We hired a developer whose degree did not exist — the 7 background checks I now run before every UAE offer

It took eight months to surface, and it surfaced by accident. A visa renewal required a fresh attestation, the paperwork came back with a discrepancy, and a phone call to the university established that the person had never been enrolled. The engineer was competent — that was the uncomfortable part. The work had been fine. But the file was fiction, and every document in it had passed our process without a single flag.

What that episode taught me is that most hiring processes verify documentsrather than facts. A document can be attested, notarised, translated and stamped, and still describe something that never happened. Below is the process we run now. It is not exotic and it is not expensive; it is simply ordered so that the cheap checks that catch the most come first.

Step 1 — Confirm identity and current visa status

Start with the basics, because everything downstream depends on them. Confirm that the name on the passport matches the name on every other document, including transliteration variants — mismatches here are usually innocent, but they are also the thread that unravels genuine problems. Note the passport expiry, because a candidate whose passport expires within six months will hit sponsorship friction regardless of how good the hire is.

Establish the candidate current status in the country: are they on a visit visa, on a residence visa sponsored by another employer, on a freelance permit, or outside the UAE entirely? Each answer changes your timeline by weeks and sometimes changes who bears the cost of transfer or cancellation. Ask for this in writing at the conditional offer stage rather than discovering it during onboarding.

Step 2 — Verify education at the source, not on the document

This is the step that would have caught our failure, and it is the one most often skipped because attestation creates a false sense of completion. Attestation is an administrative chain confirming that stamps and legalisations are in order. It is not a statement by the university that a particular person studied there.

Verification means contacting the institution registrar directly and asking two questions: was this person enrolled between these dates, and was this award issued. The critical detail is where you get the contact details. If you email the address printed on the certificate, you are trusting the document to validate itself. Find the institution official website independently and use the contact route published there.

One caveat worth stating plainly: for many engineering roles the degree matters far less than the demonstrated ability. If you would hire a strong self-taught developer without a degree — and you probably should — then the honest position is to drop the credential requirement rather than to require a credential you never check.

Step 3 — Reconstruct the employment timeline

Lay the claimed roles end to end on a calendar and look for two things: overlaps and gaps. Overlapping full-time roles at different employers need an explanation — sometimes it is legitimate consultancy, sometimes it is a rounded date, occasionally it is an invention. Unexplained gaps of several months are not a red flag in themselves; people take time out for family, study, illness or relocation. What matters is whether the explanation is consistent when asked twice, weeks apart.

For each employer, confirm the dates and the job title through the company official channel rather than a mobile number supplied by the candidate. In smaller firms this is genuinely difficult, and in a region with high company turnover some former employers no longer exist. Where you cannot verify, write down that you could not, and weigh it — do not silently treat an unverifiable role as verified.

Step 4 — Take references that go past the reference

A reference nominated by the candidate will be positive. That is not cynicism, it is selection. The value of the call lies entirely in the specificity of the questions. Replace "was he a good engineer" with questions that have costly-to-fake answers: what did they actually ship, who else was on that team, what did they struggle with in the first three months, and would you take them back into the same role.

The most informative question I ask is simply who else worked closely with them. It gives you a second reference the candidate did not choose, and a referee who has invented a working relationship will find that question hard to answer smoothly.

Step 5 — Establish provenance of the technical work

Engineering hiring has a verification problem the rest of the business does not: a portfolio is trivially easy to borrow. A public repository proves that code exists in an account, not that the account holder wrote it. The check is not to accuse anyone — it is to have a conversation that would be effortless for the author and awkward for anyone else.

Pick a non-obvious decision inside work they claim and ask why it was made that way. Why this data structure rather than the obvious one, what broke in production and how it was fixed, what would they change with hindsight. Authors answer these fluently and often with visible irritation at their past selves. This is also why a live technical exercise on your own problem, however short, remains worth more than any portfolio review.

Step 6 — Check the exit obligations of the current employer

This is where UAE hiring differs most from other markets, and where avoidable delays cluster. Establish the contractual notice period in writing rather than by verbal assurance, because senior engineering contracts frequently run to three months and candidates routinely underestimate them. Ask directly about any non-compete or non-solicitation clause, and get a copy of the relevant contract page if one exists.

Then confirm the mechanics of the visa transfer or cancellation, who is responsible for each stage, and what the current employer typically does in practice — the formal process and the customary one are not always the same. A candidate who has not raised their departure with their employer is at the start of this timeline, not the end of it. For a broader view of how notice periods and relocation dependency compress real offer deadlines, our colleagues at HireDeveloper.sg document the same pattern in the Singapore market, and JapanDev covers the equivalent obligations for Japan, where notice conventions differ again.

Step 7 — Document consent and retention

Every check above collects personal data, and collecting it without a record of consent turns a diligence process into a liability. Ask the candidate to sign a short, specific authorisation naming what will be verified and with whom. A generic clause buried in an application form is weak evidence; a one-page consent that lists education, employment and references is strong.

Set a retention period and honour it. Verification records for unsuccessful candidates should not sit indefinitely in a shared drive, and the file for a successful hire should live in the employee record with restricted access rather than in a recruiting folder the whole team can read. Decide this once, write it down, and apply it — it takes an afternoon and removes an entire category of exposure. The same discipline matters more, not less, in regulated sectors; if you are building in financial services, our guide to building a fintech app in the UAE covers the adjacent obligations that tend to arrive at the same time.

What this process does not do

It does not guarantee a good hire. Verification confirms that the person is who they claim and did what they claim; it says nothing about whether they will do well in your team. The two failures I have seen since we tightened this were both people whose files were entirely genuine and who simply did not work out. Keep the technical assessment and the team conversation doing their own job.

It also does not need to be adversarial. Told plainly at conditional-offer stage — here is what we verify, here is why, here is the consent form, it takes about a week — strong candidates treat it as a sign of a serious organisation. The only people it reliably annoys are the ones you were hoping to filter out.

Frequently asked questions

Is attestation the same as verifying a degree?

No. Attestation confirms that stamps and legalisations are procedurally in order; it does not establish that the institution ever enrolled the person or issued that result. Verification means contacting the registrar through a channel you sourced independently — never the contact details printed on the candidate document.

How long should background checks take for an engineering hire?

Seven to ten working days end to end, started at conditional offer rather than after acceptance. Education verification with overseas institutions is the slow element. Running identity, employment history and references in parallel from day one typically compresses the whole process to under a week.

What can we not legally ask about in the UAE?

Apply a job-relevance test and collect documented consent. Health, pregnancy, religion and marital status are not legitimate selection criteria for an engineering role and create discrimination exposure with no hiring benefit. Where a criminal record check is genuinely required, use the proper official channel with the candidate informed.

Should we run checks before or after the offer?

Issue a conditional offer, then verify, and state the conditionality in writing. It is fairer to the candidate and safer for you: the offer letter records that employment depends on satisfactory verification, preserving your ability to withdraw cleanly if something material surfaces.