Deepfake Hiring Fraud
A clean background check does not tell you who is on the call.
What Is Deepfake Hiring Fraud?
Hiring for a remote role is done entirely through a screen, and a synthetic face passes a video interview the way a stolen identity passes a background check. In this exercise you run a liveness check on a candidate mid-interview and watch the image fail. You practise verifying a person against their documents rather than trusting the paperwork, reading automated identity flags before they go stale, and holding the offer when the story starts to bend.
What You'll Learn in Deepfake Hiring Fraud
- Recognise that a background check, an uploaded ID document and answered references verify a record, not the person appearing on a video call
- Run a liveness check in an interview by asking for an unscripted physical action on camera, and read what a synthetic face does when something crosses it or the head turns
- Ask for a government ID document to be held up beside the face in the same frame, rather than accepting it as an upload
- Treat an automated identity flag nobody has opened as an unfinished control, and open it before a decision is made
- Refuse to ship company equipment to any address other than the one the identity was verified against, and place the hire on hold rather than accommodating the request
- Report a suspected fake candidate with the record reference, the observations and their times, and the flags that were never reviewed
Deepfake Hiring Fraud — Training Steps
-
The Last Interview
Kestrelane Software has been hiring a senior backend developer for six weeks. Fully remote, anywhere in the country, and you are down to one candidate. Ethan Cole cleared the recruiter screen, scored 41 of 45 on the technical exercise, and came back clean on the background check. The call at two o'clock is yours to say yes or no to.
-
Read The File Again
You go through the record once more before you dial in. The applicant tracking system holds everything he sent you, and everything the system did with it.
-
The Strongest Application
Nothing on the file gives you pause. It is the best application of the six weeks and it is not close.
-
Join The Interview
It is two o'clock. Imogen Vance from the talent team is joining as well, so there are three of you on the call.
-
Start The Call
The interview is on today's schedule. You are the host.
-
The First Ten Minutes
He answers well. Structured, specific, the vocabulary of somebody who really has carried a pager for a payments service.
-
How Would You Check?
There is a version of this interview where you never ask.
-
Ask Him To Move
You ask for it the way you would ask anyone: a routine step for remote roles, not an accusation. Imogen backs you up without making it a moment.
-
The Face Does Not Hold
His hand crosses his face and the picture comes apart. Bands of it slide sideways, the colour pulls, and the whole tile stalls for a moment on a frame that has already gone.
-
Camera Trouble, And One More Thing
He does not argue. He offers an explanation and a way to stop being looked at, and then, while everyone is being polite about the connection, he asks for something else.
Security Framework Coverage
MITRE ATT&CK
- T1656 Impersonation
- T1585.001 Establish Accounts: Social Media Accounts
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
- CIS 6 Access Control Management
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- PR.AA Identity Management, Authentication, and Access Control
EU AI Act
- Art. 50 Transparency obligations for providers and deployers
- Art. 4 AI literacy