Candidate Fraud

Common types of candidate fraud

Fraud ranges from padding a resume to organized schemes. The main patterns recruiters see:

• Credential and experience fabrication. Fake degrees, invented employers, inflated titles. The oldest form, and still the most common.
• Fake references. A friend posing as a former manager, often with a personal email or a phone number that does not match the claimed employer.
• Proxy interviews. Someone more qualified sits the video interview or technical test, and a different person shows up to work. Sometimes the proxy speaks while the candidate lip-syncs on camera.
• Real-time AI assistance. Candidates reading answers generated live by an AI tool during interviews or skills tests.
• Deepfake candidates. Face-swap or synthetic video and cloned voices used in remote interviews. The FBI's Internet Crime Complaint Center warned in 2022 of deepfakes and stolen personal information being used to apply for remote jobs.
• Stolen or synthetic identities. Applicants using someone else's identity documents. US government advisories since 2022 have described North Korean IT workers using stolen or borrowed identities to get remote jobs at US companies.
• Assessment cheating. Shared answer keys, a second person taking an unproctored test, or browser tools feeding answers.

Warning signs during the hiring process

No single signal proves fraud, but clusters should trigger extra checks:

• Camera always "broken," or the candidate insists on audio only for every round.
• Lip movement out of sync with speech, unnatural blinking, blurring around the face when they turn or put a hand in front of it.
• Long pauses before every answer, eyes tracking text off-screen, answers that sound polished but collapse under a simple follow-up.
• Voice or appearance changes between rounds.
• Resume details that do not survive questions: cannot name the manager, the office location, the tools the team used.
• New email address, VoIP phone number and a professional profile created recently with few connections.
• Requests to ship the laptop to an address different from the home address, or pressure to start before identity checks clear.
• Pay to a bank account in a name that does not match, or frequent changes to direct deposit after start.

A worked example: catching a proxy interview

A software company hiring remote support engineers runs a technical video interview, then an onboarding call after the offer. Recruiter Kevin Ortiz notices that a new hire, who was fluent and quick during the technical round, struggles to answer basic questions on the first-day setup call, and his voice sounds different.

Kevin compares the recordings and the photo on the ID submitted during identity verification. The person on the onboarding call matches the ID. The person in the technical interview does not. The company withdraws the offer, records the case and changes its process: every remote candidate now completes an ID document check with a live selfie match before the first interview, and the same face is matched again at the final interview and on day one.

In the next quarter, three more candidates drop out right after being asked to complete the ID step. That alone tells the team the control is working.

Why it matters for enterprise and high-volume hiring

The direct cost of one fraudulent hire includes salary paid for little or no work, recruiting cost, equipment that never comes back and the time to rehire. The bigger risk is access. A fraudulent remote employee in IT, finance or customer support can reach customer data, payment systems or source code.

High-volume hiring is especially exposed because volume puts pressure on every check. When a contact center is onboarding 50 remote agents a week, nobody looks closely at each video interview. That is why controls need to be built into the process, applied to everyone and largely automated, rather than relying on a recruiter's instinct.

How to prevent candidate fraud

Use layers. Each one stops a different scheme.

1. Verify identity early. A document check with a live selfie match before or at the first interview stops most proxy and stolen-identity schemes. See identity verification options that work on a phone.
2. Re-verify at each stage. Match the same face at the final interview and on day one. Proxy schemes depend on nobody comparing.
3. Proctor assessments. For remote tests, use proctoring with webcam checks, browser restrictions and randomized questions.
4. Design interviews that resist scripts. Ask follow-ups on the candidate's own examples, and ask them to share their screen and walk through work live.
5. Check references properly. Confirm the reference's identity through the company's main switchboard or corporate email domain.
6. Run the I-9 and, where used, E-Verify correctly. Examine documents with the employee present in person or through an authorized remote procedure.
7. Control equipment and payroll. Ship devices only to the verified home address and flag direct deposit changes in the first 90 days.
8. Train recruiters. Show them real examples of deepfake artifacts and proxy behavior, and give them a clear escalation route.

Fairness and legal guardrails

Fraud controls must be applied consistently to every candidate in the same role. Singling out applicants because of accent, name, nationality or citizenship status can violate Title VII and the immigration-related anti-discrimination provisions enforced by the Department of Justice's Immigrant and Employee Rights Section.

Biometric checks raise privacy obligations. Illinois' Biometric Information Privacy Act (BIPA) requires informed written consent before collecting biometric identifiers such as face geometry, along with a published retention policy. Texas, Washington and several other states have their own biometric rules, and GDPR applies to candidates in the EU. Where an AI interview or automated tool flags possible fraud, have a person review the evidence before any rejection. Rules vary by state and country.