Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

If an employee or contractor may be using someone else’s identity, treat the situation as an unproven allegation—not as proof of fraud or unauthorized work. Preserve the information that triggered the concern, restrict access to it, protect company systems, and involve employment, immigration, privacy, and data-security counsel before requesting new documents or taking disciplinary action.

Use the ordinary Form I-9 and E-Verify procedures for covered employees. An E-Verify mismatch or tentative nonconfirmation can result from a spelling error, name change, status update, outdated government record, or employer data-entry mistake. It does not, by itself, establish identity theft or show that the worker is unauthorized.

Start with a neutral, controlled response

The first objective is to protect people, systems, and evidence while giving the worker a fair process. Do not announce that an employee is a “thief,” circulate the allegation widely, or make an employment decision based on a single database result.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

1. Record what triggered the concern

Create a dated, factual record of what was observed, when it happened, who observed it, and which accounts, devices, records, or transactions may be involved. Distinguish facts from assumptions. For example, “The Social Security number on a payroll record is associated with a different name in a vendor alert” is a fact; “The employee stole an identity” is an unproven conclusion.

#1 Best Overall
Sale
Nicpro Mechanical Carpenter Pencils for Construction (Black, Red) With Case
  • Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
  • Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
  • Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
  • Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
  • Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons

2. Limit circulation

Give the information only to people who need it to investigate or protect the organization, such as designated HR, security, legal, privacy, or compliance personnel. Avoid group email, informal chat, or discussions with coworkers who have no role in the inquiry. Restricting circulation reduces reputational harm and helps preserve a reliable investigative record.

3. Protect systems without prejudging the worker

If credentials, tokens, devices, or privileged accounts may be compromised, follow the incident-response plan. A controlled credential reset, temporary access restriction, or enhanced monitoring may be appropriate when based on a documented security risk. Coordinate the change so that logs and other evidence are preserved. Do not abruptly disable a person merely because a record looks unusual unless counsel and security personnel determine that immediate containment is necessary.

Identify which problem you are actually handling

“Stolen identity” can describe several different situations. The response depends on whether the concern involves an employment document, an account, or a larger exposure of personal information.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Situation What it may involve Immediate focus
Possible false or stolen employment document An identity or work-authorization document does not appear to belong to the person who presented it. Preserve the document-related records, obtain legal advice, and use the standard Form I-9 process without demanding a particular replacement document.
E-Verify DHS or SSA mismatch Information entered in E-Verify does not match Department of Homeland Security records or data available to the Social Security Administration. Give the required notice and opportunity to contest or correct the mismatch; do not take adverse action solely because of the result.
Compromised employee or contractor account Someone may have used another person’s password, token, mailbox, device, or remote-access credentials. Contain access in a controlled manner, rotate credentials, preserve logs, and investigate authentication and activity records.
Broader personal-information breach Payroll, tax, customer, health, Social Security, financial, or other personal information may have been accessed or copied. Activate the breach plan, preserve evidence, assess notification duties, and coordinate with counsel and law enforcement.

Understand the Form I-9 and E-Verify boundaries

Form I-9 applies to covered employees

Form I-9 is required for employees hired after November 6, 1986. The employer examines documents establishing identity and employment authorization, and the employee generally chooses which acceptable documents to present from the Lists of Acceptable Documents. E-Verify is an electronic check used by participating employers in addition to the Form I-9 process.

Rank #2
Sale
DEWALT 20V MAX Drill and Impact Driver (DCK240C2) | Includes 2 Batteries, Charger and Bag (
  • Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
  • Both tools are designed to fit into difficult to reach spaces
  • Complete a wide range of applications with a high-performance motor that delivers up to 300 UWO, and an impact driver delivering up to 1,400 in-lbs of torque
  • Both the DEWALT impact driver and drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
  • One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips

These systems verify information under their own rules; they are not a general-purpose identity-theft investigation. A discrepancy should be handled through the process that produced it rather than converted into a demand for extra proof.

Do not demand a particular or extra document

An employer may not insist on a specific document, request more documents, or reject acceptable documents because of citizenship, immigration status, national origin, accent, appearance, or a perception that a worker is foreign. A request such as “bring a new Social Security card because your name looks unusual” can create discrimination and document-abuse risk.

