The Coworker With Full Access to Your Data May Not Be a Real Person

There might be someone at a company right now with access to the payroll system, the source code, the customer database — and that someone was never a real person to begin with. Not a hacker who stole a login. An entire employee. Fabricated from nothing. Complete with a resume, a face, and a work history that passed every check on the way in.

If you've ever filled out onboarding paperwork for

If you've ever filled out onboarding paperwork for a job, this is about the exact process that let you in. And it's the same process a fake person can walk through. A new paper covered by Homeland Security Today looked at how companies verify who they're hiring — and found a gap wide enough to drive a synthetic identity through. If that unsettles you, good. That feeling is the start of understanding it. So how does a company end up trusting someone who doesn't exist?

Start with something surprising about who gets the toughest identity checks. According to that Homeland Security Today report, the people with government clearances get vetted hard — deep background checks, ongoing review. But the folks in IT, finance, and administration? Often they don't. And those are exactly the roles that touch sensitive systems every single day. So the person who can export your whole customer list may have faced a weaker identity check than someone with no access at all. That's the backwards part.

Now, why is that suddenly so dangerous? Because A.I. got good at manufacturing people. Not just stolen passwords — full identities. A face, a name, a social security number, a profile history that all hang together. The report from Recorded Future found synthetic identity document fraud jumped three hundred percent in just the first quarter of 2025. And deepfake-enabled fraud? Up more than tenfold since the start of 2024. That's not slow drift. That's a specific attack vector going vertical.

Here's the mechanism that makes it slip through. Older fakes worked like holding a doctored photo up to a webcam — the system could sometimes spot the screen. The newer trick is called an injection attack. Instead of showing fake media to the camera, it feeds the fake image straight into the verification pipeline. Those injection attacks spiked seven hundred and eighty-three percent from 2023 to 2024. And the reason they succeed is the hard part to wrap your head around. The system checks whether the face matches the document. And it does match. A synthetic face lines up perfectly with a synthetic ID. The system is internally consistent — everything agrees — while being completely fake. Neither piece is real, but they match each other, so the check passes.

For a security team, that means their front door

For a security team, that means their front door lock is confirming a lie. For the rest of us, it means the coworker on the video call might be an image with no human behind it.

And that's what makes a fake insider scarier than a bad one. A real employee who goes rogue has a trail — old managers, references, an actual life you can investigate. A synthetic insider has none of that. There's no one to fire. No one to prosecute. Nothing to trace when things go wrong.

So why do companies keep treating identity as a one-time gate? Because hiring runs on speed. Fill the role, move on. Re-checking someone's identity every time their access grows feels like red tape, not safety. The mental model says: pass onboarding once, and you're trusted forever.

That model is the whole problem.