Guide
How to Spot a Fake Job Candidate in 2026
9 minute read - Updated: November 2026
Fake candidates used to mean a padded resume. In 2026 it means a generated identity with a real-looking LinkedIn history, a person on the video call who is not the person who will do the work, and in the worst cases an overseas operative working through a laptop parked in someone's spare room. Gartner expects one in four candidate profiles worldwide to be fake by 2028 (Gartner, 2025), and a Checkr survey of 3,000 US hiring managers in 2026 found 40% had interviewed someone later found to have a fake identity, up from 31% a year earlier. This guide walks the hiring process stage by stage and lists what to look for, what each check can and cannot prove, and what to do when the signs add up.
What counts as a fake candidate
Four types, from lowest to highest risk: an inflated resume (misrepresentation, not identity fraud); a real person using AI to answer live questions (interview cheating, covered in How to Stop Interview Cheating); a proxy or deepfake standing in for the candidate on the call; a fully synthetic or stolen identity used to gain employment and, through it, access to systems and payroll. The last two are the subject of this guide.
Read next: How to Stop Interview Cheating
Red flags on the application and profile
- A LinkedIn profile created recently with few connections and generic endorsements.
- Work history at companies that have closed or cannot confirm employment.
- A resume whose phrasing matches dozens of other applicants (application farms).
- A candidate who will only interview by video and declines any in-person step.
- Reluctance to show a government ID on camera.
- A phone number or address that does not match the stated location.
- A request to ship equipment to a different address or a third party.
- An unusual insistence on contractor or EOR arrangements over direct employment.
None of these alone proves anything.
Red flags during the video interview
- Lighting and shadows that do not change when the candidate moves.
- A hairline or glasses edge that shimmers.
- Lip movement slightly out of sync with audio, or audio that sounds processed.
- Pauses before every answer, eyes tracking something off camera, typing sounds while the candidate is supposedly thinking.
- A candidate who cannot answer a follow-up on their own resume.
- A refusal to turn the head, raise a hand in front of the face or switch to a phone camera when asked.
These are useful, and they are also the least reliable layer. The tools are improving faster than recruiters' eyes, and the strongest fraud (a proxy driving the machine by remote desktop, a well-rendered face swap) leaves no tell at all on the call.
Read next: Deepfake Job Interviews - Proxy Interviews and Interview Impersonation
What the candidate's device can tell you
The signals that matter most are not on the call at all. They are on the machine the candidate is using:
- A virtual camera or video-injection tool registered as the webcam.
- A remote-desktop or screen-sharing session active during the call.
- A second input source (mouse or keyboard events that do not come from the candidate).
- A VPN or location that does not match the stated one.
- AI assistants and overlays open on a second screen.
ScreenComply captures these from the device during the interview, with consent, as timestamped evidence.
Read next: Candidate fraud detection - Remote access detection
The day-one check most teams skip
The highest-value fraud waits until after the offer: the interviewee is real, the worker who logs in is not. The fix is identity continuity: capture a baseline at the interview, check it again at onboarding and on the first day of work, and treat a mismatch as a flag for a human to review.
Read next: Identity continuity through day one
What to do if you think you already hired a fake employee
- Preserve the evidence (session recordings, access logs, shipping records).
- Restrict access before confronting anyone.
- Involve security and legal, not only HR.
- Check whether equipment was shipped somewhere other than the worker's stated address.
- Report to law enforcement where a foreign-operative scheme is suspected.
- Review every other hire that came through the same recruiter or supplier.
Read next: North Korean IT Worker Hiring Fraud
Stay on the right side of the law
Verification steps should apply to every candidate at the same stage, be disclosed in advance, and leave the decision with a person. Avoid treating accent, English fluency or a poor webcam as evidence of fraud. Face matching and any biometric step should be optional, consented and reviewed by counsel for each jurisdiction.
Frequently asked questions
How common are fake job candidates?
Gartner expects one in four candidate profiles worldwide to be fake by 2028 (Gartner, 2025). A Checkr survey of 3,000 US hiring managers in 2026 found 40% had interviewed someone later found to have a fake identity, up from 31% the year before.
Are fake candidates only a tech-company problem?
No. Staffing firms, call centers, healthcare and finance report it. Checkr found 61% of staffing HR leaders had encountered hiring fraud.
Can a background check catch a fake candidate?
A background check verifies a name and a record, not who is on the call or who logs in on day one.
Should we require in-person interviews?
Gartner found 62% of candidates were more likely to apply where in-person interviews were required. In-person for the final round is a strong deterrent where it is practical, and device-level checks cover the remote rounds.
What does ScreenComply do that an ID check does not?
It confirms the same person through the interview and day one, and captures what is running on the device during the session.
See a session, a detection, and a report
A short walkthrough of a live exam, a flagged moment, and the finding your integrity office would receive.