Deepfake Job Interviews: How Fake Candidates Get Hired

A deepfake job interview is a hiring scam in which the person on the video call is not the person named on the CV. Real-time face-swap software maps a stolen or invented identity onto a live camera feed, while the accompanying paperwork — a passport or ImmiCard scan, a CV, a diploma, sometimes a reference letter — is forged to match. The goal is almost always a fully remote role, most often in IT, where nobody at the company will ever meet the new hire in person.

This is not a fringe curiosity for Australian employers. The US Department of Justice, the FBI and CrowdStrike have each documented organised networks running this scheme at scale, and in July 2026 Australia joined ten other governments in a joint alert naming North Korean IT workers as a live threat to remote hiring pipelines (DFAT, Joint Statement on DPRK IT Workers).

This article is provided for informational purposes and does not constitute legal or regulatory advice. Regulatory references are accurate as of the publication date. Consult your legal team for guidance specific to your situation.

What a deepfake job interview scam actually looks like

A deepfake job interview scam is a live video call where AI face-swap software replaces the real applicant's face and sometimes voice with someone else's, so the person answering questions is not the person who will do the job — or the person named on the paperwork.

The mechanics are cheap to run. An operator buys or steals an identity, builds a CV around it, and either wears a face-swap filter during the interview or has a more articulate colleague sit in for the technical rounds. Voice-authentication firm Pindrop recorded a rise of more than 1,300% in deepfake fraud attempts across contact centres and remote interactions in 2024, from roughly one per month to seven per day (Cyber Daily, February 2025). Recruitment absorbs its share of that volume, because a hiring process is built to trust the person in front of the camera.

How fake candidates build a paper trail that survives HR checks

A convincing fake candidate never relies on the video call alone — the interview is only one layer of a forged file that has to hold together across the CV, the ID document and often a reference.

The CV is typically AI-written to match the job description almost too well; the passport, driver licence or ImmiCard is a template forgery or a genuine stolen document; and the reference letter is fabricated because most HR teams still verify it with nothing more than a phone call. CheckFile covers the CV and diploma side in AI-generated CVs and fabricated diplomas, and the reference-letter angle in detecting a fabricated professional reference. CrowdStrike found that the group it tracks as Famous Chollima had built entire fake companies, complete with AI-generated websites, GitHub profiles and email infrastructure, to backstop these applications (CyberScoop, 2026). The identity and document layers reinforce each other: if the interviewer doubts the video, the forged ID and plausible reference are there to reassure the recruiter that "the paperwork checks out."

The North Korean remote IT worker scheme Australia is now named in

The dominant documented case of this fraud pattern is not opportunistic — it is a state-linked operation run by North Korean IT workers using stolen identities to get hired into remote technical roles, and Australia is no longer a bystander to it.

The FBI's wanted notice describes the scheme directly: operatives use stolen or fabricated identities, apply through ordinary job boards, and sometimes have a more technically fluent person sit the interview than the one who does the day-to-day work (FBI, Fraudulent Remote IT Workers from DPRK). Company laptops shipped to a rented address feed a "laptop farm" accessed remotely from overseas, so login traffic looks domestic. The Department of Justice's coordinated 2024 enforcement actions describe a scheme using the stolen identities of at least 80 US persons that generated more than $5 million for the North Korean government (DOJ, Two US Nationals Sentenced; DOJ, Coordinated Nationwide Actions).

Australia's own exposure is no longer theoretical. DFAT warned in August 2024 that North Korean operatives had attempted to obtain remote employment inside Australian businesses, and industry researchers now put the confirmed toll at dozens of Australian companies, spanning finance, tech and professional services (ACS, Information Age, 2026). One case involved an employer that only spotted a problem when three laptops issued to three different "hires" turned out to be shipped to the same address.

Australia's geography compounds the risk. Local employers already routinely hire genuine remote contractors in nearby time zones — the Philippines, India, Vietnam — to stretch a tech budget, and that normalised "offshore contractor I've never met, on hours that don't overlap with mine" pattern is exactly the cover a fraudulent hire needs. A recruiter who would question an unexplained overseas candidate for a Sydney office role rarely applies the same scrutiny to a role that was always going to be remote.

Real candidate or deepfake — what to look for on the call

The clearest tell during a live interview is what happens when the candidate is asked to move unpredictably in front of the camera, because most consumer-grade face-swap filters cannot track a hand or an object passing in front of a face without glitching.

Dawid Moczadło, co-founder of Vidoc Security Lab, described exactly this in an account picked up by The Register: a candidate's face blurred and distorted on a Zoom call, and asking him to wave a hand across his own face broke the filter and exposed the swap (The Register, February 2025). The test is now widely shared among recruiters as a quick, low-cost screen, though it is not the only signal worth checking.

