The person behind the resume: Candidate fraud and the advance decision

Candidate fraud has outgrown the recruiter's gut check. Here's what the research shows, how the market is responding, and how Authenticity Suite Pro puts evidence and identity verification where advance decisions happen.

‍

In July 2024, KnowBe4 hired a software engineer who cleared four video interviews, a background check, and reference verification. He was a North Korean operative using a stolen identity. Endpoint security caught him trying to install malware shortly after his workstation was activated. KnowBe4's business is teaching people to spot deception.

‍

If that team couldn't see it, a recruiter working through several hundred applications for one req can't be expected to either. Academic studies put human accuracy at spotting AI-generated content and real-time deepfakes at about 50%, roughly a coin flip.

‍

The question in front of TA and security leaders has changed. It used to be whether a candidate was qualified. Now it's also whether the person is who they claim to be, and whether you can show how you decided before an interview slot is spent.

Candidate fraud detection: The state of the problem

The numbers point one way

Gartner projects that one in four candidate profiles worldwide could be fake by 2028. That's a forecast, but the current data isn't. In a second-quarter 2025 Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, either impersonating someone else or having another person interview in their place.

‍

Findem's own application data shows why a single number misleads. Fraud rates vary widely by job family, from under 3% for some roles to more than 50% for others, and many job families sit below 10%. Some company types draw far more than their share. Security firms, for example, attract disproportionate fraud because bad actors are specifically trying to get inside them. For certain roles, Findem sees more than half of applicants flagged with fraud signals.

Proof changes the curve

Findem's assessment data points to what works. Across millions of validated technical assessments run over several years, published as The Candidate Fraud Curve, fraud indicators approached 20% to 25% where hiring relied on resumes and unverified remote testing. Once structured skill validation and identity controls became standard, they settled at 2% to 4%, even as assessment volume grew.

‍

The pattern held across the top 100 enterprise hiring organizations by assessment volume. Most clustered between 1% and 4%, while several exceeded 6% to 10%. Volume didn't predict the difference. Governance and identity controls did.

‍

These are fraud indicators in assessments, so they measure a different population than the application-level figures above. But the direction still matters: signals alone invite manipulation, and proof makes manipulation stop paying off.

Trust is breaking on both sides

Candidates are using AI too. A fourth-quarter 2024 Gartner survey of 3,290 candidates found that 39% used AI during the application process, most often to write resume text. At the same time, only 26% of candidates trust AI to evaluate them fairly, and only half trusted that the jobs they applied for were real.

‍

That second set of numbers should shape how fraud defense gets built. A process that quietly screens people out with an opaque score deepens the distrust honest candidates already feel. Verification that candidates understand and agree to is a different experience.

Fraud enters through HR and lands in Security

Gartner's Jamie Kohn has warned that candidate fraud creates cybersecurity risks that can be more serious than a bad hire. Security teams will recognize the pattern from social engineering attacks on IT help desks. An attacker who can impersonate an employee to gain access can impersonate a candidate to get hired, and then arrive with a laptop and credentials.

What recent market research adds

A June 2026 Kyle & Co report on candidate fraud surfaced three findings worth carrying into your next planning conversation.

‍

• Detection by eye has hit its limit. At roughly 50% accuracy against sophisticated fakes, recruiter training can't be the main line of defense.
• Defenses cluster in the wrong place. Tooling is densest at application intake, where fraud is cheapest to catch, and thinnest at references and after hire, where it does the most damage. Identity verification often runs at the background-check stage, after several rounds of interviews. The check isn't failing. It's firing late.
• Ownership matters more than tooling. From a two-person TA team to a global enterprise, the common gap was accountability, not budget. The report's summary line: "Recruiters carry the floor. They cannot carry the ceiling."

How the market is responding

More than 60 vendors now claim some form of fraud detection. Buyers don’t want to know if a fraud feature exists, but where that feature sits relative to the moment a recruiter decides to advance someone, and what happens after a flag fires. Three approaches account for most of the market.

ATS-native detection

Greenhouse and Ashby, both Findem integration partners, have shipped fraud detection inside the applicant tracking system. It lives in the system of record and the recruiter's daily workflow, so adoption is easy. Coverage today is concentrated at the point of application.

‍

One point applies to every embedded tool, Findem's included: signals need someone with the time, mandate, and training to adjudicate them. For teams that run Findem with Greenhouse or Ashby, Authenticity Suite Pro adds a second layer on the candidate review screen, with deeper signal context and identity verification before an interview is booked.

