Interview Fraud: What Can and Cannot Be Detected in 2026

You have a strong remote candidate on screen. The CV is clean, the answers are sharp and the references sound keen. Something feels slightly off, but you cannot say what. Is it nerves, a bad connection, or a person who is not who they say they are?

Most hiring teams are asking the same question in 2026. The honest answer is that some identity and fraud signals are easy to check, and some are very hard to detect at all. This guide separates the two, then gives you a layered process, a checklist and a worked example you can adapt this week.

Why interview fraud is on the agenda now

Interview fraud used to mean an inflated job title or a borrowed qualification. It now also includes organised identity fraud aimed at remote technical roles.

Joint government warning. As at 31 July 2026, Australia, New Zealand and nine other governments jointly warned that North Korean IT workers use fake identities and AI to hide who they are and win remote jobs, to earn money for weapons programs and to steal data (reported by Tampa Free Press and HC Magazine).
Australian Sanctions Office advisory note. As reported by Defence Connect (as at April 2026), the note tells businesses to independently verify remote workers' identity details and documents. Red flags it lists include stolen identities, fake GitHub and LinkedIn portfolios, AI image generators and voice changers.
Updated red flags. A government advisory updated in February 2026, as summarised by BrightHire (as at September 2026), adds fake personas, forged documents and face-swap filters.
Industry is comparing notes. According to the US Embassy in Australia, more than 80 people from Australian tech, recruitment, staffing and finance met around May 2026 to share ways to detect these tactics.

Everyday dishonesty matters too. In a StandOut Resume survey of more than 1,000 Australians, reported in an FMC Group statistics roundup (as at October 2026), 42.5% admitted lying on an application or in an interview at some point, and three-quarters of those who lied said they were not caught. It is self-reported, so treat it as a rough indication rather than a precise rate.

What can be detected

Some signals are genuinely checkable because they leave evidence you can compare. BrightHire (citing Mandiant, as at September 2026) and Righteo (as at March 2026) describe these as practical starting points:

Internet phone (VoIP) numbers. Look up the number type before the first call. A VoIP number is not proof of anything, but it is worth noting alongside other signals.
Location that does not match. Compare the claimed location with time zone behaviour, the address on documents, payroll details and where equipment will be shipped.
Faces that do not match. Compare the person on camera with their ID and with photos on their online profiles. Do this across more than one interaction, not only the first call.
Candidate and referee on the same device or IP address. If your reference process collects technical details, a match between candidate and referee is a strong prompt for further checks.

The common thread: each of these compares two independent pieces of evidence. That is what makes them checkable.

What is hard to detect

Other signals are easy to fake and hard to prove. Be honest with your team about this, so nobody relies on a gut feeling or a single tool.

Convincing fake candidates are quick to make. Palo Alto Networks found that someone with no experience could build a fake candidate able to pass a video interview in about 70 minutes (reported by The Interview Guys, as at May 2026).
Deepfakes are a mainstream fraud concern. Experian's 2026 fraud forecast lists deepfake candidates among its top five threats (reported by HC Magazine, as at October 2026).
Answers can be fed in real time. Recorded Future found operators receiving answers in real time via AI transcription (reported by The Interview Guys).
Misrepresentation is harder to check. Australian lawyer Duncan Fletcher of Kingston Reid told HR Leader (as at July 2026) that AI makes misrepresentations "difficult to fact-check."

What this means in practice: deepfake detection tools and AI-written-text detectors can add a signal, but they do not work reliably enough to make a decision on their own. They miss things, and they can flag honest people. Treat any output as a reason to check further, never as a verdict.

A layered process that does not depend on red flags

Australian firms are moving away from spotting red flags and towards layered checks, according to WorkPro (as at September 2026): ID, work rights, licences, qualifications and employment history. Here is how to spread those layers across your hiring stages.

Before the interview

Check the phone number type and email domain age where you can.
Compare the CV against public profiles for consistency of dates, employers and photos.
Note the claimed location and time zone so you can compare later.

During the interview

Ask follow-up questions that require specific, lived detail: a decision they made, what went wrong, who they worked with.
Ask them to explain their own earlier answer in different words. Fed answers tend to fall apart on the second pass.
Keep a record of what the candidate actually said, so reviewers judge evidence, not impressions.

