Guide
Deepfake Job Interviews: How to Detect a Deepfake Candidate on a Live Call
8 minute read - Updated: November 2026
A deepfake job interview is a video interview where the face, the voice or both are generated or swapped in real time so that the person being evaluated is not the person on screen. The tools are consumer-grade now. In March 2026 an applicant interviewing for a role at a Tokyo IT firm used AI to impersonate a real executive on the call; investigators later pointed to an unnatural hairline, misaligned eyes and a lip-audio mismatch, and the applicant left the interview about two minutes after being told attendance would be in person. That case was caught because someone asked for an in-person step. Most are not.
How a deepfake interview is set up
A face-swap or avatar model, a voice changer or clone, and a virtual camera driver that presents the generated video to Zoom, Teams or Meet as if it were a webcam. The real operator may be the candidate with a different face, or a different person entirely. In the organised versions, one operator runs several identities across many companies.
Read next: North Korean IT Worker Hiring Fraud
Visual and audio tells (and why they are not enough)
- Edges of hair and glasses that flicker.
- Skin that stays uniformly lit when the head turns.
- Blinking that is too regular or absent.
- Lip movement slightly behind the audio.
- A voice with flattened intonation or odd breathing.
- Glitches when a hand passes in front of the face.
Every one of these improves with each model release, the call is compressed video, and a recruiter is making a hiring decision, not running forensics. A tell is a reason to look harder, not a finding.
Read next: How to Spot a Fake Job Candidate
Three live tests you can run on any call
- Ask the candidate to turn their head fully to each side and hold.
- Ask them to pass a hand slowly in front of their face.
- Ask them to switch to their phone camera and show the room.
A prepared operator can refuse politely, and refusal is itself informative, but none of these produces evidence you can keep.
What detection from the device looks like
With the candidate's consent, a lightweight agent on the candidate's machine records what is running during the session.
- A virtual camera or injection tool registered as the webcam is captured directly.
- Video liveness signals and continuous face-identity consistency flag a face that changes or stops behaving like a face mid-session.
- Audio voice-clone signals run alongside.
- Remote-desktop sessions and a second input source are flagged, which is how the proxy version of the same fraud shows up.
All of it is timestamped evidence a person reviews; nothing fails a candidate on its own.
Read next: Candidate fraud detection - Proxy Interviews and Interview Impersonation
Deepfakes after the interview
The interview is only the first chance. The same tooling is used on the onboarding call and the first team meeting. Identity continuity, a baseline captured at the interview and checked at onboarding and on day one, closes that gap.
Read next: Evidence and review
Frequently asked questions
How common are deepfake job interviews?
Reliable public counts do not exist. The attributable figures are Gartner's forecast that one in four candidate profiles worldwide will be fake by 2028 (Gartner, 2025) and the Checkr 2026 finding that 40% of US hiring managers interviewed someone later found to have a fake identity.
Can Zoom or Teams detect a deepfake?
Not as a built-in feature. The platform receives whatever the camera driver sends it.
Is face matching required to detect a deepfake?
No. Virtual camera detection and liveness signals work without matching to a stored photo. Photo ID matching is optional and enabled per employer.
What should we do if we suspect a deepfake mid-interview?
Stay neutral, run the three live tests, finish the call, and escalate to security with the recording.
Does this slow down hiring?
No. The session runs inside the interview the candidate already attends, and the review happens on flagged sessions only.
See a session, a detection, and a report
A short walkthrough of a live exam, a flagged moment, and the finding your integrity office would receive.