AI recruiting and sourcing platforms

AI sourcing platforms such as Juicebox approach fraud indirectly. Juicebox's own launch materials cite rising application fraud as a reason to lean on outbound sourcing agents instead of sifting through inbound. Its trust center says the AI is meant for the pre-application phase and doesn't contribute to candidate decisions.

‍

Going outbound is a reasonable answer to noisy inbound, but it isn't a verification layer. Applications still arrive, sourced candidates still move into interviews, and someone still has to decide who is real before an interview slot is committed.

Standalone fraud tools

Purpose-built tools such as Tofu and Endorsed treat fraud detection as the core product, and some go deep. The trade-off is placement. They detect fraud as standalone tools, disconnected from where advance decisions are made. Gem uses Tofu for fraud detection, but it remains a separate layer, so signals and advanced decisions don't share a surface.

Where Authenticity Suite Pro fits

The same report identified four vendors from four different categories that arrived independently at the same design commitments: surface signals rather than verdicts, explain every signal so the recruiter can interrogate it, and refuse automated rejection. Findem is one of them, alongside Ashby, Socure, and CodeSignal.

‍

What sets Findem apart is doing this natively inside a people intelligence platform. Structured signals with candidate-specific context and identity verification sit inside the candidate review screen, with a complete audit trail, rather than in a separate point solution bolted onto the workflow.

Authenticity Suite Pro: What it is, what it does, what it means

Authenticity Suite Pro answers two questions at the moment of advance. Is this resume real? Is this person who they claim to be? Signals show a recruiter where to look. Verification supplies the proof.

What it is

Authenticity Suite gave recruiters three fixed fraud signal categories. Authenticity Suite Pro expands that to 13 categories and adds identity verification, all in the same workflow.

Fraud signals

These run automatically on every application, so concerns surface at the point of application, well before a screen or offer. Findem analyzes resumes, profiles, and online footprints against its 3D People Graph, which connects people and company information from thousands of sources. Findings are organized into 13 categories, and each flagged category comes with a plain-language explanation specific to that candidate.

‍

For example, Findem checks whether companies on a resume appear in its company graph and flags employment details that conflict with other sources. It also looks for patterns such as repeated applications from one location, unusual employment overlaps, and hidden text in application documents.

Identity verification

A recruiter sends the candidate a secure link to a short, consent-based, AI-proctored session. Liveness checks confirm a real person is present, not a photo, recording, or deepfake. Government-issued ID verification is available where administrators enable it.

The Authenticity Report

Results post to the candidate's profile, including unsuccessful or inconclusive outcomes. Every check is timestamped and recorded in an audit trail.

What it does

Heads of TA or HR

Advance decisions follow a consistent, documented process across recruiters instead of each person's instinct.

Recruiter

A flag becomes a specific question to investigate. Verification goes out in one click for one candidate, or in bulk for a slate. After review, recruiters can confirm or dismiss each flag.

CISO or Security

Identity is confirmed before interview time is committed and well before system access is granted, with a record to review if something goes wrong.

Legal and Compliance

Signals are framed as questions, not accusations, and the record shows what was checked and when.

Candidate

A clear explanation, a consent step, and a fair chance to explain an anomaly that has a legitimate reason behind it.

What it means

• Fewer interview loops spent on the wrong person: Concerns surface and get resolved before a hiring manager's calendar is involved.
• Verification moves earlier: Recruiters can request it as soon as a signal raises a question, instead of waiting for the background check after several interview rounds. That's a direct answer to the firing-late problem.
• Decisions you can explain: When a hiring manager or auditor asks why a candidate advanced, the Authenticity Report is the answer.
• People stay in charge: No applicant is automatically advanced or rejected. Recruiters interpret the findings and make the call.
• Protection, not a feature: Some months, Authenticity Suite Pro may flag nothing worth acting on. That's the outcome you're paying for.

What it doesn't cover

Authenticity Suite Pro doesn't verify references or reconfirm identity once someone is hired. Both remain among the least-served parts of the market. For the onboarding handoff, Findem's ID Verify, available as a standalone product, adds Day One reverification: new hires confirm their identity again against the data captured during hiring, so the person who starts is the person who interviewed. Within Authenticity Suite Pro, identity verification is recruiter-initiated rather than automatic on every applicant.

