Verifying Remote Candidates Without Breaking the Law: Stage-Gated Identity Checks and I-9 Rules

Pre-Flight Gate: Do Not Cure Candidate Fraud With a Class-Action Lawsuit

Remote identity fraud is real and expensive, as recent DOJ seizures of laptop farms make plain. Overcorrecting with unlawful pre-offer ID uploads or silent biometric scans creates immediate class liability.

Every remote talent team feels the squeeze. FBI advisories in July 2025 and October 2026 detailed stolen-identity IT schemes, VoIP spoofing, and real-time face-swapping proxies. Discovering a fake hire after Day 1 triggers our 72-hour fraudulent remote worker response runbook, so executives demand an instant gate at the top of the funnel. Within 24 hours, someone proposes three disastrous fixes. They ask to collect passports with resumes, run covert AI deepfake detectors on Zoom, and block VoIP carriers or foreign-sounding names.

Halt all three proposals immediately. Each one breaks a separate statute:

• Pre-offer work-authorization document demands violate 8 U.S.C. § 1324b: The Department of Justice Immigrant and Employee Rights Section (IER) enforces 8 U.S.C. § 1324b(a)(6) against employers with four or more employees. Demanding Form I-9 verification documents before an applicant accepts a job offer—or specifying a US passport or Permanent Resident Card—is an unlawful unfair documentary practice (pair this check with compliant job-ad sponsorship wording).
• Pre-offer ID photos inject protected traits into selection: Collecting driver's licenses at application hands hiring managers exact dates of birth (ADEA), race and national-origin markers (Title VII), and facial disfigurement or disability clues (ADA) before screening resumes.
• Name and nationality ban-lists backfire on real US victims: As the FBI warned in its remote IT worker advisories, DPRK operatives steal the real Social Security numbers and names of US citizens. Informal name-filtering or VoIP blacklists block qualified US applicants and re-victimize identity-theft targets while missing stolen mainstream profiles.

Stage 1 & Stage 2: Human Continuity Checks That Catch Proxies With Zero Biometric Scans

Live human observation catches 90% of proxy-interviewer swaps without extracting a single biometric vector. Standardize recruiter-to-hiring-manager continuity checks across every video stage.

Run these low-friction, zero-biometric human verification steps inside your people operations and recruiting workflow:

1. Enforce live camera-on parity with an explicit ADA/religious accommodation path: Require live camera-on participation across the recruiter screen, technical coding round, and manager interview. State upfront in the calendar invite that candidates needing a disability or religious accommodation for video formatting can message Recruiting Operations directly.
2. Keep the same recruiter on the first 90 seconds of Round 2 and Day-1 onboarding: Proxy rings rely on siloed interviewers—Person A aces the technical round, Person B takes the manager chat, and Person C logs in on Day 1. Having the original recruiter join the first 90 seconds of the final round (and the Day-1 IT onboarding call) to introduce the candidate visually defeats proxy handoffs without recording or biometric templates.
3. Use live artifact challenges instead of static prompts: Ask the candidate during the live call to walk through a specific design tradeoff from their own prior commit or adjust a live whiteboard constraint while speaking naturally. Real-time voice-and-lip-sync deepfake rigs lag noticeably when asked to screen-share and talk simultaneously or hold a hand briefly near the jawline while speaking—though never mock or interrogate speech cadence that could stem from a stutter, neurological condition, or accent.
4. Verify hardware shipping addresses before shipping laptops: Cross-check the post-offer laptop shipping street address against commercial mail-receiving agencies (UPS Stores), freight forwarders, or residential addresses already tied to another active contractor's MDM telemetry.

Stage 3: Biometric Selfie-ID Vendors and AI Video Analysis Rules

If high-security roles justify a third-party identity vendor or AI deepfake analyzer, treat facial geometry and voiceprints as regulated biometric identifiers. Collect written informed consent first.

Before plugging an automated "selfie-to-ID liveness" vendor or an AI video-integrity tool into your ATS for AI and changing work workflows, verify three strict statutory gates:

