Industry forecasts for 2026 rank deepfake job candidates among the most significant emerging fraud threats, and hiring teams increasingly report interviewing someone who turned out not to be who they claimed. The good news: fraud leaves signals, and a few well-placed controls catch most of it.
The four kinds of candidate fraud
- Proxy interviews. A more skilled person sits the interview, and someone else turns up for the job. Increasingly the substitution happens in real time, on camera.
- Deepfake video and voice. Face-swap and voice-cloning tools let one person appear as another in a live call, or replay pre-recorded video through a virtual camera.
- AI-assisted answers. A genuine candidate reads answers generated in real time by an AI assistant, so the interview measures the tool, not the person.
- Synthetic or stolen identities. Entire personas, with fabricated work histories and borrowed identity documents, built to win remote roles and the system access that comes with them.
Why security roles are a prime target
A security engineer's first week can include privileged access to identity systems, cloud consoles and incident data. For an attacker, a job offer is an access path: no exploit required. Governments and industry bodies have publicly warned about organised schemes placing fraudulent remote IT workers inside companies to earn revenue, steal data or extort their employers. For security roles, a successful fake candidate is a security incident.
Warning signs
None of these proves fraud on its own. Together, they tell you where to look harder.
- Video that is oddly smooth, slightly out of sync with speech, or glitches around the face when the person moves or turns.
- A camera reported as virtual-camera software, or a picture that barely changes for minutes at a time.
- Pauses before every answer, eyes tracking a second screen, or polished answers delivered at reading pace.
- Generic answers that never include a specific system, number or mistake from the candidate's own experience.
- Reluctance to turn the camera on, to switch to an unplanned topic, or to meet in person.
- Inconsistencies between interviews, references, identity documents, payroll details and the delivery address for equipment.
A layered defence
Before the interview
- Verify identity with a document and liveness check at the start of the process, not at offer stage.
- Tell candidates up front what checks you run. It deters fraud and is fairer to everyone.
During the interview
- Ask structured, experience-based questions and always follow up: "what exactly did you do, and how did you know it worked?" Rehearsed and AI-generated answers fall apart at the second question.
- Monitor integrity signals: virtual cameras, static or replayed video, leaving the interview window, pasted text and text that appears in bursts.
- Tag each signal to the answer it affects, so reviewers know which evidence to distrust.
After the interview
- Contact referees through independently found details, not numbers supplied by the candidate.
- Verify qualifications, certifications and security clearances with the issuer.
- Re-check identity at onboarding, and treat mismatched payroll or shipping details as a stop sign.
Staying fair
Fraud controls must not become a new source of unfairness. Integrity signals should prompt a human review, never an automatic rejection: people have unreliable internet, use accessibility tools and get nervous. Avoid emotion or facial-expression analysis entirely, offer a human interview on request, and record why each decision was made.
This is how Critical Hive works: AI vision proctors the interview live and a selfie is captured at the start — no video is recorded or stored — with structured STAR-method questions, adaptive follow-ups, integrity signals tagged to each answer, and scores based only on what candidates say. A person makes every decision. Photo ID is collected by the recruiter if the candidate progresses, not by Critical Hive.
Further reading: Addressing the threat of fake job candidates (New York State Bar Association) and Deepfake interviews (Metaview).