Free tools Windows power users keep installed
One-click scans. No signup required.
HYPR’s 2026 research says 98% of fake hires had active corporate credentials and internal network access by the time they were detected. That is not the same statistic as the separate finding that 98% of surveyed HR executives said they had encountered candidate fraud firsthand: the first describes reported cases and access, while the second describes HR respondents’ experience.
What HYPR’s two 98% findings mean
In a September 15, 2026 release, identity-security company HYPR reported two distinct results from separate research efforts. In its survey of 500 U.S. HR leaders, 98% said they had encountered candidate fraud firsthand. In its findings on fake hires, HYPR reported that 98% had received active corporate credentials and internal network access by the time they were detected. The figures have different denominators and should not be read as saying that 98% of hires were fraudulent.
As an Amazon Associate I earn from qualifying purchases.
HYPR also reported that 42% of organizations detected hiring fraud only after the person’s first day, and that discovery typically took four to six days. These results suggest that, in the incidents covered by the research, a hiring process could move from candidate screening to real workplace access before an organization recognized the fraud.
How the research was conducted—and what it can establish
HYPR says its 2026 State of HR Identity Fraud Detection research surveyed 500 U.S. HR leaders working in Talent Acquisition, HR Operations, and HR Technology. HYPR combined those findings with a separate 2026 passwordless identity assurance study, produced with S&P Global / 451 Research, which surveyed 950 IT security decision-makers across the U.S., EMEA, and APAC. The HR and IT security populations are not one combined survey, and findings from one should not be attributed to the other.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The figures are vendor-published survey findings, not an independently audited count of fraudulent hires across all employers. HYPR’s public release does not establish the full question wording, recruitment method, response rate, weighting, or independent validation. They are useful indicators of what respondents reported, but they do not establish a population-wide fraud rate or prove that any particular identity-verification product prevents these incidents.
Who detects fake hires, and when
HYPR reported that human observation and intuition uncovered 68% of fraudulent hires in the HR research. That points to a detection process in which colleagues or managers may notice inconsistencies after onboarding, rather than a single automated gate reliably identifying every case before access is issued.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A separate figure in HYPR’s broader identity research says security tools caught 53% of enterprise identity-based attacks; the remaining 47% were found through coworker reports, internal audits, and external notifications. This result concerns identity attacks generally, not hiring fraud specifically, so it should not be used to claim that security tools detected 53% of fake hires.
Recommended Free Tools
Responsibility shifts after access is provisioned
HYPR’s findings describe a potential ownership gap across the employee lifecycle. Before day one, 53% of responses about identity-risk responsibility named HR leaders, compared with 17% naming IT and security. After credentials were created, security and IAM claimed 55% of responsibility, while HR’s share fell to 15%.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These figures are about reported responsibility, not a demonstrated measure of which team performed better. Their practical implication is that organizations need to make the handoff explicit: who confirms the person’s identity before onboarding, who approves credential issuance, and who responds if concerns emerge once access is active.
Why discovery is only part of the incident
HYPR says remediation can take weeks. In the 2026 findings, 24% of organizations said fully resolving one fake-hire incident took one to three months. The public release does not define exactly when “full resolution” starts or ends, so the interval should not be interpreted as a precise time to revoke credentials or remove network access. It may cover a broader response and recovery process.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
HYPR CEO and co-founder Bojan Simic framed the risk this way: “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT.” That is the company’s interpretation of the threat, rather than an independent conclusion established by the survey.
What employers can review across the hiring lifecycle
The findings support a governance review, not a one-product fix. HYPR’s report landing page describes coverage from screening and onboarding through credential access and active employment. Employers can use that lifecycle to identify where identity confirmation happens and where responsibility changes hands.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Screening and interviews: Decide what evidence is used to confirm that the candidate is the person represented in the application and interview process.
- Before credentials are issued: Assign a named owner for identity checks and define what must be complete before IT provisions accounts or network access.
- At each handoff: Specify who shares verification status between recruiting, HR operations, IT, and security, and how unresolved concerns are escalated.
- During employment: Establish how identity-related concerns are reviewed after onboarding rather than treating verification as a single pre-hire event.
- When fraud is suspected: Define who can suspend credentials and access, preserve relevant evidence, and coordinate the wider incident response.
These are decision points, not a validated ranking of controls. The public findings do not establish that biometrics, document checks, multifactor authentication, passwordless sign-in, or any single commercial product would by itself stop the reported fraud. HYPR describes its own product category as enterprise identity assurance combining passwordless authentication, adaptive risk mitigation, and automated identity verification; that is vendor positioning, not evidence that its product prevented the incidents in the survey.
Quick Recap
Sources
- HYPR: 2026 State of HR Identity Fraud Detection Report and its September 15, 2026 announcement, “Nearly All Fraudulent Hires Gain Active Corporate Credentials Before Detection, HYPR Research Finds.”
- HYPR: 2026 State of Passwordless Identity Assurance Report, produced with S&P Global / 451 Research.
- IT Brief Asia: Mara Sugue, “Fraudulent hires get credentials before detection, HYPR,” October 2, 2026.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
