Background Check Processes

🇫🇷 🤝🏻🇩🇪 : joint French-German proposals by our cyber agencies ANSSI - Agence nationale de la sécurité des systèmes d'information and the Federal Office for Information Security (BSI) Security on a decisive topic : the European digital Identity wallet 🇫🇷 ANSSI and 🇩🇪 BSI issued a new joint paper on remote identity verification ⭐️Following an initial joint publication in 2023, ANSSI and BSI are now releasing a new joint document aligned with the updated European regulatory framework. 🌍 Last month, Director General of ANSSI @Vincent Strubel & German counterpart Claudia Plattner reaffirmed the trusted relationship between #ANSSI and #BSI on the topic of remote identity verification. 📈 Since February 2024, the regulatory shift introduced by eIDAS 2 has brought forth the #EU Digital Identity Wallet, which may be issued based on remote identity verification. At the same time, cyber threats have continued to evolve, and European standardisation work on remote identity verification has progressed. Key takeaway =a secure and trusted EUDI Wallet depends on: 🔹Strong, harmonized standards 🔹Advanced defenses against remote attacks 🔹Cross-border interoperability and regulatory support. 🛡️ High Assurance is Essential for EUDI Wallet Onboarding. Remote identity proofing, particularly video-based methods, are being explored as alternatives to national eID systems but present significant technical and security risks. 🎯 3️⃣ Critical Verification Goals to ensure trustworthiness: 🔹Biometric genuineness 🔹Document authenticity (genuine, current, and physically possessed) 🔹Face matching (the face matches the ID document photo). ⚠️ 2️⃣ major categories of attacks: 🔹Presentation Attacks: use of photos, masks, or replayed videos in front of the camera. Exploit the fact that many ID document security features are not verifiable remotely. 🔹 Injection Attacks : Bypass the camera using pre-recorded or AI-generated data; Deepfakes and synthetic documents pose increasing challenges. ✅ Recommendations for Strengthening the Ecosystem 🔹Harmonise Evaluation Criteria -Establish pan-European test specifications directly mapped to LoA High. -Mandate biometric attack testing in evaluations 🔹Bridge the Document Verification Gap -Develop standards for remote verification of ID documents. -Promote chip reading over OCR where legally possible. -Ensure legal frameworks enable conformity assessment bodies to perform robust testing. #cyber #scybersecurity #Europe