If a document appears questionable, obtain advice on the appropriate next step. Do not improvise a separate document standard for one person or group. Apply the same Form I-9 rules consistently to similarly situated workers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not automatically redo an existing employee’s I-9

An existing employee’s suspected identity issue does not give an employer a blanket license to demand a new I-9 or new documents. Whether a new form, correction, reverification, or other action is permitted depends on the facts, the reason for the request, the employee’s status, and applicable federal and state rules. Ask employment and immigration counsel before starting a re-verification exercise. Counsel can also help determine how to document a legitimate correction without creating the appearance of retaliation or discrimination.

Rank #3
Sale
Push to Unlock,Katerk 6pcs 1/4 inch Hex Shank Aluminum Alloy Screwdriver Bit Holder Light-Weight Quick-Change Extension Bar Keychain Drill Screw Adapter Portable,Black Carabiner,Tool Gifts for Men
  • 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
  • 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
  • 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
  • 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
  • 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.

Handle an E-Verify mismatch correctly

What a mismatch means

Official E-Verify guidance states: “A DHS or SSA Tentative Nonconfirmation (mismatch) results when the information entered in E-Verify does not match DHS records or data available to SSA.” The same guidance states: “A mismatch does not necessarily mean that the employee is not authorized to work in the United States.”

Common explanations include a misspelled name, a name change that has not propagated through records, a status change, an outdated government record, or an employer’s data-entry error. A mismatch is therefore a signal to follow the resolution process, not a finding that the worker stole an identity.

Give the employee the required opportunity to contest

Provide the notice and instructions required by the applicable E-Verify process, explain the deadline and available method for contesting the result, and allow the employee to correct the information or work with the appropriate agency. Keep a record of when the notice was provided and what procedural steps were completed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

EEOC guidance says an employer must not fire, suspend, modify a work schedule, delay job placement, or otherwise take adverse action merely because an employee received a tentative nonconfirmation. Do not reduce hours, remove a shift, deny a promotion, or place the person on unpaid leave to pressure a quick resolution. Any separate employment action must rest on a documented, lawful reason unrelated to the tentative nonconfirmation.

Rank #4
Sale
2 Pack Carpenter Pencils Mechanical Pencils with 12 Refills, (2 Colors)
  • Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
  • Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
  • Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
  • Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
  • Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed

When the person is an independent contractor

An independent contractor is not handled identically to an employee. Review the written agreement, the contracting company’s responsibilities, access rights, and any confidentiality or security clauses. Do not assume that an E-Verify or Form I-9 procedure applicable to your employees automatically applies to an independent contractor.

Separate identity questions from performance or contract issues

If the concern is that a contractor’s account was used by someone else, investigate authentication, device, and access records. If the concern is that the contractor supplied false information, let counsel determine whether the contract permits suspension, replacement personnel, or termination and what notice is required. Avoid using a suspected identity issue as a pretext for an unrelated contract dispute.

Coordinate with the contractor’s organization

For a contractor supplied by another business, notify the designated contact through the contractual channel and share only the information needed to protect systems and investigate. Confirm who will preserve the worker’s records, conduct interviews, notify authorities, and communicate with affected individuals. Keep your own evidence and decision log even when the other organization leads the personnel investigation.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Investigate possible company or customer-data exposure

Assemble the right team

Bring together employment or immigration counsel, privacy or breach counsel, HR, information security, and qualified forensic specialists. The Federal Trade Commission advises moving quickly to secure systems, using legal and forensic expertise, and avoiding destruction of evidence during investigation and remediation.

Best Value
Milwaukee 48-22-3104 Inkzall Point Marker, Fine, Black, 4-Pack
  • Milwaukee Ink all Fine Point Marker, Black, 4 Per Pack
  • 4 per pack Features Clog Resistant Marker Tip Writes through Dusty, Wet and Oily Surfaces Durable Marker Tip for Writing on Concrete, OSB and Rough Surfaces
  • Clog resistant tip writes on dusty, wet and oily surfaces and is optimized for rough surfaces such as OSB, cinderblock and concrete
  • Hard hat clip- attaches for easy access
  • Quick dry time with reduced smearing and marking

Preserve evidence before cleaning up

  • Retain authentication, endpoint, email, VPN, payroll, access-control, and application logs according to the incident plan.
  • Preserve relevant devices, accounts, messages, documents, and physical-access records.
  • Capture forensic images when appropriate instead of repeatedly altering the original device.
  • Record who collected each item, when, from where, and how it was stored.
  • Do not delete suspicious files, reset every system indiscriminately, or overwrite logs before forensic personnel advise that preservation is complete.

