How can you tell if a candidate is using a deepfake?

Often you can’t from one clue. The FBI has described interviews where lip movements didn’t match the audio and coughs or sneezes didn’t line up with the video. Look for clusters of signs, use planned follow-up questions and keep one interviewer constant across rounds so changes stand out.

Should we stop hiring remotely because of candidate fraud?

Usually not. Most of the useful controls are good interviewing anyway: consistent panels, structured follow-ups, live video and verification at the right moments. Add an in-person step where a role’s access or risk justifies it, and apply it to everyone hired into that role.

What should an interviewer do if they suspect a candidate isn’t who they say they are?

Finish the interview professionally, without accusing anyone. Write down specific observations with times, then tell the recruiter and your security or legal contact through the agreed channel. They decide on next steps, such as another interview with a different panel or verification through your background-check vendor.

GuideCandidate fraud and deepfake interviews: how to spot and prevent them

Q: What is candidate fraud?

Candidate fraud is any attempt to get hired under false pretenses: invented or borrowed credentials, someone else taking the interview, real-time coaching, a stolen or synthetic identity, or a deepfake on video. It’s most visible in remote hiring, where the employer may not meet the candidate in person before the start date.

Q: Can employers ask candidates for ID before an interview?

It depends on where you hire and what you ask for, so involve legal. In the U.S., work-authorization checks belong after the offer: E-Verify’s rules say employers must not use it to pre-screen applicants. A consistent identity check for every candidate at a given stage is a separate question for your counsel.

CONTENTS

Try ModernLoop now

Get a demo

Contents

Short answer

Candidate fraud is when an applicant misrepresents who they are or what they can do: a stolen or synthetic identity, a stand-in or coached interviewee, or a deepfake on video. No single sign proves it. Make it hard with layered process controls: consistent panels, live-video practices, identity checks at the legally right moments and verification through your existing vendors.

What is candidate fraud?

Candidate fraud, or interview fraud, covers any attempt to get hired under false pretenses. The common forms:

Embellished credentials. Degrees, titles or employers that don’t check out.
Proxy interviews. Someone other than the applicant takes the interview, or a different person shows up to do the job.
Off-camera coaching. Answers fed in real time by another person or a tool.
Stolen or synthetic identities. Real people’s details, or invented ones, used to apply.
Deepfakes. Video or voice altered to impersonate someone in a live interview.

These aren’t hypothetical. In June 2022, the FBI’s Internet Crime Complaint Center (IC3) warned of an increase in complaints about deepfakes and stolen personal information used to apply for remote and work-from-home jobs, including IT, programming, database and software roles. Complaints described interviews where the candidate’s lip movements didn’t match the audio, and background checks that found an applicant’s details belonged to someone else. More recent FBI warnings about North Korean IT workers describe paying facilitators to take job interviews on a worker’s behalf.

None of this means treating every candidate as a suspect. The FBI itself warns that aggressive controls carry “unusually high risks of generating false positives” that could harm legitimate employees and filter out qualified applicants. The goal is a process that makes fraud hard without making honest candidates jump through hoops.

Candidate fraud warning signs by stage

Treat these as reasons to look closer, not verdicts. Each has innocent explanations on its own; what matters is a cluster, or a sign that repeats across stages.

Stage	Warning signs	What to do
Application	Résumé and online profiles that don’t match; contact details shared with other applicants; brand-new professional profiles	Note it, and plan to verify history directly with employers and schools
Recruiter screen	Camera off without a reason; vague answers about past work; a location that doesn’t match the application	Expect video from every candidate, with an accommodation path; probe for specifics
Skills interviews	Audio out of sync with lip movement; long pauses before polished answers; eyes tracking something off-screen	Use planned follow-up probes; ask the candidate to walk through their own past work
Panel or onsite	A different-seeming person, voice or skill level between rounds; resistance to any in-person step	Keep one interviewer constant across rounds and compare notes
Offer and checks	Background-check details that belong to someone else; equipment requested at an address that isn’t on their ID	Pause and escalate; ship equipment only to the verified address
First weeks	The person on camera isn’t the person you interviewed; unexpected remote-desktop tools on work devices; frequent changes to bank details or addresses	Escalate to security and HR together

“ITWs cannot be identified reliably with a single indicator.”

