Stop debating whether it is fraud — use a cost continuum to align your stakeholders

The fraud cost continuum

Candidate fraud does not announce itself. It surfaces as a bad hire, a delayed project, a budget overrun, or an unexplained data incident — categorized and closed without the underlying cause ever being named. The costs fall into four bands, each with a distinct probability and a distinct response. 

Level 1 — Friction costs.  Common; most programs absorb these regularly. A fraudulent candidate clears screening, onboards, underperforms, and exits — indistinguishable from an ordinary bad hire. Recruiting fee, onboarding time, project disruption, and re-fill typically run $20,000–$50,000 per event. In programs placing 50+ workers a year, this happens several times a quarter. It does not feel like fraud. It feels like hiring variability — which is exactly why the root cause is never addressed. 

Level 2 — Direct financial loss.  Periodic. A candidate with a fabricated identity or credentials collects three to four pay periods before inconsistencies surface — $15,000–$35,000 in direct payroll theft, and $40,000–$75,000 once the recruiting fee, onboarding, and replacement search are added. Fraud operations target this band deliberately: large enough to be profitable at volume, modest enough that most teams close the incident rather than investigate the pattern. 

Level 3 — Operational and competitive harm.  Less frequent, but far costlier per incident. An overemployed worker billing full time at a senior rate while splitting attention across two roles creates compounding costs: paid capacity that never fully shows up, the opportunity cost of a senior seat that is not driving what it was priced to drive, and lost knowledge transfer to the team around them. A single senior-level incident commonly runs $150,000–$300,000 in salary waste, rework, and lost output. 

Level 4 — Catastrophic loss.  Rare, but existential. IP theft, ransomware enabled by a planted insider, or export-control and data-sovereignty violations from location misrepresentation. Damages run into the millions: regulatory penalties, legal settlements, client terminations, reputational harm. The asymmetry is the point — a single $50,000 fraudulent placement can trigger $5 million or more in downstream damage, because the response is proportional not to the incident but to everything that placement could have touched. 

Why the continuum aligns stakeholders  

Each function sees the band closest to its own work — HR sees friction, finance sees direct loss, security sees the catastrophic tail. Left alone, those are four separate conversations. Placed on one continuum, they become a single picture, and the cross-functional team can finally agree on where the program actually sits and what level of response the exposure justifies. The continuum does not settle whether an incident was fraud. It settles what it cost — which is the question that actually drives a decision. 

Start here 

Take your last twelve months of early terminations and unexplained performance exits. Place each one on the continuum by cost, not by whether anyone called it fraud at the time. The exercise usually reveals two things: how much Level 1 and 2 cost the program has been absorbing as ordinary variability, and whether a Level 3 or 4 exposure has been sitting unexamined. 

Questions to take back to your team

Where on this continuum does our program actually sit — and have we ever measured it? How much Level 1 and 2 cost are we absorbing as hiring variability? Have we assessed our Level 3 and 4 exposure, or only the incidents obvious enough to surface on their own?