Contain access in a measured way

Rotate exposed credentials, revoke tokens, enforce multifactor authentication where available, and isolate affected systems when the technical evidence supports those steps. A containment action should identify the account or system at risk, the reason for the action, the approving person, and the expected review time. Maintain essential business continuity and avoid exposing additional personal information while investigating.

Determine what information may be involved

Identify whether the event involves Social Security numbers, payroll or tax data, financial information, health information, customer records, authentication secrets, or only an employment-record discrepancy. Establish the affected systems, time period, number and location of people, and whether information was accessed, acquired, or merely exposed. These details drive legal, contractual, and communications decisions.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Decide whether to report or notify

Assess applicable duties with counsel

Notification requirements vary by state and may also arise from contracts, industry rules, or the type of data involved. Ask counsel to assess the states connected to affected individuals, the organization’s location, sector-specific obligations, contractual commitments, and any law-enforcement considerations. Do not assume that one notice satisfies every jurisdiction.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Coordinate with law enforcement

The FTC recommends notifying law enforcement when appropriate and coordinating timing with investigators. Counsel and investigators can help determine whether an early report could protect other victims, support recovery, or interfere with an active investigation. Preserve the underlying evidence and provide a consistent factual account.

Notify affected people when required or appropriate

If personal information may have been compromised, determine who must be contacted, when, and by what method. A useful notice explains what categories of information were involved, the relevant period if known, what the organization has done, and practical steps people can take to reduce identity-theft risk. Avoid speculation about the employee or contractor and do not disclose unnecessary personnel details.

The FTC’s 2013 guidance estimated that nine million Americans have their identities stolen each year. That estimate is national and dated, but it illustrates why exposure of Social Security numbers or financial information should be treated as a potential harm to affected individuals, not merely as an internal HR matter.

Use this decision framework before taking action

  1. Classify the relationship: Is the person an employee covered by Form I-9, an independent contractor, or supplied by another company?
  2. Classify the signal: Is it a document concern, an E-Verify mismatch, an account compromise, or a broader data-breach indicator?
  3. Assess immediate access risk: Which accounts, systems, facilities, or records could be misused right now?
  4. Check procedural status: Is a tentative nonconfirmation still within the employee’s contest period, or has the standard process been completed?
  5. Map legal duties: Which federal, state, contractual, sector-specific, and collective-bargaining requirements may apply?
  6. Choose expertise: Do you need employment or immigration counsel, privacy counsel, independent forensics, HR support, or law-enforcement coordination?
  7. Document the decision: Record the facts considered, alternatives, approvals, safeguards, and review date.

Common mistakes and safer alternatives

  • Mistake: treating a mismatch as proof of fraud. Safer approach: explain the mismatch, provide the contest process, and investigate other evidence separately.
  • Mistake: demanding a new Social Security card or passport. Safer approach: follow the Lists of Acceptable Documents and obtain counsel before any re-verification.
  • Mistake: firing or cutting hours while a tentative nonconfirmation is pending. Safer approach: maintain the required opportunity to contest and separate any unrelated, documented performance issue.
  • Mistake: wiping a laptop or deleting logs immediately. Safer approach: preserve evidence first, then contain and remediate with forensic guidance.
  • Mistake: notifying everyone before facts are established. Safer approach: limit circulation, coordinate with counsel and investigators, and communicate only verified information.
  • Mistake: treating a contractor exactly like an employee. Safer approach: review the contract, access model, and the supplier’s responsibilities before acting.

A practical case file checklist

Maintain one controlled case file containing:

  • The original trigger and a timeline of events.
  • The names and roles of people who received the information.
  • Relevant Form I-9 or E-Verify notices and procedural dates.
  • Access, credential, device, and log-preservation actions.
  • Interview notes that distinguish observations from conclusions.
  • Legal, HR, privacy, security, and forensic decisions and approvals.
  • The data-elements and populations potentially affected.
  • Law-enforcement contacts, notification analysis, and communications.
  • The final disposition and any controls added to prevent recurrence.

This record supports consistent treatment, helps investigators reconstruct events, and demonstrates why each employment, security, and notification decision was made.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.