The CV in front of you is not evidence, It is a claim.

Every CV your organisation receives is, at its core, an unverified statement. The candidate has told you where they worked, when they worked there, what their job title was and how long they stayed. You have no way of knowing whether any of it is true until you check. And the uncomfortable reality, from two decades of processing vetting files across security, healthcare, financial services and government, is that a significant number of people do lie — and most employers never find out.

Research consistently puts the proportion of CVs containing inaccuracies at between 40 and 60 per cent. Some of those are minor embellishments. Many are not. Inflated job titles, extended employment dates designed to cover gaps, roles that never existed, employers listed who would have no record of the person. These are not edge cases. They are patterns we saw repeatedly across hundreds of thousands of files, and they are becoming more sophisticated as candidates grow more aware of what most employers actually bother to check.

The question is not whether CV fraud happens. It does, regularly, and to organisations who consider themselves careful. The question is whether your current verification process is capable of catching it — and for most organisations, the honest answer is that it is not.

Why traditional reference checking often misses what matters most

The standard approach to employment verification in most organisations involves contacting previous employers for references. The problem is that this process has fundamental limitations that candidates who want to deceive have long known how to exploit.

Former employers often confirm only the bare minimum: dates of employment and whether the individual is eligible for rehire. Many will say nothing more than that, partly from habit and partly from an understandable reluctance to expose themselves to any legal risk. The result is that a reference that appears to confirm employment often tells you very little about whether the dates the candidate gave you are accurate, whether the role they described bears any resemblance to reality, or whether there are periods of employment they have chosen not to disclose at all.

Gap fraud — where candidates either invent plausible employment to fill a period they would rather you did not examine, or quietly extend the dates of a real role on either side of a gap — is one of the most common forms of CV manipulation we encountered across years of doing this work operationally. It is also one of the hardest to detect through traditional referencing alone, because you are essentially relying on the candidate to tell you where to look.

If a candidate has omitted an employer entirely, you will not know to contact them. If they have shifted dates by a few months to close a gap, a cursory reference check from the employer they have listed will not reveal it. The gap exists in the silence between what they told you and what actually happened — and traditional referencing has no mechanism to expose that silence.

What HMRC PAYE records actually show you

This is where employment history verification through HMRC becomes, in our view, the single most important tool available to UK employers who are serious about CV verification.

HMRC maintains a record of every individual's PAYE employment history. Every employer who has paid someone through PAYE is required to submit a Full Payment Submission each time that employee is paid, detailing their pay and deductions. That data is held by HMRC and constitutes an official, tamper-proof record of a person's PAYE employment in the UK — employer names, start dates, end dates, and taxable income reported for each period.

The candidate cannot alter it. They cannot fabricate it. They cannot choose which parts of it you see. When you request this record with candidate consent, you get what HMRC holds — and that gives you the ability to do something no reference check or candidate-supplied document can give you: a direct, objective comparison between what the candidate told you and what actually happened.

You can access up to five years of PAYE history through the candidate's personal tax account via HMRC's online service. The candidate logs in using their Government Gateway details and prints or exports their PAYE employment record, which you then compare directly against the employment history they disclosed on their application.

For employment history going back beyond five tax years, there is a postal application process available through HMRC, though this takes considerably longer. For most screening purposes, the five-year digital record covers the period that matters most.

What it catches that nothing else will

The practical value of HMRC PAYE records in a screening context becomes very clear when you understand what you are comparing. You have the candidate's CV in one hand and the official government record in the other.

That comparison will show you immediately if dates have been altered. If a candidate has listed employment from January 2021 to March 2023 at a particular organisation and the HMRC record shows they left in September 2022, you have a discrepancy that needs explaining. If the HMRC record shows an employer the candidate did not list at all, you have an omission that needs addressing. If there is a six-month gap between PAYE employments that the candidate's CV presents as continuous employment with one organisation, you have potential gap fraud in front of you.