Before the offer

Verify ID documents through an independent process, not only by viewing them on camera.
Confirm work rights, licences and qualifications with the issuing body where possible.
Call referees on numbers you found independently, such as a company switchboard, not the number the candidate supplied.

After the hire

The New Zealand NCSC Cyber Threat Report (reported by HC Magazine, as at October 2026) describes a North Korean contractor who passed hiring at a large NZ business using fake ID, a local address and a recruited NZ citizen who received and ran the company laptop. Once exposed, the worker threatened to leak commercially sensitive data. The suggested fix: send laptops only to the named hire, signed for in person.

The Australian Sanctions Office advisory note also recommends limiting remote workers' access to payroll and personal data. Combine both:

Ship equipment only to the verified person, with in-person sign-off.
Start new remote staff on least-privilege access and expand it as trust is established.
Watch for sudden changes in working hours, location or bank details in the first months.

Interview fraud checklist

Phone number type checked and noted
Claimed location compared with documents, time zone and shipping address
Face compared with ID and online profiles across more than one interaction
Follow-up and rephrase questions used in the interview
Interview evidence recorded in the candidate's own words
ID verified independently, not only shown on camera
Work rights, licences and qualifications confirmed at source
Referees contacted via independently found numbers
Candidate and referee technical details compared, where collected
Laptop shipped to the named hire only, signed for in person
Starting access limited, especially to payroll and personal data
Every flag reviewed by a person before any decision

Worked example

This is an illustrative scenario, not a real client.

A Brisbane software firm is hiring a remote cloud engineer. The leading candidate says they live in Melbourne. Before the first call, the recruiter notes the mobile number is VoIP. On its own, that means little: plenty of contractors use VoIP.

In the interview the candidate answers technical questions fluently, but when asked to rephrase an answer about a migration project, they repeat almost the same wording and cannot name anyone they worked with. The hiring manager records this as evidence, not a conclusion.

At reference stage, the firm calls the previous employer's switchboard rather than the supplied number. The switchboard has no record of the referee. The firm pauses, asks the candidate for independent ID verification and an in-person meeting in Melbourne before any equipment is sent. The candidate withdraws.

No single signal decided the outcome. Three independent checks, each recorded, did.

Avoid flagging honest candidates

Every signal above has an innocent explanation somewhere. People use VoIP numbers, travel, have poor webcams, get nervous and share devices at home. If you treat signals as verdicts, you will lose good people and you will not stop determined fraudsters.

Two practices help. First, make sure a person reviews every flag, using the approach in our human review checklist for AI shortlists. Second, be explicit about what was and was not checked. In Critical Hive, for example, a person always makes the hiring decision, scores come with the candidate's own words as evidence, and the integrity report lists what was and was not checked, so nobody mistakes a partial check for a clean bill of health. You can see how that works on the fraud and integrity page.

If you hire for security roles where access risk is high, our cyber security recruitment team applies the same layered approach.

FAQ

Can AI tools reliably spot a deepfake on Zoom?

No. Detection tools can add a signal, but they do not work reliably enough to base a decision on. Palo Alto Networks' finding that a passable fake candidate can be built in about 70 minutes shows why layered checks matter more than any single tool.

Is asking a candidate to hold up ID on camera enough?

Not on its own. Documents can be forged and faces can be altered with filters, as the February 2026 advisory notes. Use independent verification and, for higher-risk roles, an in-person step. Whether and how you collect ID is a privacy question; this is general information, not legal advice, so check with your adviser.

What if I think I have already hired a fake worker?

Act quickly and get legal advice. DFAT has warned that continuing to pay a suspected North Korean worker "may be viewed as sanctions contraventions" (reported by HC Magazine, quoting Coder Trove, as at October 2026). This is general information, not legal advice. Restrict access, secure equipment and data, and document what you know.

How do I check references are not the candidate's mates?

Find contact details yourself through company switchboards or official websites, ask specific questions about dates and projects, and compare technical details where collected. A candidate and referee on the same device or IP address is a strong prompt for further checks.

Next step

If you want to see how integrity evidence and human decisions fit together in a real interview flow, book a live demo.

Sources

This guide was drafted with AI assistance and passed automatic claims checks; it has not been reviewed by a person. General information only. Tell us if something looks wrong: contact us.