Fake Job Candidates: A Calm Guide to Verifying Who You Are Interviewing

The call connects. The face matches the photograph, the accent matches the CV, the answers land where you expected them to land. And a question sits at the back of your mind that would have sounded slightly unhinged five years ago. Is this the person who applied?

It is no longer a paranoid question. It now appears in analyst forecasts. A Gartner report from July 2025, covered by HR Dive, projects that by 2028 as many as one in four candidate profiles worldwide may be fabricated.

Two Different Claims, Easily Confused

Pull the forecast apart from the survey, because they describe different things. The quarter-of-all-profiles projection concerns documents and online presence: the CVs, portfolios and professional pages that generative tools can now assemble convincingly and at volume. The behavioural finding is separate. Across a Gartner poll of three thousand job seekers, 6% admitted involvement in interview fraud, either by impersonating somebody else or by arranging for somebody to impersonate them.

A small share, in other words. Also a share that becomes a real planning problem once you are hiring in any volume, and a forecast that, even at half strength, drains the ordinary CV of a little more meaning each year.

One of Gartner's senior research directors described the consequence to reporters in August 2025:

Employers are finding it steadily harder, he said, to judge "candidates' true abilities, and in some cases, their identities." Reported by HR Dive.

Three Forces, Arriving Together

The first is cost. Producing a polished CV, a plausible cover note and a fluent set of prepared answers used to take effort and some talent. It now takes a prompt and a minute, which means a well-presented application carries far less information about the applicant than it did.

The second is distance. In a hiring process conducted entirely through screens, no recruiter ever shares a room with the person they are assessing, and a shared room is where most impersonation used to collapse.

The third is incentive. Some roles come attached to production systems, customer records or payment approvals, and that access is worth the trouble of a false identity to somebody. Not every role is a target. Those ones are.

There is a trust problem running alongside all of this, and it cuts in both directions. Roughly a quarter of candidates in the same HR Dive coverage said they trusted artificial intelligence to judge them fairly. Around half assumed it was already screening their applications. And close to half doubted that the vacancies in front of them were genuine at all. Suspicion is now mutual. That matters for your response, because a heavy-handed verification regime will drive away the honest majority long before it inconveniences anybody dishonest.

What the Court Papers and the Bureau Describe

Forecasts are easy to shrug at. Sentencing documents are harder. On 15 April 2026 the United States Department of Justice announced prison terms for two American nationals who had helped overseas workers pose as US residents to win remote technology jobs. The release states that the scheme sought work at more than 100 American companies, compromised the identities of more than 80 US persons, and generated more than $5 million in illicit revenue for North Korea, with the facilitators running what the department calls laptop farms so that workers abroad could log in as though they were sitting in Ohio. Two people received sentences of 108 and 92 months.

The useful part is that the FBI has published what to actually do, free, in plain language. Its public service announcement of 23 July 2025 recommends that employers mandate video with unobscured backgrounds, verify prior employment and education directly with the businesses and institutions concerned, and grant no access to any systems until the background check is complete. Two of its suggestions are oddly memorable. Ask the person to point the camera out of a window and talk about where they are. Ask them to wave a hand in front of their face, because generated video tends to falter when something crosses it.

Britain already obliges you to do a version of this, though for a different reason. GOV.UK states that an employer must check that a job applicant is allowed to work in the UK before employing them, using the online share code, the original documents with the applicant present, or an identity service provider offering Identity Document Validation Technology, and must keep copies for two years after the person stops working there. That is United Kingdom law and the detail sits in our guide to right to work checks. On all of this we write as editors, never as lawyers.

If you do decide to buy something, the prices are no longer frightening. Veriff publishes a self-serve tier at $0.80 per verification with a $49 monthly minimum, rising to $1.39 per verification on the next tier up, with enterprise terms quoted on request. The number worth holding on to is that one identity check costs less than a coffee, which removes cost as an excuse and leaves only the question of where in the process it belongs.

One Live Check, at the Riskiest Moment

Identify the single point in your process where a false identity would do the most damage. Usually that is immediately before an offer, or immediately before someone receives credentials. Put one live, human check there and nowhere else.

Options are mundane. A video conversation in which the person works through a short task on a shared screen. A brief meeting in person where geography allows it. A verification step owned by whoever runs payroll or security. The specific mechanism matters far less than the fact that it is one step, applied to everybody, explained in advance. One check done properly earns more trust than five done anxiously.

Questions That Reward Lived Experience

A person who actually did the work can talk about it in ways a generated profile cannot imitate. Aim at the untidy middle of a project rather than its outcome. Which part went wrong? Who disagreed with the approach, and what was their argument? What would they build differently now? Take a single line off the CV and ask what happened around it.

Listen for texture. People who lived through something supply strange, unhelpful, specific details: the name of a vendor, the week it all slipped, the colleague who turned out to be right. Somebody working from a memorised profile tends to stay at altitude. None of this proves anything either way, and plenty of honest, nervous people answer vaguely. A flat answer earns a sharper follow-up, not a conclusion.