FBI Internet Crime Complaint Center, on North Korean IT workers (ITWs), public service announcement, October 13, 2026

Identity checks at the right moments

Identity verification is an employer process with legal timing rules, so agree on it with HR and legal before you change anything. A sensible sequence:

Timing matters. E-Verify’s rules say employers must not use it to pre-screen applicants, and USCIS requires Form I-9 Section 2 within three business days of the employee’s first day of work for pay. If you add an identity step before the offer, keep it to confirming identity, apply it to every candidate at that stage and have counsel approve it. The FBI notes that steps such as E-Verify and live verification raise friction for fraudulent workers, and its July 2025 guidance recommends verifying prior employment and education directly with employers and schools.

Before the offer

Confirm the same person attends every round: live video, consistent panels, planned probes. Work-authorization checks come later.

After the offer

Run your usual background and reference checks through your existing vendors, with consent, and verify employment and education with the source.

At hire and on day one

Complete Form I-9 and, if you use it, E-Verify. Ship equipment only to the verified address, and confirm the new hire is the person you interviewed.

Consistent interviewer panels and live-video practices

Most of what helps is good interviewing anyway. These practices make fraud harder without making the process hostile.

Keep one interviewer constant. Have the recruiter or hiring manager meet the candidate in more than one round. A familiar face notices when the person, the voice or the skill level changes.

Ask for video from everyone, with an accommodation path. Set the same camera expectation for every candidate and say so in the invite. Offer an alternative for anyone who needs one, decided by a person, not a rule.

Probe for specifics. Planned follow-up questions are hard to fake. Ask candidates to walk through their own work: what they built, why, and what they’d change. The structured interview guide shows how.

Use one link and one platform per loop. When every interview runs on the same link, a last-minute request to switch platforms or join from a different account stands out.

Apply any extra checks to everyone. The FBI’s July 2025 guidance suggests requiring video with unobscured backgrounds, and notes that asking someone to wave a hand in front of their face may prompt a malfunction in AI-generated video. If you adopt checks like these, use them with every candidate at that stage.

Recording consent and interview policy

Recording interviews can help reviewers and deter fraud, but consent rules differ by state and country, and AI note-takers raise the same questions. Before you record:

Write a policy: which interviews you record, who can watch and how long you keep recordings.
Tell candidates in advance, in the invite, and get consent where the law requires it.
Decide what happens if a candidate declines to be recorded, and make sure it doesn’t count against them.
Store recordings with your other candidate data, under the same access controls and retention rules.

Have legal sign off on the policy and the candidate notice. A recording you weren’t allowed to make is a bigger problem than the one you were trying to solve.

What to do when you suspect candidate fraud

Write the playbook before you need it, owned jointly by recruiting, security and legal. The FBI’s October 2026 guidance makes the same point: IT, HR, security and management each see different signals, and combining them improves detection.

Stay professional on the call. Don’t accuse or confront. Finish the interview as planned: you may be wrong, and if you’re right, you’ve lost nothing.

Write down what you observed. Specific, factual notes with times: what you saw and heard, not what you concluded. Keep them with the rest of the feedback in the ATS.

Escalate through one channel. Tell the recruiter and your named security or legal contact. Don’t discuss it in open channels or with the candidate.

Verify through normal channels. An extra interview with a different panel, an in-person step, a background check or direct verification of past employment: the same step you’d use for anyone in the same situation.

Decide, document and report. Make the decision with legal. If fraud is confirmed, the FBI asks companies to report this kind of activity to IC3 at ic3.gov.

Where interview scheduling data helps

Your scheduling records are a quiet source of evidence. A consistent loop record shows who met the candidate, when, on which link and in what order, which is the first thing an investigator will ask for. Patterns show up there too: repeated last-minute reschedules, requests to change the meeting platform, the same contact details on several applications.

Build that consistency into the process: interview plans that keep one interviewer constant across rounds, invites that always carry the same video link, interviewer notes attached to each interview, and reschedules logged with who asked for them. None of this detects fraud by itself. It gives the people who can detect it something to work with.

Where ModernLoop fits

ModernLoop is interview scheduling software, not an identity-verification or fraud-detection tool. What it does is keep the interview process consistent: interview plans with suitable interviewers for every loop, one consistent Zoom or Google Meet link for every interview, a private Slack channel per candidate where the interview team can compare notes, and Reporting & Dashboards to follow up on declined or rescheduled interviews. Identity checks, background checks and security reviews stay with the teams and vendors you already trust.

ModernLoop gives every interview one consistent Zoom or Google Meet link, shown here on a Leadership Interview event.

Sources

Legal points are summarized for orientation, not as legal advice. All sources checked October 22, 2026.