Candidate fraud detection: How to spot and stop fake applicants
Updated November 2026
On this page
Candidate fraud detection is the work of confirming that an applicant is a real person, is who they say they are, and has the experience they claim, before they reach interviews, offers, or system access. Most cases fall into three types: fabricated resumes, synthetic or stolen identities, and proxy interviews. No single check catches all three, so effective teams layer checks across the hiring stages and keep a person in charge of every decision.
Between AI helping “fake candidates” land jobs and international schemes designed to secure remote IT jobs for North Korean nationals at U.S. companies, the threat of fraudulent applications keeps growing. On October 13, 2026, the Justice Department announced charges in a scheme that affected more than 70 U.S. companies, along with the seizure of about 187 computer devices from suspected laptop farms in Texas.
This guide covers the three fraud types talent and security teams ask about most, where to check for each one across the hiring process, who should own a flag, and how to evaluate candidate fraud detection tools.
How common is candidate fraud?
Estimates vary by survey, role, and hiring channel, so treat any single number with care. These are recent, dated sources.
| Source | Published | Finding |
|---|---|---|
| Gartner candidate survey | July 31, 2025 | In a survey of 3,000 job candidates, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them. Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. |
| Greenhouse 2025 AI in Hiring Report | November 19, 2025 | 65% of U.S. hiring managers have caught applicants using AI deceptively, including reading from AI-generated scripts (32%), hiding prompt injections in resumes (22%), and showing up as deepfakes (18%). |
| Checkr Hiring Hoax survey | October 15, 2026 | Of 3,000 U.S. managers involved in hiring, 67% have confirmed or strongly suspected an interview proxy, up from 35% a year earlier. 40% have interviewed a candidate later revealed to be using a fake identity. |
| FBI public service announcement | October 13, 2026 | North Korean IT workers increasingly pay Americans to appear on camera, take part in job interviews, verify fraudulent identities, and lend their professional networking accounts. |
Fraud is also uneven across roles. Findem’s own application data shows fraud rates that vary widely by job family, from under 3% for some roles to more than 50% for others. Some company types, such as security firms, draw far more than their share.
The three types of candidate fraud
Real cases often combine all three. In the scheme described in a December 2024 indictment, North Korean IT workers used stolen identities to apply, paid U.S. residents to attend interviews under fake identities, and built phony company websites to back up their work histories.
| Fraud type | What it looks like | Where it surfaces | Signals worth checking |
|---|---|---|---|
| Fabricated resume | Invented employers, inflated titles or tenure, AI-written experience, and hidden text aimed at AI screeners | Application and screening | Companies that can’t be verified, dates that conflict with other sources, and a digital footprint much shorter than the claimed career |
| Synthetic or stolen identity | A real person’s stolen details, or real and invented details combined into a new persona, often with an AI-altered photo | Application through background check | Contact details with little history, names or addresses that don’t match across documents, and many applications from one location |
| Proxy interview or deepfake | Someone else attends the interview, or a face or voice overlay changes who appears on camera | Interviews and assessments | A different person at different stages, audio that doesn’t match lip movement, and answers that fall apart under follow-up questions |
Fabricated resumes
Generative AI made polished resumes cheap. In a Findem webinar with Kyle Lagunas, examples included a candidate claiming 20 years of experience whose digital footprint went back only a few months, and a listed employer that didn’t appear in business registries. Some fake employers even come with websites. The 2024 indictment describes sites that listed home addresses as offices and phone numbers whose area codes didn’t match the business location.
Watch for hidden text, too. In Greenhouse’s 2025 survey, 41% of U.S. job seekers admitted to using prompt injections, which are hidden instructions meant to get a resume past AI screening.
Synthetic and stolen identities
A stolen identity uses a real person’s details. A synthetic identity combines real and invented details into someone who doesn’t exist. Both can pass a standard background check. When security awareness company KnowBe4 hired a remote software engineer in 2024, the new hire had passed four video interviews, a background check, and reference checks using a valid but stolen U.S. identity and an AI-enhanced photo. KnowBe4 caught it only when its endpoint security flagged malware loading on the new workstation.
An established profile isn’t proof either. The FBI’s October 2026 alert says North Korean IT workers now pay people to use their professional networking accounts, which often have years of legitimate activity.
