Candidate fraud detection
Updated November 2026
Deepfaked video, a proxy answering off camera, a different person logging in on day one. ScreenComply sees it from the candidate's own device and gives your recruiters the evidence, not a verdict.
The face on the call is generated or swapped in real time over someone else's video feed. Investigators in a March 2026 case in Tokyo cited an unnatural hairline, misaligned eyes and lip-audio mismatch; the applicant left the call about two minutes after being told attendance would be in person. Most teams will never get that lucky with the tells.
Deepfake job interviewsThe person on camera is real, but someone else is answering: through an earpiece, a second screen, or a remote-desktop session where a more experienced operator drives the candidate's machine. The candidate passes. The proxy never shows up for work.
Proxy interviewsThe candidate who interviewed, cleared screening and signed the I-9 is legitimate. On day one, a different person logs in on those credentials, often from another country, and the location mismatch is caught only after onboarding and the first pay cycle.
North Korean IT worker fraud1 in 4
By 2028, one in four candidate profiles worldwide will be fake.
Source: Gartner, 2025.
40%
of US hiring managers interviewed someone later found to have a fake identity, up from 31% the year before.
Source: Checkr 2026 survey of 3,000 US hiring managers.
68%
of hiring managers say candidates are better at faking identities with AI than companies are at detecting them.
Source: Checkr, 2026.
6,500+
interviews linked to more than 130 identities in one North Korean operative cluster.
Source: Okta Threat Intelligence, September 2025.
Background checks verify a name, not the person on the call. A document and selfie check at application time confirms who applied, not who is answering the questions or who logs in two weeks later. Visual tells (hairline, eye alignment, lip sync) are getting rarer as the tools improve, and a recruiter is not a forensic analyst.
The fraud lives on the candidate's device: the virtual camera feeding the call, the remote-desktop session a second operator is using, the AI assistant on a second screen, the VPN masking the country. That is the layer nothing in a standard hiring stack can see. See how to spot a fake job candidate.
Remote-desktop sessions, screen sharing and a second input source driving the machine are flagged while the interview is running.
The agent records what is actually running, so a virtual camera or video-injection tool is captured as evidence rather than inferred from a blurry frame.
Video liveness and audio voice-clone signals run on the session, with continuous face-identity consistency so a mid-session swap is flagged.
Desktop AI tools, always-on-top overlays and second-screen prompts that a lockdown browser cannot see.
An optional photo ID match at the first session, and a physical baseline (face, gaze, movement, voice) captured at the interview and checked again at onboarding and on the first day of work, so a substitution is flagged without a certified ID bank.
Every flag comes with a timestamp and the evidence behind it: the process that was running, the second input, the segment of video. A recruiter or program manager reviews it and decides. Nothing fails a candidate automatically, which is what keeps the process defensible under employment and privacy law, and what keeps good candidates with a bad webcam from being treated as fraud.
Candidates consent to monitoring up front and are told what it covers. In practice that notice is itself the deterrent: most people who are only there to hand off access do not continue. See evidence and review.
Open-enrollment classes of hundreds, half on personal devices; suppliers who never see the worker; a laptop shipped to an address that is not the worker's. ScreenComply runs on the device the candidate uses for the interview, the job preview and the first day of training, whoever issued it.
Candidate fraud is any attempt to get hired as someone other than the person who will do the work or under a false identity: fabricated identities and resumes, a proxy answering interview questions, deepfaked video on the call, or a substitute worker logging in after a legitimate candidate is hired.
Sometimes by eye, but not reliably. ScreenComply looks at the device instead: whether a virtual camera or injection tool is running, whether the face stays consistent through the session, and whether the audio shows voice-clone signals. Those are captured as evidence rather than a judgment call on a frozen frame.
No. Document and background checks confirm who applied. ScreenComply confirms that the person on the call and the person on day one are that same person, and that nobody else is driving the machine.
For device-level coverage, yes: a lightweight agent that runs only during the session the candidate consents to. A browser-based mode covers less and is available where an install is not possible. The agent runs on the candidate's own device or an employer-issued one.
Candidates are told what is monitored and consent before the session, nothing is recorded outside it, and no decision is made by the software. Face matching is optional and enabled per employer with notice. Your counsel should review the notice for your jurisdictions; see Responsible AI for how ScreenComply approaches biometric and AI rules.
Your team has the evidence to end the process, and ScreenComply can lock the device used in the session so it cannot be used to access the program again.
A short walkthrough of an interview session, a flagged moment and the evidence your team would review.