• Illinois BIPA (740 ILCS 14/15 & 14/20) & Texas CUBI (Tex. Bus. & Com. Code § 503.001): Any tool that extracts facial geometry or a voiceprint—even for three seconds in RAM to match a selfie against a license or flag a synthetic face—triggers Illinois's Biometric Information Privacy Act. Even after Illinois SB 2979 (P.A. 103-0769, effective August 2, 2024) capped repetitive scans at one recovery per person rather than per scan and confirmed electronic signatures satisfy a "written release," statutory damages remain $1,000 per negligent violation and $5,000 per intentional or reckless violation per applicant! You must publish a public retention/destruction schedule (destroying biometric data when the initial purpose is satisfied or within 3 years), state the purpose and duration in writing, and capture an affirmative electronic release before collection.
• Illinois Artificial Intelligence Video Interview Act (820 ILCS 42): If AI analyzes recorded video interviews of applicants based in Illinois, you must notify the applicant beforehand, explain how the AI works and what characteristics it evaluates, obtain prior consent, restrict sharing strictly to evaluators, and delete all copies within 30 days of an applicant's deletion request (see also our two-party recording and AI notetaker consent rules).
• FCRA Adverse-Action Check (15 U.S.C. § 1681b(b)): If a third-party identity or fraud-scoring vendor compiles database records bearing on character or trustworthiness as a Consumer Reporting Agency, rejecting a candidate on a vendor "High Fraud Score" without standalone FCRA disclosure, authorization, pre-adverse notice, copy of the report, and five-business-day dispute window violates the Fair Credit Reporting Act—hitting real identity-theft victims hardest!

Stage 4: Execute the DHS E-Verify Remote Form I-9 Alternative Procedure Properly

Remote video inspection of Form I-9 documents is illegal unless your company is an active E-Verify participant in good standing. Follow every step of 8 CFR § 274a.2(b)(1)(ii)(A) within three business days of start.

Once the candidate accepts the offer, Form I-9 becomes your strongest lawful verification gate—provided you never improvise the rules under 8 CFR § 274a.2(b)(1)(ii)(A) (authorized under 88 FR 47990):

1. Confirm E-Verify eligibility first: Only employers enrolled and in good standing in E-Verify for the hiring site may inspect Form I-9 documents over live video. If you do not use E-Verify, you must conduct physical in-person document inspection (via HR or a trained Authorized Representative—never a rubber-stamp webcam check!).
2. Employee selects from the Lists of Acceptable Documents: Send the official Form I-9 Lists of Acceptable Documents. Never ask for a List A passport or EAD specifically; let the hire choose any valid List A document or List B + List C combination.
3. Complete all four mandatory Alternative Procedure steps by Business Day 3: (a) Receive clear front-and-back copies of the chosen document(s) first; (b) conduct a live video interaction with the individual presenting the exact same physical document(s) while your original recruiter or trained HR verifier confirms visual continuity with the person who interviewed; (c) check the "Check here if you used an alternative procedure authorized by DHS to examine documents" box in Section 2 of the current Form I-9; and (d) retain clear, legible front-and-back copies with the I-9 and submit the E-Verify case (including E-Verify Photo Matching where triggered).

Copy-Ready Candidate Video Continuity & Optional Biometric Release Notice

Insert Block A into standard remote interview invites, and require explicit e-signature on Block B before launching any third-party facial or AI video-analysis tool.

BLOCK A — STANDARD LIVE INTERVIEW CONTINUITY NOTICE (ZERO BIOMETRIC COLLECTION)
"Live Video Interview Expectations & Accommodations:
To ensure fair evaluation and candidate continuity across remote hiring stages, interviews are conducted live with cameras enabled, and your recruiting coordinator will briefly join final-stage introductions. We do NOT record interviews or use automated biometric or AI video-scoring tools during standard interviews. If you require a disability-related, medical, or religious accommodation regarding video participation, please email [[email protected]] prior to your session."

---

BLOCK B — STANDALONE WRITTEN RELEASE (ONLY IF USING BIOMETRIC ID OR AI VIDEO ANALYSIS)
"Notice & Written Release for Identity Verification / Video Analysis (740 ILCS 14/15; 820 ILCS 42):
1. Purpose & Mechanics: Before [Vendor Name] verifies your identity [and/or analyzes recorded video], please note that the software temporarily extracts facial-geometry measurements [and/or evaluates video audio/visual characteristics using artificial intelligence: describe specific characteristics evaluated] solely to confirm live candidate identity and prevent impersonation.
2. Retention & Deletion Schedule: Neither [Company] nor [Vendor] sells, leases, or profits from biometric data. Any biometric identifiers or templates are permanently destroyed immediately upon completion of identity verification (and in all events within [30 days / no later than 1 year]), and Illinois applicants may request complete video deletion within 30 days at [[email protected]].
3. Accommodation / Non-Biometric Alternative: You may opt for a live human verification session with HR instead of automated verification without penalty by contacting [[email protected]].
[ ] I have read this Notice and voluntarily execute this Written Release consenting to the collection, use, and temporary storage of my data as described above."