You will also see periods where no PAYE employment is recorded. This does not automatically mean the candidate is concealing something — self-employment, periods working abroad and career breaks are all legitimate explanations — but it gives you a clear, objective basis for a structured conversation about that period rather than simply taking the candidate's word for it.

For roles in regulated sectors, this level of verification is not optional. BPSS requires verification of an individual's employment history for at least three years before the baseline check, and HMRC PAYE records are explicitly recognised as a valid method of achieving that verification. Security sector employers working to BS7858 have similar obligations. The FCA's screening requirements for certified functions and senior managers demand employment history verification as part of a compliant process. In each of these contexts, HMRC records are not a nice-to-have. They are one of the most robust tools available to meet the standard.

Our published guide on employment history verification sets out what a compliant process looks like across different regulatory frameworks, and it is worth reading alongside this piece if you are building or reviewing your verification approach.

The limits you need to understand

Using HMRC PAYE records effectively means understanding what they do and do not show.

They cover PAYE employment in the UK only. Self-employed periods, overseas employment, and work conducted outside the PAYE system will not appear. Someone who spent three years as a contractor, worked abroad or was genuinely self-employed will have gaps in their HMRC record that are entirely legitimate and require alternative verification. If you are screening candidates with international employment history, HMRC records are one layer of verification, not the complete picture.

The records also do not show job titles, responsibilities or the quality of someone's work. They confirm that the person was employed by an organisation and receiving pay through PAYE during a given period. What the role actually involved still needs to be established through a properly structured reference process.

Employer names in HMRC records can also differ from the trading name a candidate would naturally use on a CV. Payroll may run through a parent company, a holding entity or a different legal name than the brand the individual worked for. These discrepancies are usually straightforward to resolve with a brief note, but they need to be considered rather than flagged automatically as an inconsistency.

And crucially, the process requires candidate consent. The candidate must log into their personal tax account and share that record with you. This is entirely appropriate from a data protection standpoint and should sit naturally within a transparent pre-employment screening process with a proper candidate privacy notice in place. If you are not sure whether your privacy notice is compliant, our right to work checks employer guide covers the broader compliance framework that sits around your screening process.

Making it part of your standard process

The organisations that catch CV fraud consistently are not the ones with the most aggressive screening processes. They are the ones with the most systematic ones. HMRC PAYE verification works best when it is built into your standard pre-employment process as a routine step rather than something reserved for cases where you are already suspicious.

Start by making the request for HMRC employment history part of your standard application documentation. Explain to candidates clearly what you will be checking and why. For most candidates with nothing to conceal, this is a straightforward administrative step. For those who have something to hide, the request itself will occasionally prompt a withdrawal — which is information in itself.

When the record comes in, do a structured side-by-side comparison with the declared employment history. Document what you found, what matched, what did not, and how any discrepancies were resolved. That documentation is your audit trail and your defence if any questions are asked later about the robustness of your process.

For employers in aviation, security, healthcare and financial services, consider whether your current verification process is meeting your sector's specific standard. If you are facing an audit or an inspection, our pre-audit vetting file review service exists precisely to give you an independent assessment of whether your files would withstand scrutiny before an inspector arrives.

The CV fraud problem is not going away. If anything, as AI tools make it easier to generate plausible employment histories and supporting documents, the pressure on verification processes is increasing. HMRC PAYE records are not a perfect solution. But they are the closest thing to a tamper-proof employment history check available to UK employers, and most organisations are not using them. That gap is worth closing.

Working with Vetting Hub

At Vetting Hub, we work with HR teams, compliance managers and business owners who want to handle employment screening and vetting with complete confidence — not just tick a box and hope for the best.

Our subscription gives your organisation access to CPD certified practical training built from real operational experience, the compliance tools and frameworks to put that knowledge to work, and direct access to Graham and Vivianne Johnson when a specific question needs a specific answer. Whether you are building a screening process from scratch, reviewing one that has grown organically over the years, or preparing for an audit, we are here as an ongoing resource rather than a one-off course.

Visit us at www.vettinghub.co.uk to find out more.