It was a great opportunity to address #HR #leaders representing various Industries in a Round Table discussion, titled - "𝗔𝗜 𝗮𝗻𝗱 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗼𝗻 𝗶𝗻 𝗕𝗮𝗰𝗸𝗴𝗿𝗼𝘂𝗻𝗱 𝗖𝗵𝗲𝗰𝗸𝘀: 𝗕𝗮𝗹𝗮𝗻𝗰𝗶𝗻𝗴 𝗘𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝗰𝘆 𝗮𝗻𝗱 𝗔𝗰𝗰𝘂𝗿𝗮𝗰𝘆.", which was organized jointly by SpringVerify and HR SUCCESS TALK® in Bangalore As we navigate the complexities of talent acquisition, AI and automation have emerged as game-changers. However, we must balance efficiency and accuracy to ensure reliable results. Let me share the challenge, possible AI driven solutions and use cases. 𝐓𝐡𝐞 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞: Manual background checks are time-consuming (avg. 2-4 weeks), prone to human error (up to 30%), and costly (avg. $50-$100 per check). 𝐓𝐡𝐞 𝐒𝐨𝐥𝐮𝐭𝐢𝐨𝐧: AI-powered #automation can streamline background checks, reducing turnaround times by 50-75% and costs by 20-50%. 𝐒𝐭𝐚𝐭𝐢𝐬𝐭𝐢𝐜𝐬: Following are some interesting data points in background verification 1. 80% of employers conduct background checks 2. 45% of resumes contain discrepancies 3. AI-powered background checks reduce false positives by 90% 4. 95% of employers report that background checks have helped prevent or reduce instances of workplace violence, theft, or other forms of misconduct. 5. The global background check market size was USD 13.83 Billion in 2023 and is likely to reach USD 38.70 Billion by 2032 6. 71% of employers use background checks to verify education credentials, while 64% use them to verify employment history. 7. 85% of job applicants admit to lying or exaggerating on their resumes, highlighting the need for thorough background checks. 𝐔𝐬𝐞 𝐂𝐚𝐬𝐞𝐬: There are several #AI-powered background checks #usecases which can be leveraged to address the various needs of BGV * 𝐈𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐕𝐞𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧: AI-driven ID verification tools, like ID.me and Jumio, ensure accurate identification. * 𝐄𝐦𝐩𝐥𝐨𝐲𝐦𝐞𝐧𝐭 𝐕𝐞𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧: Automated systems, such as HireRight and EmployeeScreenIQ, validate employment history. * 𝐂𝐫𝐢𝐦𝐢𝐧𝐚𝐥 𝐑𝐞𝐜𝐨𝐫𝐝 𝐂𝐡𝐞𝐜𝐤𝐬: AI-powered search algorithms, like those used by Been Verified and (link unavailable), efficiently scan databases.  𝐀𝐈 𝐚𝐧𝐝 𝐆𝐞𝐧 𝐀𝐈 𝐓𝐨𝐨𝐥𝐬: 1. Natural Language Processing (NLP) for 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵 𝘢𝘯𝘢𝘭𝘺𝘴𝘪𝘴 2. Machine Learning (ML) for 𝘱𝘢𝘵𝘵𝘦𝘳𝘯 𝘳𝘦𝘤𝘰𝘨𝘯𝘪𝘵𝘪𝘰𝘯 3. Optical Character Recognition (OCR) for 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵 𝘴𝘤𝘢𝘯𝘯𝘪𝘯𝘨 4. Robotic Process Automation (RPA) for 𝘸𝘰𝘳𝘬𝘧𝘭𝘰𝘸 𝘰𝘱𝘵𝘪𝘮𝘪𝘻𝘢𝘵𝘪𝘰𝘯 It was insightful, interesting & inspiring round table. Many thanks to my friends - Annie Mathen, Poornima Srinivasan,Tino Thomas, Anbu M, Paramveer Singh Narang, Nandakumar Kuruppath, Priyanka Nikumbha, Maitreyee Bhaduri, Harsha Vatnani, Yashwanth JembigeA, Govind Negi for sharing their expertise and connect. #Leadership #eductaion #AI #BGV #Wednesdaywisdom #digitalsecurity #dataprivacy #GDPR

The National Institute of Standards and Technology (NIST) has released the second public draft of its Digital Identity Guidelines (SP 800-63, Revision 4), reflecting a comprehensive update in response to the rapidly evolving digital landscape. This update, incorporating feedback from over 4,000 comments, focuses on ensuring #secure, #private, and #equitable access to government services while addressing the needs of #diverse populations. 🔍 Key Points from the Latest Draft: 𝐂𝐨𝐦𝐩𝐫𝐞𝐡𝐞𝐧𝐬𝐢𝐯𝐞 𝐅𝐫𝐚𝐮𝐝 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: The guidelines introduce expanded requirements for managing fraud at different assurance levels, including programmatic #fraud management tailored to remote and in-person #identity proofing scenarios. This is crucial for safeguarding both organizations and individuals against identity-related fraud #risks. 𝐌𝐨𝐝𝐞𝐫𝐧𝐢𝐳𝐞𝐝 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐈𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐒𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬: NIST has significantly enhanced guidance on the use of digital #wallets and syncable #authenticators like #passkeys, aligning with the latest technological advances. These solutions are designed to ensure that digital identities are #securely managed across multiple devices while maintaining a high level of user control and #security. 𝐀𝐈 𝐚𝐧𝐝 𝐌𝐋 𝐂𝐨𝐧𝐬𝐢𝐝𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐬: Recognizing the increasing integration of #AI and machine learning in identity systems, the guidelines now include detailed requirements for #transparency, bias mitigation, and risk management associated with these technologies. This ensures that AI-driven identity solutions are both reliable and equitable. 𝐈𝐧𝐜𝐥𝐮𝐬𝐢𝐯𝐞 𝐚𝐧𝐝 𝐄𝐪𝐮𝐢𝐭𝐚𝐛𝐥𝐞 𝐀𝐜𝐜𝐞𝐬𝐬: A major emphasis is placed on ensuring that all individuals, including those from underserved #communities, have equitable access to digital services. The guidelines address potential barriers and propose strategies to mitigate the risk of exclusion, thereby fostering broader participation in digital identity ecosystems. 𝐔𝐬𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐚𝐧𝐝 𝐏𝐫𝐢𝐯𝐚𝐜𝐲: The draft continues to stress the importance of balancing usability and privacy, ensuring that digital identity systems are user-friendly while safeguarding personal information. This includes detailed #privacy controls and usability testing with diverse user groups to accommodate varying needs and preferences. NIST is inviting public comments on these draft guidelines until October 7, 2024. Stay tuned for more updates. 👇 Read more #DigitalIdentity #Cybersecurity #NIST #AI #DigitalTransformation #PublicSector #Privacy