What this means for Australian employers hiring remote

An Australian employer that unknowingly hires a fraudulent remote worker may have handed system or customer-data access to someone it cannot identify — a live Privacy Act problem, not a hypothetical one. Under the Australian Privacy Principles, specifically APP 11's duty to take reasonable steps against misuse and unauthorised access, the Office of the Australian Information Commissioner expects organisations to know who they have granted access to before a breach, not after (OAIC, APP 11 — Security of Personal Information). That duty is about to get more exacting: an exposure draft released in August 2026 would add a new "fair and reasonable" test to the Privacy Act 1988 (Baker McKenzie, Australia Privacy Reform, September 2026).

Visa status and identity are two different checks. VEVO confirms whether a visa holder is entitled to work in Australia; it does not verify that the person behind the visa record is the person who turned up on the video call, so a stolen identity never checked against its source document can clear VEVO cleanly. For organised fraud rather than a one-off CV embellishment, the AFP's cybercrime unit and ReportCyber are the right escalation path (AFP, Cybercrime). Combined with distance normalising remote contractor arrangements, this is why fully remote IT and support roles — the focus of our staffing and recruitment solution — warrant more scrutiny at offer stage than most Australian workflows currently apply.

A verification checklist before you extend an offer

The most effective control is not a single clever question on the call — it is checking that the identity, the documents and the interview all describe the same person before an offer goes out.

• Verify the ID document itself (structure, fonts, security features, MRZ checksum), not just a photo of it.
• Cross-check the CV's claimed employer against a reference contacted through a switchboard number you look up independently, never one supplied by the candidate.
• Ask for one unscheduled, camera-on task in a later round — live coding, a screen share, a document held up to the camera.
• Confirm bank and next-of-kin details at onboarding match the verified identity, not a third party.
• Treat resistance to a second, unscheduled video call as a flag worth escalating.

Manual reference and document checks alone are not a reliable backstop: the ACFE's 2024 Report to the Nations found that only 37% of document fraud is caught by internal manual controls, with a median detection delay of 87 days (ACFE, Report to the Nations 2024). By then, the fraudulent hire may already have completed onboarding and been granted access to systems or client data.

Where CheckFile fits in a remote hiring workflow

CheckFile does not replace the hand-wave test or a properly sourced reference call — it checks the documents a fake candidate still has to submit even when the face on the call is real-time AI-generated. Our platform analyses the ID document, the CV and any diploma or reference letter attached to the same candidate file against each other for structural and metadata inconsistencies, with AI-generated content forensics available as an optional layer configured to sector risk. In practice, that means detection grounded in multi-layer analysis of the ID, the CV and the diploma or reference letter attached to the same file, rather than a judgement call made on video alone. The same logic applies to a forged ImmiCard or the synthetic and templated identity documents increasingly used in this scam. CheckFile surfaces signs of AI-generated content as a complement to your existing controls — not a replacement for a proper interview process, a reference check, or a VEVO check for Australian right-to-work cases.

If remote hiring is a meaningful share of your recruitment volume, our deepfake detection module is built for this scenario, alongside the broader document security controls underpinning the platform. Pricing scales with volume rather than headcount on our plans page; teams evaluating fit across sectors can start from our industry verification guide, or the CheckFile homepage.

Frequently Asked Questions

Does asking a candidate to wave their hand in front of their face actually detect a deepfake?

It catches many consumer-grade face-swap filters, which struggle to render an object passing in front of a tracked face without glitching. It is not foolproof against higher-quality software, so treat it as one signal among several rather than a definitive test.

How common is this in Australia, or is it mostly a North Korea-specific problem overseas?

Australia signed the July 2026 multinational alert alongside ten other governments precisely because it is no longer someone else's problem, and researchers have linked dozens of Australian companies to confirmed cases. The underlying tools are consumer-grade, so opportunistic fraud — someone else sitting a technical interview for a friend — uses the same techniques on a smaller scale, independent of any state-linked scheme.

What should we do if we suspect we already hired someone using this method?

Restrict system and data access immediately rather than waiting to build a full case. Preserve laptop and login logs, involve legal and security before any confrontation, and report organised fraud through the AFP's ReportCyber system.

Is this only a problem for IT and tech roles?

IT and software roles are the most reported category because they are easiest to perform fully remotely with no physical deliverables, but CrowdStrike has noted the same networks branching into other remote functions, including customer support and sales. Any fully remote position with system or data access carries the same risk, regardless of job title.