This guide provides an overview of the fraud detection alerts integrated into Employment Checks, powered by Referoo, explaining the different alert types, what happens when they are triggered, and best practices for investigating potential fraudulent behaviour.
⚠️
Important note: Fraud detection alerts do not confirm fraud
The absence of an alert does not guarantee the reference is genuine.
Alerts may not appear if the referee or candidate is using blockers or certain security settings on their device.
Multiple alerts can still have a reasonable explanation (for example, the candidate and referee sharing a single device or working from the same location).
Use fraud detection alerts as one input into your investigation — you are responsible for deciding whether a reference is likely to be fraudulent or authentic.
Fraud detection alert types
IP address match
Triggered when the candidate and referee (or two referees) use the same Wi-Fi, hotspot, or VPN while completing forms.
Common when colleagues fill in details together in the office.
Treat as higher risk if the candidate and referee don’t usually live or work together, especially if they’re in different cities.
Unique browser ID match
Triggered when the candidate and referee (or two referees) use the same device and browser (e.g. the same laptop/phone and Chrome/Edge).
This is a stronger indicator of potential fraud than an IP match alone.
Digital ID names do not match
Triggered when a free automated Digital ID check finds a mismatch but there is a matching Unique Browser ID alert.
When an alert is triggered
The following actions will automatically happen:
The user receives an auto-email notifying them a fraud detection flag has been triggered. Referoo support is cc’d in.
Referoo support will reply with the fraud detection insights from the candidate record, pointing out that the fraud detection insights from the referee are included in the referee report, link to this guide.
An alert icon will appear against the Referee in ELMO Recruitment. Details around the alert will be available in the reference report.
A Digital Identity Check may be sent automatically to the referee who triggered the alert.
Gathering more details
The Browser and Operating System (OS) indicators won't show up as warnings if they match, as these can often match up without any concerns. May people use the same browsers (ie the latest version of Chrome/Safari) and Operating Systems (ie Windows 10, iOS) as these are standard across many devices. However, if these do also match up in conjunction with an IP Address Match and/or Unique Browser ID Match, it can strengthen the case that potential fraud is occurring.
If they are different but you have received the Unique Browser ID match warning, check the timestamps: the candidate may have accessed the questionnaire at one stage, but the referee themselves may have submitted it through an entirely different set of details. This is when you would use the 'View IP Log' button to view the history of interaction (see next section below).
Note that many OSs are specific to the type of device being used. If you seek further information from someone who has triggered an alert, you can ask how they filled out their online form and see if that matches up with the OS that is recorded.
Some OS examples are below, but you can Google any OS to confirm the types of device(s) it is used on:
Mobile: iOS, Android
Tablet: iPad OS
Computer: Windows, OS X, macOS
IP Logs
These logs show the list of interactions with the candidate's dashboard or the referee's questionnaire. If no warnings appear but you do see a few different IP addresses listed, this may not be a concern - the candidate or referee may have originally accessed their form on their computer, then returned to the form using their mobile phone using a different wifi network or their mobile data provider.
Responded Dates and Times
Candidate: this date and time shows when they provided their referee's details.
Referee: this date and time shows when they completed their reference.
If completion of the reference happens very quickly after the referee's details were provided, this by itself may not be a concern (an eager referee), but tied with other indicators it may be a cause for concern (the candidate sent the request to themselves and quickly answered with short, easy, positive responses).
These timestamps could also be useful to have on-hand if you speak with the candidate or referee and their version of events doesn't match with what is shown here.
Communication Logs
The Communication Logs show every email and SMS communication sent out to the candidate on their record, and to the referee on their record. They will also show whether the communication was successfully sent, failed to send, was opened (email only), and/or was viewed (email only) where possible.
These can be useful when piecing together events - especially if, for example, the referee advises they filled out the reference from their email invite but all emails had failed to send to the referee due to an incorrect email address.
The Reference Report
A very positive reference report is a very common scenario, and usually not something of concern (quite the opposite!). If a number of other indicators of potential fraud are flagged in your investigation though, checking the answers provided by the referee in the reference report itself for additional indicators is always a good idea.
Tips for investigating potential fraud
📝
We recommend following your own company's guidelines for investigating potential fraud. The suggestions below are optional and used at your own risk — ELMO and Referoo do not accept responsibility for any outcomes or actions taken while you investigate potential fraudulent behaviour.
Start with the reference report
Read the report carefully to understand what the alert means, who triggered it, and when it occurred.
Consider calling the referee first
Referees are often less likely to be defensive than candidates — it’s not their application on the line.
Ask them to elaborate on key answers (e.g. “Could you provide more detail about the answer you gave for question X?”) and check that their responses match what’s in the questionnaire.
If still unsure, explain there was a fraud alert popup and politely confirm how, when and where they completed the reference. Check this against timestamps and platform data.
If concerns remain, contact the candidate
If fraud is still suspected after speaking with the referee, call the candidate.
Let them know about the alerts and ask if they can explain what might have caused them.