Called the "No-Match" regulation, it gives companies 90 days to verify a hire's identity and eligibility to work if an employee's Social Security number doesn't match information in the Social Security Administration's database. Companies who do not fire workers who cannot provide proper documentation in that timeframe risk fines as high as $10,000 for each of these employees, if it can be proved that the firms knowingly flouted the law.

This regulation could be problematic for small businesses, which often lack the human resources staff and immigration expertise to review documents and ensure their authenticity, say some advocates. "They aren't in the document-review business, and some fraudulent documents look pretty legitimate," says Karen Harned, executive director of the National Federation of Independent Businesses Legal Foundation, a Washington, D.C. based lobbying group. Sometimes, an employee's records might not match the government's because of a perfectly legal name change or a clerical error, and a company that acts too hastily might end up on the fast track to a discrimination lawsuit, she adds.

Some business owners say they are being proactive about asking for proper paperwork but worry that these efforts may not be fail-safe. "We do our best to look at documentation to the best of our ability," says Jim Balmain, owner of Smith's Bakeries, which generates $3.5 million annually with 55 workers at seven locations in Bakersfield, Calif. "But if employees have something phony we can't catch because it's a high-quality forgery, I don't think we should be penalized. I'm having lunch with my Congressman at the end of the month to discuss it."