🎭 46 bank accounts opened using a deepfake. What does this case tell us about digital onboarding? The use of deepfakes and generative AI in digital onboarding is emerging as one of the most significant challenges for identity verification systems. While the banking sector is among the most exposed, this issue affects any organisation that verifies customers remotely. A recent case from the Netherlands illustrates the problem. A man is accused of opening 46 bank accounts using stolen identity documents and AI-generated deepfakes to bypass a bank's facial verification process during onboarding. According to investigators, some of the identity documents were obtained from social media, while others were collected through a fake apartment rental listing that asked prospective tenants to submit copies of their ID documents. The fraud was uncovered when one of the account applications included a woman's identity document, while the accompanying selfie clearly showed the face of a man. Beyond the individual case, it highlights a broader issue. Verifying an identity document does not necessarily mean verifying the identity of the person completing the onboarding process. A document may be genuine and belong to a real person, but that does not guarantee that the individual presenting it is its legitimate owner. As AI continues to evolve, the trust model built around document verification, selfies and facial recognition is facing new challenges. eIDAS 2.0 represents a shift from identity verification based primarily on visual evidence to a model built on trusted digital credentials. Rather than assessing whether a document and a face appear to match, organisations can rely on identities issued and verified by trusted public authorities. This is where the government-backed digital identities introduced under eIDAS 2.0 become increasingly relevant. Rather than relying solely on the analysis of a document and an image, they enable identity verification based on digital identities with a high Level of Assurance (LoA). The new AML Regulation (AML-R) is moving in the same direction, introducing more stringent requirements from July 2027 regarding the level of assurance expected for identities used in customer onboarding. For organisations subject to AML obligations, this is not only a regulatory matter but also an opportunity to rethink how identity is verified in an increasingly AI-driven environment. For anyone involved in digital onboarding, it is worth taking a look at how organisations such as Hopae are addressing this challenge. Their objective is to enable organisations to verify high-assurance, government-backed digital identities through a single integration, gradually moving beyond a model based solely on document verification. More information is available here: https://lnkd.in/e6gc6MVi