Most of this is settled in the opening conversation. Our piece on what the best hiring managers do differently on the first call shows how to draw out detail without turning the conversation into an interrogation.

Mistakes That Make It Worse

Do not request a passport scan by email in week one. That is the worst possible moment to ask. Nobody has given this applicant a reason to trust you yet, and a sensitive document sent to an unverified address creates risk for them rather than comfort for you.

Do not lean on a single tool that promises to detect fakes. Such systems get it wrong in both directions, and a false positive is not an abstraction. It arrives in the inbox of a real applicant who now has to prove their own existence.

Nor should your own interviewers be the last to know. A panel that knows what to watch for, and knows that an inconsistency is grounds for another question rather than an accusation, behaves far better than one that discovers the whole subject halfway through a call.

Keeping the Check Humane

Verification fails quietly rather than loudly. Poor bandwidth, an unfamiliar accent, a nervous manner: any of these can read as irregular on a video call, and none of them is evidence of anything whatsoever. Anchor the check to things you can write down, such as a contradiction between a document and a live answer. Record what you observed, and have a second person read it before any decision is taken.

Count the cost of getting it wrong in the other direction, too. Treat a genuine applicant as a suspect and they will remember it for years, and describe it to everybody they know. Most misunderstandings are repaired by a prompt apology and a straight explanation, so give both.

Friction has a price at the end of a process as well. Our piece on why candidates vanish at the offer stage rather than the interview is worth reading before you add a step near the finish line.

Compare Notes Across the Panel

Pool what the interviewers saw. If your founder, your hiring manager and your recruiter each walked away describing a slightly different person, that discrepancy deserves a conversation rather than a shrug. Fraud is generally caught by comparing accounts, not by one brilliant question.

State the reason once, warmly, near the beginning: impersonation has grown more common now that so much hiring happens on screens, so every hire here has their identity confirmed. Real candidates will nod and move on. It also signals that you take security seriously, which the better candidates in security-adjacent fields notice and appreciate. The practical mechanics of doing this over video are covered in our guide to identity checks in remote interviews.

Why We Would Not Buy a Fraud Detector First

The market would like to sell you detection. Screening that scores an applicant's authenticity, flags a suspicious profile, rates a video for signs of synthesis. We think that is the wrong first purchase, and the ordering here matters more than the brand.

Start instead with the step you already owe and most companies perform badly: one documented identity check, late in the process, done the same way for everybody. In Britain that check is a legal obligation anyway, so doing it properly costs you nothing you were not already spending. Add the bureau's free questions, which require no subscription and no vendor, and you have covered the overwhelming majority of what a small employer can realistically catch. A paid verification at under a pound a head is a sensible complement to that. It is a poor substitute for it.

The cost nobody quotes you is the one that lands on honest applicants. A detector tuned to find fraud in a population where fraud is rare will produce mostly false alarms, and every false alarm is a real person being asked to prove they exist. Teams that lead with suspicion usually find the damage shows up somewhere they were not measuring: in withdrawn applications, in the quality of who bothers to finish, in what gets said about them in a group chat. Asking for two documents where one would answer the question is the same error in miniature. Verification should be the narrowest thing that works, and it should arrive after you have given somebody a reason to trust you, which is also the spirit of our approach to reference checks.

A role that is itself the target changes our position. Privileged access to production systems, payment approvals, customer records: there the sentencing documents describe exactly your company, the attacker is funded by a state rather than opportunistic, and layering a paid check on top of the free ones is proportionate rather than paranoid. Everywhere else, the detector is a purchase that buys comfort and sells away goodwill.

Write the Policy Down Before You Need It

The worst moment to design a verification process is the afternoon somebody raises a concern about a candidate. Decide now, in writing, what the check is, who performs it, at which stage, and what happens when something does not line up. Two sentences of policy will do. The purpose is not bureaucracy; it is making sure that the same standard applies to the applicant whose video keeps freezing as to the one whose answers felt a little too fluent.

Agree the escalation route too. A mismatch goes to one named person, who speaks to the candidate directly and asks a straight question rather than quietly declining them. Most discrepancies have dull explanations, and a candidate given the chance to supply one usually does.

Where to Get Help

Where a role touches money or sensitive systems, have the process reviewed once by whoever leads security for you, or by an outside adviser. Requirements for identity verification, right-to-work documentation and data handling differ from country to country, and this article is editorial guidance rather than legal advice. Take advice in the jurisdiction you hire in before you build a policy on it.

A recruiter who works your market is useful here as well. They see patterns across dozens of companies, and they usually hear about a particular scam doing the rounds weeks before anyone else does.

The risk is real and the proportionate answer is small. A single calm check, announced plainly and applied without exception, will carry most teams through their first year of this.