The part no tool solves: Who owns the flag

The hardest part of candidate fraud is organizational, not technical. Detection without a response plan leaves recruiters holding signals they have no authority to act on. Whatever tooling you choose, three questions are worth answering:

‍

1. Who adjudicates a flagged candidate, and with what authority?
2. When does a concern move from TA to Security or Legal, and through what path?
3. Who decides which roles get identity verification before interviews?

Findem's assessment data makes the same point from another angle. Across large hiring organizations, governance and identity controls predicted fraud exposure better than hiring volume did.

‍

Authenticity Suite Pro gives each of those people the same evidence on the same screen. It can't decide who those people are. That's a decision for TA and Security to make together, and it's far easier to make before the next incident than after it.

See it on a real candidate

Authenticity Suite Pro is generally available today. Government-issued ID verification is available in the United States and India at launch.

‍

The fastest way to judge Authenticity Suite Pro is to watch it work. In a demo, we'll open a flagged profile, walk through what each signal means, send a verification request, and review the Authenticity Report that comes back. We'll also talk through how your team would route what it finds. If your security team has a stake in hiring risk, bring them along.

‍

Request a demo with the team. Authenticity Suite Pro builds on the original Authenticity Suite. Read how it started: Introducing Findem's Authenticity Suite.

Frequently Asked Questions

For Heads of Talent Acquisition and HR

Does Authenticity Suite Pro automatically reject candidates?

No. Signals identify questions to clarify, not proof of misconduct. No applicant is automatically advanced or rejected, and many flagged details have legitimate explanations, such as an overlapping contract role. Recruiters review the findings, talk with the candidate where needed, and decide.

How is Authenticity Suite Pro different from Authenticity Suite?

Authenticity Suite surfaces three fixed fraud signal categories. Authenticity Suite Pro expands that to 13 categories, each with a candidate-specific explanation, and adds identity verification, optional Interview Prep, and the Authenticity Report.

Does identity verification run on every applicant?

Fraud signals run automatically on every application. Identity verification is recruiter-initiated. A recruiter sends a request to one candidate or to a group in bulk, which keeps the added step where there's a reason to ask for it.

What does the candidate experience?

Candidates receive a secure link with an explanation of what verification involves, and they give consent before starting. The session is short and AI-proctored, with a liveness check and government ID where enabled. If the recruiter has turned on Interview Prep, candidates also see role context and answer a few pre-screening questions.

How long does verification take?

The checks themselves run instantly. Total time depends on how quickly the candidate completes their session, and recruiters can send the request as soon as a signal raises a question, well before interviews are scheduled.

For CISOs and Security Leaders

Is government ID required, and where is it available?

Liveness checks are part of every verification session. Government-issued ID verification is available subject to administrator permissions, in the United States and India at launch.

Can we see how signals are detected?

You can see which of the 13 categories are flagged and a plain-language explanation of each. The underlying detection logic isn't disclosed, so people attempting fraud can't study it and work around it.

What does the Authenticity Report record?

The report posts to the candidate's profile and records each check and its outcome, including unsuccessful or inconclusive results. Every entry is timestamped and captured in an audit trail, so you can show what was verified and when.

Does it cover reference fraud or post-hire identity handoffs?

Not within Authenticity Suite Pro, which focuses on the application and pre-interview stages. For the onboarding handoff, Findem's ID Verify, available as a standalone product, includes Day One reverification, where new hires confirm their identity again against the data captured during hiring. Reference verification isn't covered today. Your Findem team can walk through how those fit with your Security and IT controls.

How should TA and Security divide ownership?

Shared ownership between TA and Security is one of the most common models among organizations actively investing in fraud prevention. TA runs the hiring process and candidate experience. Security provides investigative support for higher-risk cases, with escalation paths defined in advance. Findem can walk through how that model maps to your team in a demo.

How do you detect candidate fraud?

In two layers. First, every application is analyzed against Findem’s 3D People Graph, which connects people and company information from thousands of sources. Findings roll up into 13 signal categories, such as companies that can’t be verified, employment details that conflict across sources, repeated applications from one location, and hidden text in application documents.

‍

Each flag comes with a plain-language explanation of what looks unusual. Second, when a signal raises a question, recruiters can send an identity verification session that confirms a real person is present and, where enabled, matches them to a government-issued ID. Recruiters review both and make the call.