🇪🇺🆔 Navigating the Technical Architecture of the EU Digital Identity Wallet Ecosystem ICYMI: The France Identité Playground displays this comprehensive visual mapping of the EUDI Wallet landscape, illustrating the intricate web of protocols, regulations, and use cases. 💓 At the heart of this ecosystem is the EUDIW itself, which functions as the primary interface for citizens. Its security is underpinned by the Wallet Secure Cryptographic Device (WSCD) and the Wallet Secure Cryptographic Application (WSCA), which provide the hardware and software security environments necessary to meet "High" Level of Assurance standards. The governance of this infrastructure is rooted in the eIDAS (Electronic Identification, Authentication and Trust Services) regulation. This legal foundation is translated into technical requirements through the Architecture and Reference Framework (ARF) and various Implementing Acts (IAs), which mandate the specific standards member states must adopt for interoperability. A critical component of this cross-border efficiency is the Once-Only Technical System (OOTS), which allows for the automated exchange of evidence between public authorities, reducing the administrative burden on users. Data within the wallet is categorized into two primary streams: - Personal Identification Data (PID), which represents the core identity of the holder, such as name and date of birth. - (Qualified) Electronic Attestation of Attributes ((Q)EAA) - verifiable credentials like university degrees or professional certifications. When these attestations are issued by public sector entities, they are categorized as Public Electronic Attestation of Attributes (Pub-EAA). To ensure these credentials can be issued and presented securely, the infographic highlights a dual-protocol strategy. - The mobile Driver’s License (mDL) standard, ISO 18013-5, remains a cornerstone for proximity-based and offline verification. - For online interactions, the framework relies heavily on the OpenID Connect suite, specifically OpenID Connect for Verifiable Credential Issuance (OID4VCI) for the secure delivery of attributes to the wallet, and OpenID Connect for Verifiable Presentations (OID4VP) for the sharing of those attributes with relying parties. These are frequently coupled with Decentralized Identifiers (DID) to ensure a privacy-preserving and non-trackable identity layer. Real-world utility of the wallet displayed in the graphic include use cases such as Know Your Customer (KYC) compliance, Age Verification, and seamless Payment integration, which intersects with the Payment Services Directive 2 (French acronym: DSP2). By integrating the ability to generate a Qualified Electronic Signature (Signature) directly from the wallet, the EUDIW effectively bridges the gap between public administration and the digital private economy. France Identité Playground Ressources https://lnkd.in/dNWFPMDT

#learningwithhemant #recruitment #usstaffing Poka-Yoke Concept (Mistake-Proofing): Poka-yoke is a Japanese term meaning “mistake-proofing” or “error prevention.” It was introduced by Shigeo Shingo as part of the Toyota Production System to eliminate human errors in manufacturing by designing systems or processes that prevent mistakes before they occur. The concept focuses on: 1. Preventing errors from happening. 2. Detecting errors early if they occur. 3. Minimizing the impact of errors through corrective mechanisms. --- Applying Poka-Yoke in Recruitment Recruitment involves multiple manual steps prone to human error — screening, scheduling, evaluation, documentation, and communication. Implementing poka-yoke principles helps improve accuracy, fairness, and efficiency. Here are examples of how it can be used: 1. Automated Screening Filters Use structured forms or ATS (Applicant Tracking Systems) that reject incomplete applications automatically. Example: A candidate cannot proceed unless they upload a resume or answer all mandatory questions. 2. Structured Interview Process Create standardized question templates for all interviewers to ensure consistency. This prevents bias and missed evaluation areas. 3. Predefined Evaluation Criteria Use scorecards with defined parameters (skills, communication, experience, attitude). Prevents subjective judgment and ensures every interviewer evaluates fairly. 4. Automated Reminders & Scheduling Use automation tools to send interview reminders to candidates and interviewers. Prevents no-shows and scheduling errors. 5. Verification Checkpoints Introduce steps like document verification, reference checks, and automated validation of email IDs and phone numbers. Prevents fake profiles or wrong information from slipping through. 6. Offer Letter Controls Add approval stages before sending offers. Reduces the risk of sending incorrect or duplicate offers. 7. Data Accuracy Controls Standardize data entry formats (for names, emails, phone numbers) to avoid duplication in your recruitment database. --- Expected Results Reduction in recruitment errors (wrong hiring, data mismatch, missed interviews). Improved candidate experience through consistent communication. Higher recruiter efficiency and time savings. Increased credibility and trust with clients or internal stakeholders. Better quality of hires due to systematic screening.

Excited to share this one — Checkr, Inc. ($5B background screening platform) chose Extend to process millions of screening documents. They're seeing 95-100% accuracy with 60-100% less human review time. Background screening is one of the few domains where a false positive and a false negative are both catastrophic. Flag the wrong person and they don't get the job. Clear the wrong person and you've got a much bigger problem. Now do that across court extracts, police certificates, education transcripts, and identity documents from hundreds of countries, where the templates change without notice and half the certifications are stamped or handwritten. Millions of pages of it. We sat down with Adam Litton, Staff Software Engineer at Checkr, who described an important shift in how his team ships: intaking new document types is now just about configuration, not an engineering project. Their ops subject matter experts (the people who have actually read thousands of these documents) build and iterate on the extraction themselves. My favorite line from Adam: "That decouples document coverage from engineering capacity." Loved digging into this with the Checkr team. Full breakdown in the comments.

