How to spot candidate identity fraud: proxy interviewers, deepfakes and fake applicants

To spot candidate identity fraud, look for inconsistencies that build across stages rather than a single odd moment: contact details reused across applications, a resume that gets vaguer under follow-up questions, a face or voice that changes between interviews, video where lips and audio do not line up, and requests to ship equipment or send pay somewhere unexpected. Then confirm with checks you apply to every candidate, such as verifying identity on camera, confirming past employers yourself and completing identity documents through your normal onboarding process.

This is not a hypothetical risk for remote roles. The FBI has published several warnings, cited below, about stolen identities, deepfakes and proxy workers used to get hired, mostly into remote technology jobs. Shorter lists of questions are in remote candidate screening questions and IT contractor screening questions; this page is the full process, stage by stage.

What the FBI and FTC have warned about

As of September 2026, these are the primary sources worth reading in full:

• June 2022. The FBI's Internet Crime Complaint Center reported deepfakes and stolen personal information used to apply for remote work, including interviews where the lip movement of the person seen on camera did not match the audio, and actions such as coughing that did not line up with what was seen. Background checks found applicants using other people's identities.
• January 2025. An FBI warning about North Korean IT workers said they have been observed using AI and face-swapping technology during video interviews, reusing phone numbers and email addresses across resumes, and changing addresses or payment platforms during onboarding. It recommends identity verification during interviewing, onboarding and employment, and cross-checking HR systems for applicants with the same resume content or contact information.
• July 2025. A further FBI warning on North Korean IT worker threats advises verifying prior employment and education directly, requiring video with an unobscured background, and asking the individual to wave a hand in front of their face because it may prompt a malfunction in AI-generated video. It also advises sending equipment only to the address on the employee's identification documents.
• The other direction. The FTC has warned that scammers impersonate recruiters for real companies on LinkedIn and job sites to take money and personal information from job seekers. Real candidates are wary for good reason, which affects how you ask for identity information.

The types of fraud you are looking for

At application: patterns across candidates

Individual applications rarely look wrong. Patterns appear when you look across them, which is why the FBI suggests cross-checking your own systems.

• The same phone number, email pattern or resume text under different names.
• Voice-over-IP phone numbers where you would expect a mobile or landline, especially if they recur.
• Profiles created recently with few connections and a detailed senior work history.
• Employers that cannot be found outside the resume, or education from institutions you cannot confirm.
• A photo on a profile that appears elsewhere under a different name.

None of these alone proves anything. Several together justify moving that candidate to a more careful verification path before investing interview time.

On the screen and in interviews

Depth under follow-up

A test that is both useful and fair: ask about something specific on the resume and follow up twice. Real experience becomes more detailed with each question, including awkward details nobody would invent. Borrowed experience becomes vaguer, pauses before each answer, or repeats the resume's wording.

"You list the billing system migration at [company]. Which system did
you move from, and why did the team choose to move?"
"What broke in the first week after cutover, and who noticed it?"
"Who was your manager then, and how did they decide who was on call?"

Video signals

• Lips and audio out of step, particularly when the candidate moves or laughs.
• Blurring, warping or a face that seems to float when a hand, hair or glasses pass in front of it.
• A camera that "fails" as soon as the candidate is asked to switch it on, every time.
• Long pauses before every answer, or eyes tracking text off-screen throughout.
• A heavily blurred or virtual background kept on after a request to remove it.

A short, neutral request handles most of these. Tell every candidate at this stage in advance that interviews are on camera. On the call, you can say: "Before we start, could you switch off the background blur for a moment, and wave a hand in front of your face? We ask everyone at this stage; it's a quick identity check."

Consistency between rounds

A proxy interviewer is easiest to catch when two people compare notes. Keep a record of each interview, including the candidate's own words on key answers, and ask later interviewers to look for:

• A different voice, accent or speech pattern from the first call.
• Stories that change: a project described as led in round one and supported in round two.
• Knowledge that fails on topics the candidate handled easily earlier.

Notes or transcripts from each round make this comparison possible. Interview Signal keeps a transcript on the interviewer's computer, so a later interviewer can check exactly what was said in the first round rather than relying on memory.

At offer and onboarding

Fraud often surfaces when logistics become real. The FBI warnings point to changes of address and payment platforms during onboarding.

After start, the first weeks are the last checkpoint. A new hire who never appears on camera, whose voice differs from the interviews, or who logs in from an unexpected location is worth a conversation with security, not only with HR.

Staying fair while you check

Fraud checks done badly become discrimination. National origin is protected under federal law, and the EEOC's national origin guidance covers decisions based on accent, ancestry or appearance. Build these guardrails into the process:

• Apply checks by stage and role, not by suspicion. If camera verification happens at the second interview for remote engineering roles, it happens for every candidate at that stage.
• Never treat accent, name, visa status or a non-US education as a fraud signal. The signals are inconsistencies, not backgrounds.
• Offer accommodations. Some candidates cannot use video for disability-related reasons. Provide another verification route rather than excluding them.
• Ask for documents only at the right time. Identity documents belong to the post-offer process, not a first screen. Given the FTC's warnings about fake recruiters, legitimate candidates are right to refuse to send ID to a stranger early on.
• Record facts, not impressions. "Lip movement did not match audio at 14:05; candidate declined to remove background blur" is a fact. "Seemed suspicious" is not.

What to do when you suspect fraud

1. Do not accuse the candidate on the call. Finish the interview politely and note exactly what you observed, with times.
2. Escalate internally to your recruiting lead and, if any system access, equipment or offer has been issued, to security straight away.
3. Run the standard next check, such as an additional on-camera verification or employment verification, the same way you would for anyone at that stage.
4. Check your systems for other applications with the same contact details or resume text.
5. Decide on documented facts, and close the process with a neutral message.
6. Report suspected activity to the FBI's Internet Crime Complaint Center at ic3.gov, as its warnings request. Agencies should tell the client promptly, with the facts.

A fraud-resistant process checklist

• Candidates are told in advance which interviews are on camera and why.
• New applications are checked against existing records for reused phone numbers, emails and resume text.
• Screens include at least two follow-up questions on a specific resume claim.
• Interview notes or transcripts are kept so later rounds can compare answers.
• A simple on-camera identity step is used for every candidate at a defined stage.
• Employment and education are verified through contacts you find yourself.
• Equipment ships only to the address on identity documents; payroll goes to an account in the employee's name.
• Accommodations and an alternative verification route are available.
• Your own recruiters use company email and can be verified by candidates through your website.