Candidate identity verification for a remote developer means proving three things line up: the government ID, the face on your interview call, and the name on the bank account you pay. Most companies check one of the three, once, at the offer. Fraud schemes live in the gaps between them. The FBI's advice is to verify identity "during hiring, onboarding, and throughout the employment of any remote worker", and that's the right frame for a contractor in Mexico City as much as an employee in Austin.
Key Takeaways
- Identity verification (IDV) is an ID document check plus a liveness or selfie match, tied to the person who actually interviews.
- Form I-9 generally doesn't apply to independent contractors or people working outside the US, so remote LATAM hires need a different check.
- Colombia's three official records certificates are free online; Mexico's federal criminal-records certificate costs $240 MXN and the candidate (or someone they authorize) has to request it.
- A background check run through a US screening company triggers FCRA disclosure and consent rules.
What candidate identity verification actually includes
Strip the vendor marketing and IDV is two steps. The candidate photographs a government ID, and the system checks it looks genuine. Then the candidate takes a live selfie or short video, and the system checks it's a live person who matches the ID photo. Unit 42 (Palo Alto Networks) recommends exactly this, ID document plus liveness, matched to the person who shows up to interview. The matching is the part people skip.
If you want a standard to point at, NIST's digital identity guidelines, SP 800-63-4, were finalized in July 2025. They define assurance levels. IAL2 "requires collecting additional evidence and more rigorous processes for validating evidence and verifying identities" and can be done remotely. That's roughly the level a remote engineering hire with production access deserves. IAL3 needs an in-person or attended session, which is overkill for most startups.
Vendors that sell this include Persona, Onfido (now part of Entrust), Veriff, Jumio, Socure and CLEAR, which Greenhouse integrates. I haven't verified their pricing, so I won't quote it; get quotes.
Why I-9 doesn't cover your LATAM contractor
US employers know Form I-9. It doesn't help here. The USCIS handbook lists people you don't complete an I-9 for, including "Independent contractors" and people "Not physically working in the United States or its territories." So a contractor writing code from Medellin gets no federal identity check by default. Nothing stops you from running your own, and you should.
(General information, not legal advice. If the person will ever work from inside the US, talk to an immigration lawyer, because the rules change.)
Background checks in Latin America: the free and cheap options
Many LATAM countries publish official records certificates the candidate can pull themselves. Two examples:
| Country | Certificate | Cost | Who requests it |
|---|---|---|---|
| Colombia | Judicial records (Policia Nacional), disciplinary (Procuraduria), fiscal (Contraloria) | Free online (Policia Nacional; El Universal) | Anyone with the cedula number |
| Mexico | Constancia de Antecedentes Penales Federales (OADPRS) | $240 MXN fixed fee, about 72 hours | The person, a guardian, or a representative with a carta poder |
Two cautions. Mexico's constancia covers federal records only, and state records are separate. And a certificate the candidate sends you is a PDF; check it on the issuing portal where that's possible. And in Mexico, the Supreme Court has reportedly treated a blanket demand for a criminal-records certificate as discriminatory when the role doesn't justify it (El Imparcial, July 2026), so ask for it only where the access genuinely warrants it, and ask local counsel first.
If you instead hire a US background-check company, the Fair Credit Reporting Act kicks in. You need a written disclosure "in a stand-alone format", written permission, and a pre-adverse-action notice with a copy of the report before rejecting someone because of it. The same FTC/EEOC page warns that a background policy with disparate impact must be "job related and consistent with business necessity."
The three-point identity check
| When | Check | Catches |
|---|---|---|
| Before the final interview | IDV: document + liveness | Stolen or fake identity |
| During the final interview | The face on the call matches the IDV selfie; camera on | Proxy interviewer, deepfake |
| Before access and first payment | Payment account and shipping address match the ID name and address | Laptop farms, third-party payment routing |
The third row matters more than it looks. The 2022 State/Treasury/FBI guidance on North Korean IT workers says to be "particularly suspicious if a developer claims they cannot receive items at the address on their identification documentation." Our post on North Korean IT workers goes through those flags.
A Concrete Version
A 20-person B2B SaaS company hires a senior Python contractor in Guadalajara. Here's a check that costs a few dollars and a couple of hours.
- Day 0, after the second interview: the candidate gets an IDV link from whichever vendor you picked. Takes them five minutes. You get a pass with the ID photo and a liveness selfie.
- Day 1, final interview: your interviewer has the selfie open in another tab. Same person. Camera on the whole call.
- Day 2, offer: because the role has production access to payment data, you ask for the federal constancia (optional elsewhere). The candidate requests it on the OADPRS site, pays $240 MXN (you reimburse it), and sends it about three days later.
- Day 5, contract: the payment details are in the candidate's own name. The laptop ships to the address on the ID.
Elapsed time barely moves, because everything runs in parallel with the offer. Total cost is the IDV fee plus about $13 for the certificate at current exchange rates. Compare that to giving repo access to someone you never actually identified.
The Honest Counterpoint
IDV has real costs beyond the fee. You're collecting government IDs and biometric selfies, which is sensitive data; you need a retention policy and a vendor whose security you trust. If any candidate is in Illinois, biometric selfies also bring BIPA's written-consent rules. Some candidates will drop out of a process that asks for an ID before an offer, and some of those are good engineers who've had their data leaked before. Asking at the final stage, not the first, keeps that loss small.
IDV also proves identity, not skill or honesty. A real person with a real ID can still fake a resume or outsource the work. You still need a hard technical evaluation and reference checks.
Here's where Ruzora stands, plainly. Every engineer on our bench passed a graded coding assessment and an AI-led technical interview; how we vet lists the further steps (a live English conversation, a founder screen, reference checks). On the buyer side, Sol, our hiring agent, shows blind profiles first, so the identity check naturally lands after the MSA and before access. We do not run ID-document or liveness checks today. Proof-of-human interviews with liveness are on our roadmap, not live. So if you hire through us, run the identity steps above yourself once identities are shared after the MSA.
Frequently Asked Questions
How do you verify a remote candidate's identity?
Run an ID document check plus a liveness selfie through an IDV vendor, then confirm the person on your final interview matches that selfie. Before granting access or paying, check that the bank account and shipping address match the ID.
Do I need an I-9 for a contractor in Latin America?
Generally no. USCIS lists independent contractors and people not physically working in the US among those you don't complete Form I-9 for. That means no default federal check, so run your own identity verification. This is general information, not legal advice.
Is a background check in Mexico free?
Not at the federal level. The Constancia de Antecedentes Penales Federales costs a fixed $240 MXN and the candidate requests it. Colombia's police, Procuraduria and Contraloria certificates are free online.
The Bottom Line
Candidate identity verification only works when the ID, the face on the call and the payment account point to the same person. Check all three, at the final stage, and keep watching after the start date. It costs little and closes the gaps fraud schemes depend on.
If you want the technical side handled before you meet anyone, browse engineers who already passed our coding assessment and AI-led interview.
Roberto Espinoza is CEO of Ruzora, which helps US startups hire pre-vetted senior LATAM engineers, with a vetted shortlist in 72 hours. See available engineers.