Proxy interviews and deepfakes
In a proxy interview, someone other than the applicant takes the interview. Deepfakes go further, with a face or voice overlay running live on the call. Kyle & Co’s June 2026 market report notes that Pindrop, itself a fraud vendor, caught a real-time face overlay in its own candidate pipeline.
People are not reliable detectors on their own. In two University of Florida studies, participants correctly identified deepfake images about 50% of the time and deepfake videos about 63% of the time. A recruiter’s instinct works best as one layer, not the only one.
How to detect candidate fraud at each hiring stage
The FBI advises employers to treat hiring like security. No single indicator is reliable, so it recommends layered checks throughout the employment lifecycle, an approach it calls “identity in depth.” Here is what that looks like stage by stage.
| Stage | Main checks | Suggested owner |
|---|---|---|
| 1. Application | Automated fraud signals on every applicant, ATS history, and candidate declarations | TA |
| 2. Before the first interview | Consent-based identity verification for flagged candidates and high-risk roles | TA, using a policy set with Security |
| 3. Interviews and assessments | Same-person checks, proctored assessments, and in-depth questions about past work | TA and hiring managers |
| 4. Offer and background check | Reference verification, device and location consistency, and background check | TA and HR |
| 5. Day one and after | Identity reverification and monitoring of remote access tools | IT and Security |
1. At application: screen every applicant automatically
Run automated checks on every application so concerns surface before a recruiter spends time on a screen. Useful checks include whether listed companies exist, whether employment details conflict with other sources, repeated applications from one location, duplicate profiles, and hidden text in documents.
Your ATS history is a strong signal, too. When you integrate your ATS with Findem, you gain visibility into:
- When candidates last applied
- How many times they’ve applied
- What roles they applied to
- Previous resumes they’ve applied with
- Previous ATS activity (interviews, notes, on-sites, etc.)
For example, if a candidate applied to a software engineering internship six years ago and is now applying for a senior role with a slightly different resume, that’s expected career growth. However, if a candidate applies to 20+ roles with vastly different titles and resumes, this raises a red flag.
Simple process steps help at this stage as well: captchas or candidate declarations about authenticity, short pre-screening questionnaires, and recorded video responses to application prompts. Gartner also recommends telling candidates how you define acceptable use of AI and that you check for fraud.
2. Before the first interview: verify identity where there’s a reason to
Identity checks often run late. In Checkr’s 2026 survey, only 29% of companies verify identity as soon as someone applies, and 49% wait until after at least one live interview. Move verification earlier for flagged candidates and high-risk roles. A short, consent-based session with a liveness check and, where allowed, a government ID match confirms a real person is present before interview time is spent. Tell the candidate what the check involves and why.
3. During interviews and assessments: confirm it’s the same person
Check that the person in the interview is the person who applied and passed the assessment. Proctored assessments and continuity checks across stages help. So does depth: after its incident, KnowBe4 advised getting candidates on camera and asking them about the work they are doing.
Validation also changes behavior. Across millions of validated technical assessments, Findem’s assessment data, published as The Candidate Fraud Curve, found fraud indicators of 20% to 25% where hiring relied on resumes and unverified remote testing. Once structured skill validation and identity controls became standard, they settled at 2% to 4%, even as assessment volume grew.
4. At offer and background check: verify references and logistics
References are a weak point. KnowBe4 recommends against relying on email-only references. Kyle & Co calls the IP address and device fingerprint of a candidate’s references the most reliable, least gameable signal in the market: when five references submit from one device, one person or a small ring is likely filling them out. Logistics matter, too. KnowBe4 lists a laptop shipping address that differs from where the candidate says they live as a red flag.
5. On day one and after: reverify and watch access
Fraud doesn’t end at the offer. Confirm on day one that the person starting is the person you interviewed, and give IT a short list of what to watch for. The FBI flags remote desktop software, external keyboard, video, and mouse (KVM) devices, and bank accounts, addresses, or other identifiers that change unusually often.
Who should own a candidate fraud flag?
Detection without a response plan leaves recruiters holding signals they have no authority to act on. The FBI makes the same point: IT, HR, security, and management each see part of the picture, and combining what they see improves detection. Agree on three things before the next incident:
- Who reviews a flagged candidate, and what they can decide
- When a concern moves from TA to Security or Legal, and through what path
- Which roles require identity verification before interviews
Plan for false positives as well. The FBI warns that aggressive controls carry an unusually high risk of flagging legitimate applicants, and that relying only on ban lists of names can block qualified people and further harm victims of identity theft. Treat a flag as a question to resolve, not a verdict.