Fintechs and Sponsor Banks: If you are dealing with long Sanctions review queues (like I used to), this new release is a game changer. Problem statement: AML/BSA exam standards require banks to show their homework on any potential watchlist hits. Take a name like Jose Lopez, of which one of our clients had 300 on the books, we could be talking about 100s of manual reviews. Solution Statement: We can solve this problem with some additional controls to our platform and make meaningful operational impacts to the process. 1️⃣ Dual score controls: A two step process that eliminates a significant percentage of the manual queue by answering two distinct questions. First does the name match? Is this a strong match candidate to the source list. Secondly, when there's a name match, your analysts answer the question, is this really the same PERSON or ENTITY that is contained on the list? By creating a second score, the Entity Correlation Score (ECS), it gives users a way to create an automated way to weed out the vast majority of false positives. Using Machine Learning and AI capabilities additional features are extracted to help answer this question. Features such as age and date of birth, gender, country of residence and name commonality indices, etc. are leveraged to show the likelihood that the entities are actually the same person. Therefore a high name score and a low entity correlation score can systemically be labeled as false positives once the organization has tested and set thresholds to determine their comfort level with the ECS outputs. 2️⃣ One click research: For the people remaining on the list that are above the probability threshold, it used to take many clicks for an analyst to get all the research data to make a call. Gen-AI tools now surface all the supporting data with one click, along with a suggestion with supporting logic. 3️⃣ Auditability: Full audit logs record all the searches and results and custom reports allow a view of all the logs, changes and results as well for both screening and also automated population monitoring. Increased efficiency with ability to show homework. For the compliance nerds out there, read about the underlying details in our blog in comments. Now live for all Socure customers. https://lnkd.in/gAyViRnP

I talk a lot about the value of digital ID credentials, but I don’t often go deeper into what makes them so secure and privacy-preserving. One of the core pieces is DIDs, a W3C standard. A DID is a unique identifier that resolves to a pair of cryptographic keys. When an organization issues a verifiable credential, it signs that credential with its private key. The organization's public key is discoverable via their DID, so anyone verifying the credential can independently confirm two things: 1) the credential was issued by the claimed issuer 2) the data hasn’t been tampered with As an analogy, you can think of a DID a bit like a URL. Just as a URL is a globally resolvable identifier for a website, a DID is a globally resolvable identifier that allows digital ID credentials to be cryptographically verified. This is the foundation that makes digital verifiable credentials trustworthy and interoperable, while still preserving user privacy.

The rise of DPRK worker impersonation schemes should be a wake up call for every enterprise, especially in tech and crypto. These aren’t just fake resumes anymore. We’re talking about coordinated operations using stolen identities, AI-generated personas, deepfakes, laptop farms, and social engineering to infiltrate organizations as “trusted employees.” Once inside, these actors gain legitimate access to systems, source code, sensitive data, financial platforms, and internal communications. (Security Boulevard) The scary part? Most companies still treat identity verification as a one-time hiring event. Modern identity assurance needs to happen continuously across the employee lifecycle: • During interviews and onboarding • During incremental trust reviews after employment begins • During credential resets and account recovery events • Anytime a worker requests access to systems they’ve never used before as part of a just-in-time provisioning workflow Why? Because worker impersonation is no longer a static fraud problem. It’s an ongoing trust problem. An attacker may successfully obtain initial credentials through deception, social engineering, insider collusion, or stolen identities. But if organizations continuously re-verify identity at critical moments of elevated risk, these bad actors become dramatically easier to detect before they can persist in the environment. This is where enterprises need to evolve beyond simple document verification or background checks alone. Identity assurance should combine: > Device trust > Behavioral analysis > Geolocation intelligence > Phishing-resistant authentication > Real-time identity verification > Escalation paths to human verification when risk is high The future of enterprise security isn’t just “who logged in.” It’s continuously answering: “Are we still confident this person is who they claim to be right now?”