AI Hiring Fraud: Warning Signs at Every Hiring Stage

Hiring fraud rarely shows up as one obvious moment. It is usually a series of small mismatches spread across the funnel: a profile that does not match the CV, an interview with odd pauses, a request to ship a laptop somewhere unexpected.

This post maps the warning signs to each hiring stage, so recruiters, hiring managers and IT teams know what to watch for and who should act.

Try it: use ProofAI's AI resume detector, free for 10 checks a day with no login.

How big is the problem?

Reliable numbers are limited, so here is what has been measured or documented:

• In a Gartner survey of 3,000 job candidates, 6% admitted taking part in interview fraud. Gartner also predicts that by 2028 one in four candidate profiles worldwide will be fake. That is a forecast, not a measurement.
• The FBI has warned since 2022 about deepfakes and stolen personal data used to apply for remote jobs, mostly in IT and software roles.
• In October 2026, the US Department of Justice announced actions against North Korean remote IT worker schemes affecting more than 70 US companies. An earlier case, charged in January 2025, involved at least 64 US companies.

Most of the published cases are American, but the tactics depend on remote hiring rather than geography. Any company that hires remotely for technical roles, including Indian IT and GCC teams, faces the same exposure.

Not every warning sign below means fraud. Each one is a prompt to verify, not a reason to reject.

Stage 1: Application and profile

Warning signs

• Online profiles that do not match the CV, several profiles for one identity with different photos, or profiles with no photo. The FBI lists these in its red-flag indicators for fraudulent IT workers.
• Dates, employers or job titles that differ between the CV, LinkedIn and the application form.
• A profile photo that looks generated, or that a reverse image search finds elsewhere under another name.
• Many applications from the same contact details to unrelated roles in a short time.

What to do: Cross-check two or three facts against independent sources, such as the employer's main phone line or the university registrar. Do not rely on contact details the candidate supplied.

Stage 2: Screening and assessments

Warning signs

Also read: How to Detect AI in PDFs, Docs, Images and Videos

• Signs of cheating on coding tests or interview questions. The FBI describes long pauses, stalling, eye movements that suggest reading, and answers that are plausible but wrong.
• A take-home test or writing sample far stronger than anything the candidate produces live.
• A highly polished, generic CV. On its own this means very little: Gartner found 39% of candidates use AI during the application process. AI-polished writing is common and often legitimate. The concern is when it hides what the person can actually do.

What to do: Add one short live task with follow-up questions that build on the candidate's own answers.

Stage 3: Video interviews

Warning signs

• Unwillingness or inability to appear on camera, or appearance, time zone or location that keeps changing. This is the first indicator on the FBI's list.
• Lip movement that does not match the audio, or coughs and sneezes that do not match what happens on screen. The FBI's 2022 notice describes both.
• Undue concern about drug tests or in-person meetings, and saying they cannot attend.

What to do: Ask the candidate to hold their ID up to the camera, and where practical hold one in-person or verified meeting before the offer.

Stage 4: Offer and onboarding

Warning signs from the FBI's list:

• A request to send the company laptop to a freight forwarding address, or a home address that changes soon after hiring.
• Repeated requests for prepayment, with anger when refused.
• Frequent changes of payment accounts, or requests to be paid through other platforms or methods.

What to do: Ship equipment only to verified addresses with signature on delivery. Confirm bank details through the bank, not through documents the new hire sends.

Stage 5: The first weeks

Warning signs

• Remote-access software installed on a company laptop. In the DOJ's January 2025 case, US-based helpers hosted company laptops at home in "laptop farms" and installed remote-access software so that workers abroad could appear to be in the US.
• Login locations that do not match where the laptop is supposed to be.
• Threats to release source code unless extra payments are made. The DOJ says some of these workers have stolen company data and attempted extortion.

What to do: Give new hires least-privilege access, block unapproved remote-desktop tools, and have IT check that device locations match login locations.

Make it a shared process

Fraud slips through when each team sees only one piece of the picture. A few habits help:

• Give every stage an owner. Recruiters check profiles, interviewers note live-performance gaps, HR checks identity and payment details, and IT watches devices.
• Log anomalies in one place, so three small concerns from three people can be seen together.
• Treat everyone the same. Apply identical checks to every candidate for a role, and record why decisions were made. An accent, a slow connection or a nervous manner is not a red flag.
• Report it. In the US the FBI asks companies to report suspected cases to IC3.

Where a detector helps

At stage 1 and 2, an AI text detector can tell you which CVs, cover letters or writing samples to probe in interview. ProofAI's AI resume detection accepts PDF, DOCX, DOC and TXT files up to 25 MB and shows the passages that drove its score. It does not check video, and like every detector it gives a probability, not proof. Never reject a candidate on a score alone.

ProofAI sends the text or files you check to AI model providers to analyse them and keeps a record of each check (date, type and score, never your content); see our privacy policy.

Sources

• Gartner, Survey Shows Just 26% of Job Applicants Trust AI Will Fairly Evaluate Them (31 July 2025)
• FBI IC3, Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions (28 June 2022)
• FBI IC3, Additional guidance on DPRK IT workers: red flags and mitigations
• US Department of Justice, Two North Korean Nationals and Three Facilitators Indicted (23 January 2025)
• US Department of Justice, Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies (13 October 2026)

Written and reviewed by the 4Born Content Writer Team. AI tools assisted with drafting; every statistic above links to its source.