The Deepfake Candidate: 8 Checks That Verify You Are Hiring a Person

This is a different problem from candidates using AI to help with their answers, and conflating the two leads teams to the wrong response. Interview assistance is a question about the integrity of your assessment, whereas this is a question about whether the person on the call is who they claim to be and will do the work.

The second question used to answer itself. Remote hiring, cheap live video manipulation and organised operations running at scale have made identity something you now have to verify deliberately.

What the numbers say:

The clearest measure of exposure comes from a vendor survey. GetReal Security found that 41% of 668 security and risk leaders at large enterprises reported that their organizations had already hired and onboarded a fraudulent candidate. That sample is large enterprises with security leadership, so it is not a figure you can apply to employers generally.

The government reporting is firmer. The FBI has warned that North Korea-linked IT workers have used AI and face-swapping technology during video interviews, and reused phone numbers and email addresses across multiple applicant personas, and in August 2026 said it had identified a DPRK remote IT worker employed by the US federal government.

An advisory issued by eleven nations describes operators combining artificial intelligence, remote-control software and hired stand-ins to make fraudulent candidates appear genuine during technical interviews. The practical consequence is stated plainly in that reporting: asking a candidate to turn their camera on is no longer an identity check.

Legislators have started to respond, with the FAKER Act introduced in the US House on 27 July 2026. Regulation is some distance behind the problem, which leaves verification as an employer responsibility for now.

What the Fraud Looks Like

Three patterns account for most documented cases:

1. Proxy interviewing. A capable person sits the interview, and a different, less capable person takes the job. This is the oldest version and remains the most common because it requires no technology at all.
2. Live video manipulation. A face-swap or synthetic overlay runs during the call, letting one operator present as several different applicants. This is what the eleven-nation advisory describes and what makes camera-on verification unreliable.
3. Stolen or fabricated identity. Real documents belonging to an actual person are used by somebody else, or a complete persona is constructed with supporting paperwork. Document verification confirms the paperwork is authentic, which is a different thing from confirming the person holding it.

1. Verify Identity at a Named Point

Treating every candidate as a suspect throughout the process is expensive and damages your employer brand without any security benefit. Verification works better as one defined checkpoint that everybody passes.

Put it late enough that you are not running checks on a large unqualified pool, and early enough that you are not discovering a problem after an offer. Immediately before the final interview or at the offer stage works for most organizations.

What to do: name the stage, apply it to every candidate for that role, and say so in advance.

2. Ask for a Spontaneous Physical Action

Live manipulation degrades when something unexpected crosses the face or moves rapidly. Advisors suggest asking the candidate to slowly wave a hand across their face, turn fully into profile, or pick up and hold an object near their head.

Keep the request casual and unscripted, because a request that always comes at the same moment, in the same words, will be anticipated. This check costs nothing and reliably catches the current generation of tooling.

What to do: build two or three variations into your interviewer notes and vary which one is used.

3. Compare the Recording Against the Next Conversation

Proxy interviewing works because each stage is assessed in isolation by a different person. Consistency checks across stages are where it falls apart.

Voice, vocabulary, technical depth, and the specific examples used should be broadly consistent between a recorded screen and a later live round. A recorded first round is useful here precisely because it can be rewatched rather than remembered.

What to do: have the final interviewer watch two minutes of the recorded screen before their conversation.

4. Check Contact Details for Reuse Across Applicants

The FBI report specifically notes that phone numbers and email addresses are reused across multiple applicant personas. This is one of the few checks that scales automatically and requires no judgment.

Search your applicant database for duplicate phone numbers, email forwarding patterns, and duplicate bank or address details during onboarding. Organized operations run many personas, so reuse is a structural weakness in their approach.

What to do: run a duplicate check on contact fields across your ATS quarterly, and at offer stage for remote roles.

5. Ask About Logistics That Fraud Cannot Easily Answer

Fabricated personas have a prepared professional history and very little incidental life detail. Questions about time zones, local arrangements, previous commute, or how they plan to handle a specific practical aspect of the role produce hesitation that prepared material does not cover.

This works without being adversarial, because these are ordinary questions a recruiter would ask anyway. The Japanese case reported in 2026 involved a suspected deepfake applicant who ended the interview after roughly two minutes once told that in-person attendance would be required.

What to do: include two practical logistics questions in every remote-role screen.

6. Treat Document Verification as Necessary and Insufficient

Checking that a passport or right-to-work document is genuine establishes its authenticity. It does not establish that the person presenting it is the person it describes, which is the gap stolen-identity fraud operates in.

Liveness-linked verification, where the document check and a live capture are bound together, closes most of that gap. Document checks performed separately from any live check do not.

What to do: use a verification provider that verifies both the document and liveness in a single step, rather than accepting a photographed document via email.

7. Keep One In-Person or Supervised Touchpoint Where Risk Justifies It

For roles with system access, financial authority, or sensitive data, a single in-person or independently supervised verification remains the strongest control available. It is also the one most frequently dropped from fully remote processes.

This does not require an in-person interview round. A short verification appointment at an office, a partner location, or a notary serves the purpose without changing your hiring model.

What to do: define which roles require it by access level rather than by seniority, because the risk follows the permissions.

8. Verify Again at Onboarding

Proxy fraud succeeds at the handover rather than at the interview. The person who completes the process and the person who receives the laptop are not necessarily the same, and most verification efforts stop before that point.

Checking identity at equipment issue and at first system access costs very little and closes the most-used route.

What to do: repeat the liveness check at onboarding and match it against the interview recording.