Earlier this year, we wrote about our Identity Verification product. In the original article, we talked about what Identity Verification provides and what its capabilities are. In this mini article, however, we wanted to revisit this product with a focus on why it’s so important to verify a person’s identity before engaging with them.
A Brave Example
The well-known security awareness company, KnowBe4, recently made public the fact that they had been victim of a North Korean plot to infiltrate their systems. Considering the nature of their business, this took a lot of guts to come out and say publicly. If anyone should understand the importance of corporate security, it should be KnowBe4, right?
The attack was fairly simple: steal a real person’s identity, apply for a job at KnowBe4 using that stolen identity, then use the company equipment (login credentials, laptop, key fob, or whatever else is mailed to remote employees during the onboarding process) to infiltrate their network and cause as much damage as possible.
It worked. In late July, 2024, KnowBe4 made an announcement that shocked us all: they had mistakenly hired this individual, sent them a company laptop, and then watched in horror as the fake employee attempted to upload malware to their systems.
With that said, we commend KnowBe4 for coming out publicly and talking about this incident. It goes to show that even the industry’s leading security companies can be victim to these kinds of attacks. If it can happen to them, it can happen to you.
In the case of KnowBe4, they got lucky and stopped the attack in its tracks. The attackers were unable to do any real damage and, to our knowledge, were not able to exfiltrate any sensitive information either. You can read the full description of the attack in their blog article that we linked to above.
How does ID Verification play into this?
As we discussed in our previous article, there are a lot of great pieces of data that can come back in an Identity Verification search. Not only are you finding out if the information that the consumer entered is correct (we compare the given name, dob, and address to what’s been reported by the credit bureaus), but we’re also able to tell you if there is anything else suspicious about the data we found:
• Are there too many phone numbers or SSN’s associated with the individual’s data?
• Was the SSN issued before the person was born?
• Are they reported deceased?
• Was the address they provided current? Is that address considered a “high frequency” address like a PO Box?
• Did the given name match the primary name or an alias?
These are all things that can help spot potential fraud. Does it mean that you should strike this person from the books and deny them an opportunity? Absolutely not! That’s not ethical, and in most cases, it’s not legal either. It does, however, mean that you should take a closer look at them and sus out any discrepancies.
KnowBe4 said it best in their own article:
WHAT TO LOOK OUT FOR:
• Use of VOIP numbers and lack of digital footprint for provided contact information
• Discrepancies in address and date of birth across different sources
• Conflicting personal information (marital status, “family emergencies” explaining unavailability)
• Sophisticated use of VPNs or VMs for accessing company systems
• Attempt to execute malware and subsequent cover-up efforts
Link to article here.
These are all low hanging fruit that anyone can verify to help ensure corporate security. If they’re not already part of your hiring process, talk to your background screening company or HR department about having them added.
USinfoSearch can help you harden your corporate security strategy by providing you with the tools to detect and mitigate fraud. This is important not only for your hiring practices, but also for your customer credentialling and onboarding processes.
If anything in this article made you raise an eyebrow or second guess what your company is doing to vet its employees and customers, please pick up the phone and reach out to our sales team. We’ll be happy to walk you through our products and show you how they can help strengthen your business and reduce the risk of fraud.
