, spreadsheet models, scenario calculators, heuristic decision aids, or emerging AI tools used for analysis and summarization. These tools may not neatly fit legacy definitions of a “model,” and so they are sometimes excluded without robust documentation. Why It Matters Regulatory definitions of “model” have broadened over time. What creates risk is the absence of defensible reasoning and documentation. Longman describes the risk clearly: “Some [teams] are deploying AI solutions that are sort of unbeknownst to the model risk management community – and almost creating what you might think of as a shadow model inventory.” Without visibility, institutions cannot confidently characterize use, trace inputs, or assign appropriate tiers, according to Longman. It also undermines the credibility of the official inventory during examinations. A well-governed program can articulate why certain tools fall outside model risk management scope, referencing documented criteria aligned with regulatory guidance. Without that evidence, exclusions can appear arbitrary, suggesting gaps in oversight. 5. Inconsistent or Subjective Classification Frameworks The Blind SpotAs inventories scale and governance teams expand, classification decisions are often distributed across reviewers. Over time, discrepancies can emerge. Why It Matters Inconsistency undermines both risk management and regulatory confidence. If two models with comparable use cases and impact profiles are assigned different tiers without clear justification, it signals that the framework is not being applied uniformly. AI adds even more complexity. When it comes to emerging AI model governance versus traditional model governance, there’s a lot to unpack, says Longman: “The AI models themselves are a lot more complicated than your traditional logistic or multiple regression models. The data, the prompting, you need to monitor the prompts that the LLMs for example are responding to and you need to make sure you can have what you may think of as prompt drift,” Longman said. As frameworks evolve, particularly to incorporate AI, automation, and new regulatory interpretations, institutions must ensure that changes are cascaded across the entire inventory. Partial updates or selective reclassification introduce fragmentation. Longman recommends formalizing classification through a structured decision tree embedded in policy to ensure consistent outcomes across business units. Beyond clear documentation, a strong classification program is applied consistently, measured objectively, and periodically reassessed across the full portfolio. BONUS – 6. Elevating Classification with Data-Level Visibility Some institutions are extending classification discipline beyond models to the data layer itself. Longman describes organizations that maintain not only a model inventory, but a data inventory, mapping variables to the models they influence. This approach allows institutions to quickly assess downstream effects when operational or environmental changes occur including system updates or even natural disasters affecting payment behavior. In an AI-driven environment, traceability may become a competitive differentiator. Conclusion Model classification is foundational. It determines how risk is measured, monitored, escalated, and reported. In a rapidly evolving regulatory and technological environment, it cannot remain static. Institutions that invest now in transparency, consistency, and data-level visibility will not only reduce supervisory friction – they will build a governance framework capable of supporting the next generation of AI-enabled decisioning. Learn more

Fraud is evolving faster than ever, driven by digitalization, real-time payments and increasingly sophisticated scams. For Warren Jones and his team at Santander Bank, staying ahead requires more than tools. It requires the right partner. The partnership with Santander Bank began nearly a decade ago, during a period of rapid change in the fraud and banking landscape. Since then, the relationship has grown into a long-term collaboration focused on continuous improvement and innovation. Experian products helped Santander address one of its most pressing operational challenges: a high-volume manual review queue for new account applications. While the vast majority of alerts in the queue were fraudulent and ultimately declined, a small percentage represented legitimate customers whose account openings were delayed. This created inefficiencies for staff and a poor first impression of genuine applicants. We worked alongside Santander to tackle this challenge head-on, transforming how applications were reviewed, how fraud was detected and how legitimate customers were approved. In addition to fraud prevention, implementing Experian's Ascend PlatformTM, with its intuitive user experience and robust data environment, has unlocked additional value across the organization. The platform supports multiple use cases, enabling collaboration between fraud and marketing teams to align strategies based on actionable insights. Learn more about our Ascend Platform