How to evaluate candidate fraud detection tools
Kyle & Co counts more than 60 vendors that now claim a fraud or hiring-integrity capability, and notes that most accuracy figures in this market are self-reported. Ask where each tool sits relative to the moment a recruiter decides to advance someone, and what happens after a flag fires.
| Criterion | What to ask |
|---|---|
| Stage coverage | Which stages does it cover: application, pre-interview, interviews, references, or onboarding? |
| Explainable signals | Does each flag come with a plain-language reason specific to this candidate? |
| Human control | Can it advance or reject anyone automatically, or does a person always decide? |
| Identity verification | What does a session check, such as liveness, government ID, or face match? In which countries? How is consent collected? |
| Data beyond the resume | What does it compare the application against, such as your ATS history, public records, or company data? |
| Workflow placement | Do signals appear where recruiters already review candidates, or in a separate tool? |
| Audit trail | Is every check timestamped and recorded, including inconclusive results? |
| False-positive handling | Can recruiters dismiss a flag, and can candidates explain an anomaly? |
| Evidence | Are accuracy claims independently validated, and on what population? |
Tools fall into a few groups: fraud detection built into the ATS, standalone fraud tools, identity verification and background check providers, and people intelligence or assessment platforms that build checks into candidate review. Gartner recommends a multi-layer approach, so expect to combine more than one.
How Findem helps detect candidate fraud
Kyle & Co found that four vendors on different architectures, Ashby, Socure, CodeSignal, and Findem, independently landed on the same three design commitments: surface signals rather than verdicts, explain every signal, and never auto-reject. Findem builds those checks into its People Intelligence Platform, where candidate review already happens.
- Authenticity Suite runs fraud signals on every application. Findem checks resumes, profiles, and online footprints against its 3D People Graph, which connects people and company information from thousands of sources. Authenticity Suite Pro organizes findings into 13 categories, each with a plain-language explanation for that candidate, and adds recruiter-initiated identity verification with a liveness check and, where administrators enable it, government ID verification (in the United States and India at launch). Results post to an Authenticity Report with a timestamped audit trail.
- ID Verify Agent confirms candidate identity before screening or interviews begin. It checks identity documents, uses facial matching and behavioral signals to detect proxy participation, and records results with context in your ATS. As a standalone product, ID Verify also adds Day One reverification, so the person who starts is the person who interviewed.
No applicant is automatically advanced or rejected. Recruiters review the findings, talk with the candidate where needed, and make the call.
For the full product story, read The person behind the resume: Candidate fraud and the advance decision, or watch the webinar with Kyle Lagunas and Ash Ahluwalia, Findem’s Chief Product Officer.
Candidate fraud detection FAQ
What is candidate fraud?
Candidate fraud is when a job applicant misrepresents who they are or what they can do in order to get hired. Common forms include fabricated resumes, stolen or synthetic identities, and proxy interviews, where someone else takes the interview. Some applicants want a paycheck or want to hide a disqualifying background. Organized schemes, such as North Korean remote IT worker operations, also seek access to company systems and data.
How do you detect candidate fraud?
Layer checks across the hiring process. Screen every application automatically for signals such as employers that can’t be verified, employment dates that conflict with other sources, and hidden text. Verify identity with a liveness check and, where allowed, a government ID before interviews for flagged candidates or high-risk roles. Then confirm the same person shows up at each stage, check references carefully, and reverify identity on day one.
What is a proxy interview?
A proxy interview is when someone other than the applicant takes a job interview for them. Some proxies appear on camera as themselves, and others use a face or voice deepfake. In Checkr’s October 2026 survey of 3,000 U.S. managers, 67% had confirmed or strongly suspected an interview proxy. Identity verification before the interview and continuity checks across stages are the main defenses.
How can you stop fake job applicants without losing real candidates?
Treat each signal as a question, not a verdict. Explain your checks to candidates and ask for consent, verify identity where a signal or the role’s risk justifies it, give candidates a chance to explain anomalies that have a legitimate reason, and keep a person responsible for every advance or reject decision.
Who should own candidate fraud, TA or Security?
Both, with clear roles. TA runs the hiring process and the candidate experience. Security sets verification policy for high-risk roles and investigates escalated cases. Agree in advance who reviews a flag, when a concern moves to Security or Legal, and which roles require identity verification before interviews.
