It’s Not What you Know, It’s Who You Know - Identity Vetting in the Age of AI

Hired any North Koreans lately? If you have, you’re not alone. In the past few years, thousands of North Korean workers have been hired by prominent companies in the US, from small firms to Fortune 500 companies. 

This is not a new problem either. In fact, investigators have found evidence of this operation, dubbed “WageMole”, as far back as 2020. WageMole is widely known to be the work of a non-centralized threat group known as UNC5267, which uses stolen identities to get North Koreans hired at tech firms so they can gain access to systems and generate income for the regime.  

Companies who have fallen prey to this scam have faced costly repercussions, as some of these individuals have used their ill-gotten access to infiltrate sensitive data, steal money, and disrupt operations. 

So, if we have known about it for years, how could this still happen? 

Part of the reason is that the problem has become rapidly worse with the advent of AI technology, which enables attackers to cover more ground in less time. AI tools make it simple to quickly generate false documents and instantly translate communications in real-time. 

But what about video interviews, you might ask. Won’t that help us weed out imposters?  AI technology also allows the attackers to hide their true identities, with deep fake videos and AI-generated voices designed to mask their faces and accents. 

The truth is that in a world of impersonators and deep fake technology, without robust identity vetting you may never really know if that new remote worker or collaborator is, in fact, who they claim to be. 

How Does Identity Vetting Work?

Identity vetting offers a way to avoid situations like this, by offering you a way to verify the identity of users BEFORE you give them access. This additional security measure helps you prevent fraud and satisfy compliance mandates like Know Your Customer (KYC) or Anti-Money Laundering (AML).

The identity vetting process is generally made up of four steps: collection of evidence, identity verification, risk assessment, and determination. 

The first step involves collecting information. As part of the onboarding process, the person provides their personal information and documentation to establish their identity. The information collected could include name, address, date of birth, documents such as birth certificate, passport, or government-issued identification, and even biometric data such as fingerprints. 

Next, the identity information that has been collected has to be verified by trusted sources. This could involve checking the information against records kept by credit agencies, government databases, and biometric matching. 

With these results in hand, the next step is to assess the level of fraud risk based on your confidence in the results of your verification. Were there any inconsistencies or unexplained discrepancies? 

Finally, it’s time to make a determination to verify the user’s identity, reject it, or elevate it for further review.  

Benefits of Identity Vetting

Identity vetting provides protection against imposter threats with multi-layered and technology-driven user verification.  

Identity vetting, often referred to as identity verification or proofing, is the process of confirming that an individual is genuinely who they claim to be. It's a critical practice that offers substantial advantages for individuals, enterprises, and the broader digital landscape. 

For businesses, key benefits include:

• Fraud Prevention: Identity vetting prevents various forms of fraud like stolen identity misuse, new account schemes, hybrid identity fabrication, account compromise, and payment fraud.
• Compliance: Vetting new users is essential for helping organizations meet stringent compliance requirements.
• Proactive Risk Management: Identity vetting ensures only authorized individuals access sensitive data, enhancing overall security and minimizing financial losses.

How to Implement Identity Vetting 

But how can you get there from here? Putting identity vetting into practice isn’t just about flipping a switch. You've got to think about the whole journey your users take and select the right tools for the job. For your organization, hiring an outside firm to do background checks may be the right solution, or maybe you need to go a step further with biometrics and other vetting procedures. And, as always, whatever identity vetting method you choose, you want the solution to be seamless and frictionless for you and the users you are verifying. 

Ready to get started? KeyData Cyber's Identity Vetting Assessment is designed to give you a clear picture of where you stand and what steps you can take to strengthen your defenses. Contact us today for a complimentary Identity Vetting Assessment so you can make sure your next hire is the right hire.