A remote company issues laptops and accounts to new hires it has never met in person. A recent fraud case involved a person who used stolen personal details to get hired and obtain credentials. Which control BEST addresses this before credentials are issued?

Identity proofing establishes that a claimed identity belongs to the person presenting it before an account is created or credentials are issued. It typically involves collecting identity evidence such as government-issued documents, validating that the evidence is genuine, and verifying that the person presenting it is its rightful owner, for example through a supervised live video check, before linking the result to the HR record. That is precisely the gap a fraudster with stolen personal details exploits. Emailing credentials to the address on a resume trusts information the applicant supplied, so an impostor simply receives the credentials. Enrolling a fingerprint at first login binds the account to whoever shows up; it proves continuity, not that this person is the identity that was hired, so the impostor's own fingerprint becomes the trusted factor. Self-registration on the first day skips verification altogether and hands account creation to an unverified individual. Exam caveat: identity proofing happens once, at enrollment, while authentication happens at every subsequent login; strong authentication cannot compensate for weak proofing. Operational check: confirm the onboarding workflow records the proofing method and verifier for each hire and blocks credential issuance until that record is complete.