How to spot fake job candidates before they reach your payroll.

For years, seeing a candidate on camera was proof enough that they were who they claimed to be. Deepfake software and paid proxy interviewers have broken that assumption. In a Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, and Gartner predicts one in four candidate profiles worldwide will be fake by 2028.

The risks reach well beyond poor performance. A fraudulent worker can send wages to a sanctioned government, steal intellectual property, and leave an employer exposed to sanctions violations it never intended to commit.

In my work on risk and compliance at Kelly, I've found that this fraud usually succeeds because no one tracks a candidate across the whole hiring process. Below, I’ll break down where fake job candidates tend to slip through and how to catch them at each stage of hiring.

What fake job candidates look like today

When employers think about AI-driven hiring fraud, most picture an inflated resume or a candidate reading chatbot-generated answers during a live interview. Fake job candidates take the fraud a step further by hiding their real identity or borrowing someone else's to get hired. Resume inflation is dishonest, but the employer still hires the person they interviewed. A fake candidate can leave a company handing system access, client data, and a paycheck to someone whose identity it never confirmed.

Identity fraud usually takes one of two forms, and remote hiring has made both easier to carry out.

Proxy interviews. In a proxy scheme, the candidate pays someone else to sit the interview and pass the technical questions, and a different person shows up for the first day of work. Proxies aren't new, and the scheme requires no special technology.

Deepfakes. Deepfake software runs on the candidate's computer and maps another person's face onto their own during a live video call, matching mouth movements as they speak. Convincing deepfakes once required significant resources. Today, face-swap apps that work inside Zoom, Teams, and Google Meet are easy to download.

Why remote IT roles are the top target

When a candidate never has to meet anyone from the company in person, a proxy or a deepfake can carry them from the first interview to the first paycheck. Among remote roles, IT positions draw the most attention, largely because of a North Korean scheme that places government-trained programmers inside U.S. companies.

IT roles suit the scheme for two reasons. Highly technical candidates are still something of a unicorn, and a hiring manager who finds one with every skill on the list is eager to move forward. The North Korean regime also has skilled programmers in its cyber warfare division who can do the work a Fortune 500 company expects, which gives the regime a way to get a foot in the door. The operation depends on help from outside North Korea. One facilitator, now serving a five-year federal sentence, sold stolen identities of U.S. citizens to North Korean IT workers, who used them to get hired at 40 U.S. companies.

The part of this scheme I most want employers to understand is how quiet it is. Many of these workers do the job well, keep it as long as they can, and often hold several jobs at different companies at once. They're earning salaries for the regime and looking for intellectual property, and an employer watching for ransomware or a data breach may never notice anything unusual.

How to spot fake job candidates at every stage of hiring

Fake job candidates are easiest to catch when employers look at the hiring process as a series of handoffs. A candidate might move from a recruiter to talent acquisition, HR, a hiring manager, and finally a direct manager, while the person screening resumes rarely talks to the person who ships the new hire's laptop. Fraudulent candidates take advantage of each of those transitions, so every stage needs its own checks. Most of those checks fit smoothly into steps employers already take, so they add protection without slowing hiring.

Sourcing and screening

The first round of checks takes a few minutes per candidate, so focus your efforts on your shortlist. Run a reverse image search on the candidate's headshot to confirm it doesn't appear on someone else's profile. If a phrase on the resume sounds unusual, search it to see whether it shows up elsewhere. References should belong to real people and shouldn't match names other applicants have listed, and past employers on a LinkedIn profile should be real companies with a meaningful web presence.

Video interviews

Set the same on-camera standards for every candidate, starting with a requirement to turn off background blur and a formal ID verification step. A few simple checks during the conversation can then expose a deepfake or a candidate who isn't where they claim to be.

• Run the three-finger check. Have the candidate hold three fingers in front of their face. Most deepfake software has trouble rendering the hand and face separately, and the image tends to blur or distort.
  
  
• Ask a location question. My go-to is to ask the candidate's favorite restaurant in the city where they say they live, framed casually, as if you're visiting next week and want a dinner recommendation. Someone who lives there answers easily, and won't be put off by the question if it's built into the conversation. We've seen fraudulent candidates stumble on this question or name a well-known fast-food chain instead of a local restaurant.
  
