Deepfake Job Candidates: How to Verify Who You Hire

Remote hiring means you may make an offer to someone you have only seen through a webcam. For most candidates that is fine. But law enforcement agencies have now documented cases where the person on the call was not the person on the CV.

This guide covers what is known about the problem and a step-by-step way to confirm identity without making the process hostile for honest applicants.

Try it: use ProofAI's AI resume detector, free for 10 checks a day with no login.

What the evidence actually shows

The clearest early warning came from the FBI. In June 2022 its Internet Crime Complaint Center reported an increase in complaints about deepfakes and stolen personal data being used to apply for remote jobs. The roles were mostly in IT, programming, databases and software, and some came with access to customer data, financial data or company systems. In some cases, background checks showed the personal details belonged to someone else.

Since then the US Department of Justice has prosecuted organised schemes in which North Korean IT workers got remote jobs using stolen or fake identities:

In January 2025, the DOJ charged five people over a scheme in which at least 64 US companies gave work to the defendants and their co-conspirators between 2018 and 2024. Forged and stolen documents, including US passports, were used to hide the workers' identities.
On 13 October 2026, the DOJ announced actions affecting more than 70 US companies, including searches of suspected "laptop farms" in Texas and the seizure of about 187 devices. The release says some of these workers also stole sensitive company data and attempted extortion.

On the wider picture, Gartner predicts that by 2028 one in four candidate profiles worldwide will be fake. In its survey of 3,000 candidates, 6% admitted taking part in interview fraud, which HR Dive describes as impersonating someone or having someone impersonate them. Treat the 2028 figure as a forecast, not a measurement.

In India, CERT-In has issued an advisory on deepfakes. As summarised by Khaitan & Co, it recommends verification protocols such as multi-factor authentication and callback procedures, plus reverse image searches to check where media came from.

What a deepfake interview can look like

The FBI's 2022 notice describes two specific signs seen in interviews:

Want to check your own content? Try ProofAI free 10 checks a day, no login needed.

Also read: EU AI Act Article 50: AI Transparency Rules Explained

Lip movement that does not fully match the audio.
Coughing, sneezing or other sounds that are not matched by what the person does on screen.

These are useful, but do not rely on spotting artefacts alone. Video quality, bandwidth and cheap webcams cause similar glitches, and deepfake tools keep improving. Process beats eyesight.

A five-step verification workflow

1. Tell candidates what to expect

State in the job post or first email that you verify identity before an offer and that interviews are on camera. Gartner's first recommendation to employers is setting clear expectations about hiring standards and fraud checks. Honest candidates rarely object to a process they were told about in advance.

2. Check the person, not just the documents

The FBI's guidance on North Korean IT workers suggests:

Ask the candidate to hold their passport, driving licence or other ID up to the camera during a video call.
Require notarised proof of identity for higher-risk roles.
Do not accept background-check documents from unknown sources. Get the candidate's signed consent and run the check yourself.
Keep records of interactions, including interview recordings where local law allows. In India, check your obligations under data protection law before recording.

3. Use one interview the candidate cannot script

Ask follow-up questions that build on the candidate's own earlier answers, or ask them to talk through a small task live. The same FBI guidance lists long pauses, stalling, eye movements that suggest reading, and plausible but wrong answers as signs of outside help. Where it is practical, one in-person meeting settles the identity question. Gartner found 62% of candidates said they were more likely to apply if a role required in-person interviews.

4. Verify money and equipment details

Several FBI recommendations concern the period between offer and first day:

Ship laptops only to approved addresses, and require a signature on delivery.
Confirm bank details with a voided cheque or a statement from the bank, and check that the account is at a real bank rather than a money service business.
Be wary of a home address that changes soon after hiring.

5. Limit access in the first weeks

If someone gets through, limited access contains the damage. The FBI advises restricting admin permissions, blocking remote-desktop tools on company devices, asking remote staff to turn off commercial VPNs on company networks, and checking that laptop locations match login locations.

Keep it fair

Most candidates who have a bad connection, a nervous manner or a heavy accent are exactly who they say they are. Use red flags to decide what to verify next, not to reject. Apply the same checks to every candidate for a role, so that no group gets extra scrutiny, and write down why each decision was made.

Where text and image checks fit

Identity fraud often comes with AI-written applications and AI-generated profile photos. A detector can help you choose where to dig. ProofAI's image detection accepts JPG, PNG and WebP files up to 25 MB, and CVs or cover letters can be checked as PDF or DOCX files. ProofAI does not detect deepfake video yet, and every result is a probability, not proof. Never reject a candidate on a score alone.

ProofAI sends the text or files you check to AI model providers to analyse them and keeps a record of each check (date, type and score, never your content); see our privacy policy.