The finance employee sat down for what looked like a routine video call with his CFO. Forty-seven minutes later, he had wired $25 million to accounts in Hong Kong. The CFO was a deepfake. Every person on that call was a deepfake. And no one in the room caught it until the money was already gone.

That was February 2024. The victim was a multinational firm based in Hong Kong, and the story was confirmed by city police. If your company moved to remote work and never updated how it verifies who is actually on the other end of a login or onboarding call, you are looking at a version of your own future.

Remote Work Did Not Create Identity Fraud. It Handed Identity Fraud a Skeleton Key.

Before 2020, most companies verified employee identity the way your grandmother verified a check: in person, with a photo ID, by a human who could ask follow-up questions. Then 75 million Americans shifted to remote work almost overnight, according to a 2023 Pew Research Center survey, and the in-person handshake disappeared entirely.

The FBI reported a 300 percent increase in cybercrime complaints between 2019 and 2022. Identity fraud was not a minor contributor to that number. It was a core driver. Fraudulent job applicants, ghost employees collecting paychecks, and nation-state actors embedding operatives inside remote teams became documented, repeated problems, not edge cases.

In 2023, the U.S. Department of Justice indicted 17 individuals in a scheme where North Korean IT workers used stolen American identities to get hired at U.S. tech companies, funnel wages back to Pyongyang, and access sensitive internal systems. Does your onboarding process even ask where an applicant’s device is physically located at the time of sign-in?

That is the world these verification systems were built for.

Did You Know: A 2024 ACFE (Association of Certified Fraud Examiners) report found that organizations lose an estimated 5 percent of annual revenue to fraud each year. Remote work environments, where physical oversight is limited, are increasingly flagged as high-risk exposure points.

The Security Argument Is Stronger Than You Want It To Be

Companies implementing biometric verification are not being paranoid. They are responding to documented, quantifiable losses.

The current leading systems work through a layered approach. Think of it this way: just as a bank vault uses both a combination and a physical key, modern identity verification stacks combine something you know (a password), something you have (a device token), and something you are (a face scan or fingerprint). Remove any one layer, and the vault is easier to crack.

Firms like Jumio, Persona, and Onfido now offer real-time document verification crossed against liveness detection, a technology that confirms you are a live human in front of the camera rather than a photograph or a deepfake video. Onfido published internal data in 2023 showing their liveness detection reduced fraudulent onboarding attempts by 91 percent across their client base.

Microsoft’s 2023 Digital Defense Report documented a 130 percent year-over-year increase in password-based attacks. Passwords alone are not a verification system anymore. They are a speed bump.

Here is what the actual research shows: companies that deploy multi-factor biometric verification report significantly lower rates of account takeover and fraudulent hiring. The security case is not theoretical. It is backed by loss data, federal indictments, and a $25 million wire transfer that nobody in Hong Kong got back.

The Argument Against Is Also Backed by Real Data

So why are employees, privacy advocates, and state legislatures pushing back hard?

Because the data that makes these systems work does not disappear after verification. It is stored, often by third-party vendors, and governed by a patchwork of state laws that most employees have never read and most HR departments cannot fully explain.

Illinois passed the Biometric Information Privacy Act (BIPA) in 2008, and it remains one of the strictest biometric privacy laws in the country. Between 2019 and 2023, over 1,400 BIPA lawsuits were filed, many against employers who collected facial geometry or fingerprints without clearly disclosed retention schedules. In 2023 alone, BIPA settlements exceeded $1.5 billion, according to law firm Seyfarth Shaw’s annual BIPA litigation report.

The problem is not the scan itself. The problem is what happens afterward. Ask yourself why the vendors do not advertise the data retention terms in their marketing materials. You will not find “We store your facial geometry for seven years with twelve approved subprocessors” on any homepage.

Warning: Many biometric verification platforms operate under vendor agreements that allow data sharing with subprocessors, meaning your face scan may be processed and stored by companies you have never heard of and did not consent to directly. This is legal in most U.S. states. It is not disclosed in the sign-here onboarding flow.

A 2022 study by the Electronic Frontier Foundation found that workers in low-wage and gig economy jobs were disproportionately subject to biometric monitoring with the least legal recourse when things went wrong. The burden of these systems is not distributed evenly, and that matters when you are evaluating whether the tradeoff is worth it.

If your company went fully remote in 2020, when did you last audit your identity verification stack against current state biometric law?

Where I Actually Land

Both sides have legitimate arguments. But they are not arguing about the same thing.

The pro-verification side is arguing about whether fraud is real and costly. It is. That argument is essentially won.

The anti-verification side is arguing about whether companies can be trusted to collect, store, and protect biometric data responsibly. Based on the litigation record and the vendor contract structures currently in use, that is a much harder case to make for the companies.

The verification technology works. The governance around it is a mess. Those are two separate facts, and you can hold both without contradiction.

The answer is not to abandon biometric verification. Remote teams are too exposed without it. The answer is mandatory third-party audits of biometric vendors, standardized retention limits, and federal legislation that fills the gaps BIPA was never designed to cover nationally. Until that framework exists, employees are right to ask sharp questions before they scan.

Pro Tip: Before signing any remote onboarding agreement, search the vendor name plus the word “subprocessor” in your state attorney general’s public complaint database. It takes about four minutes. It has surfaced real issues for people who looked, and real legal exposure for companies that did not want them to look.

And who benefits from you not knowing this? Not you, and not your employer. The vendors who profit from data-sharing agreements with the least regulatory oversight are the ones with the most to lose if workers start reading the fine print.

Your Next 3 Steps

Step 1 (For employees): Go to your onboarding email or HR portal today and search for the name of any biometric vendor mentioned in your consent documents. Search that vendor name plus the word “subprocessor” in your state attorney general’s public complaint database. If retention language exceeds 12 months or lists more than three subprocessors, email HR in writing and ask for the vendor’s most recent iBeta audit result or equivalent third-party security certification. Put it in writing. That creates a paper trail that protects you.

Step 2 (For HR leads and people operations teams): Pull your current identity verification vendor contract and locate the data retention clause before your next renewal date. Run your onboarding stack against the ISO 30107-3 compliance checklist for liveness detection. If your vendor cannot produce a current iBeta Presentation Attack Detection audit result on request, that is a red flag worth acting on before the next BIPA-style legislative expansion in your state. Thirteen states introduced biometric privacy bills in 2023 alone.

Step 3 (For freelancers and contractors): You have less protection than full-time employees under most biometric privacy statutes. Before completing any biometric verification for a new client or platform, send a direct written question to the hiring contact asking which third-party vendors receive your biometric data, under what retention schedule, and whether you can request deletion upon contract completion. Legitimate companies can answer this. Companies that cannot answer it are telling you something important.