  
• Check the setting. A background that doesn't match the candidate's time of day, or several people speaking a foreign language nearby, should raise concern.
  
  
• Watch for long pauses. Hesitation before answering, especially on basic questions, is another warning sign.

Handoffs between teams

Proxy schemes can switch the person on camera at any handoff, from the move between recruiter and hiring manager to a new hire's first meeting with HR or their manager. Each person sees only one version of the candidate, so nobody is in a position to notice. A soft handoff closes that opening. Before the recruiter steps away, schedule a short call with the recruiter, hiring manager, and candidate together, so the hiring manager meets the same person the recruiter interviewed.

Onboarding and equipment shipping

The last checkpoint comes when the company ships a laptop. Workers in these schemes typically rely on a U.S.-based facilitator who receives company laptops, keeps them running in what's known as a laptop farm, and lets the overseas worker connect remotely while appearing to work from the United States. Because the laptop has to reach the facilitator, a request to change the shipping address during hiring is a red flag. While possible, very few people move while they're being hired. Fraudulent candidates will usually have a sympathetic reason ready, like a sick parent they need to visit. You want to be understanding, but the request deserves a closer look. Peers at other companies have caught fraud simply by comparing the address on the resume with the shipping address.

No single red flag proves a candidate is fake. What I look for is a stack of them. When several show up in the same process, the recruiter needs a clear path to escalate the concern to someone with the specialized knowledge to investigate. Everyone involved in hiring should know who that contact is before a suspicious candidate comes along.

What to do if a fraudulent candidate gets hired

A fraudulent hire raises law enforcement and sanctions questions on top of the immediate security concerns. If you find that your organization has hired a fraudulent candidate, here are the steps I recommend.

• Talk to counsel about sanctions exposure. If the worker turns out to be from North Korea or another sanctioned country, the company may have violated U.S. sanctions administered by the Treasury Department's Office of Foreign Assets Control (OFAC). Sanctions violations carry strict liability, so an employer that hired the worker in good faith can still be in violation. Counsel can advise on making a voluntary self-disclosure to OFAC, which the agency weighs in the company's favor when assessing penalties.
  
  
• Report it to the FBI. After consulting with counsel, reporting the scheme to the FBI is voluntary, but I strongly recommend it. Your local FBI field office can help investigate, and FBI investigations have led to prosecutions of the facilitators behind these schemes.
  
  
• Treat FBI investigators as partners. In our conversations with the FBI, investigators have said their aim is to help the employers these schemes target, and they may even put in a good word with OFAC on an employer's behalf.
  

Reporting also helps every other company hiring remote talent, because each report gives investigators more to work with against the same schemes. Building a response plan into your HR compliance planning means you can act quickly if a fraudulent hire slips through.

What to look for in a staffing partner

If you rely on a staffing partner for remote hiring, fraud screening should be part of what they deliver. Recruiters sit on the front line of the hiring process, so fraud prevention belongs among your criteria for choosing a staffing agency. A strong partner should be able to explain exactly how they keep fraudulent candidates away from your hiring managers.

Look for verification built into daily work. Background screening and contract terms are the baseline. A partner should also be able to walk you through how verification works day to day, from reference checks on finalists to soft handoffs between their recruiters and your hiring managers.

Look for recruiters trained to spot red flags. Some employers now require interview-analysis tools for remote IT roles, which flag signals like limited eye contact or frequent pauses. Technology helps, but it works best in the hands of recruiters who know what to look for, so ask how a partner trains the people screening your candidates.

Look for a process designed around your roles. In staffing, fast placement is part of the value we deliver, so every added hurdle runs against our instincts. Then again, placing a North Korean hacker inside a client's company isn't great for the business model either. The right partner balances the two for each role. Some employers have asked for in-person I-9 verification, but remote IT candidates don't expect it, and it can shrink the talent pool. For those roles, we look for other checkpoints first.

At Kelly, we've built these processes with many of our clients, from traditional staffing customers to managed service provider programs. We work with hiring managers and security teams to find the weak points in each process, including back-end checks with procurement and IT, such as confirming a laptop's shipping address matches the one on the resume. Internally, our global security, cybersecurity, talent acquisition, HR, and MSP teams share what's working, and we train our recruiters and sourcing specialists on the red flags to watch for.