While Chief Human Resources Officers (CHROs) agree hiring fraud requires attention, many doubt their organizations are equipped to stop it.

Checkr's 2026 CHRO Insights Report, surveying 2,500 HR leaders, reveals that identity fraud detection is now a top-five AI investment priority, yet only 31% of leaders feel extremely confident in preventing it.

Mistakenly, the ability to prevent fraud gets read as background check problem. It isn’t. Background checks are doing what they were built to do. The gap CHROs are sensing is somewhere else.

This gap highlights a critical issue: awareness has risen, but infrastructure has not. Fraud persists despite organizational recognition.

What the hiring funnel was actually built to verify

The modern hiring funnel was built to verify claimed history. Employment dates. Education credentials. Criminal record. License status.

Each of those checks asks: is what this person says about their past accurate?

Identity — whether the human in front of you is who they say they are — was an assumption baked underneath all of it. Of course the candidate is the candidate. The funnel was designed in a world where that assumption held.

That world is gone.

Why the assumption no longer holds

Synthetic identities pieced together from real and fabricated data points. Stolen Social Security numbers (SSNs) attached to entirely different humans. Deepfake interviews. AI-generated resumes mapped onto stolen credentials. The inputs the funnel relies on: name, SSN, employment history, education. These all can be assembled cleanly into a profile that does not correspond to the person submitting it.

In that world, background checks don’t fail. They execute correctly on a falsified foundation. The criminal record search returns no hits because the SSN belongs to someone with no record. The employment verification confirms the dates because the employment actually happened — to someone else. A well-built background check, asked to do its job, will give you a clean result on a synthetic candidate. Because what it was built to verify, it verified.

Identity is a distinct layer

Identity proofing answers a different question than background checks — actually, two questions. 

Does this identity exist, with the claimed attributes?

And does the person submitting it match? 

This is both Validate, then verify. Both have to be true before any downstream screening like a background check matters. Identity proofing belongs in the funnel, but it belongs as a separate layer with its own controls, not as a competitor to background checks or a replacement for them. And identity proofing more than just credential verification. 

This is the part most CHROs are sensing when they are asked to rate their level of confidence that they are preventing hiring fraud at their organization.

The control they don’t have isn’t a better version of something they already have. It’s a category they were never asked to build for, because the assumption held until recently. The right framing isn’t "upgrade your background checks."

It’s "add the layer the funnel was missing."

Once identity is treated as its own layer, the operational shape gets clearer:

• At the application stage: passive signals catch synthetic identity patterns before recruiter time gets spent on a profile that doesn’t correspond to a real applicant.
• At the shortlist stage: government ID verification and liveness checks confirm a real human matches the claimed identity.
• At offer and Day One: a verified identity record carries through to I-9 (Form I-9, Employment Eligibility Verification) examination, and the controls have a continuous identity thread to verify against.

The background check still runs. It still does what it was built for. But it runs on a verified foundation rather than a presumed one. That’s the architecture the 31% number is asking for.

The seat-at-the-table connection

CHROs who can articulate this distinction — why identity is a separate layer, not a background check upgrade — are making a strategic argument, not a procurement one. They are naming a category of risk that touches employment law, data protection, and sanctions exposure, and they are naming it before the rest of the executive team does.

The 31% number is not bad news. It’s data. And the CHROs who read it correctly will spend the next twelve months building the identity lifecycle the funnel was missing.

See how Proof builds that continuous identity thread from first application to I-9 >