Deepfake Job Interviews: How Fake Candidates Get Hired

A deepfake job interview is a hiring scam in which the person on the video call is not the person named on the CV. Real-time face-swap software maps a stolen or invented identity onto a live camera feed, while the accompanying paperwork — a passport scan, a CV, a diploma, sometimes a reference letter — is forged to match. The goal is almost always a fully remote role, most often in IT, where nobody in the company will ever meet the new hire in person.

This is not a fringe curiosity. The US Department of Justice, the FBI and the security vendor CrowdStrike have each documented organised networks running this scheme at scale, and UK and European employers hiring remotely are now squarely in scope.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Regulatory references are accurate as of the publication date. Consult your legal team for guidance specific to your situation.

What a deepfake job interview scam actually looks like

A deepfake job interview scam is a live video call where AI face-swap software replaces the real applicant's face and sometimes voice with someone else's, so the person answering questions is not the person who will do the job — or the person named on the paperwork.

The mechanics are cheap to run. An operator buys or steals an identity, builds a CV around it, and either wears a face-swap filter during the interview or has a more articulate colleague sit in for the technical rounds. Voice-authentication firm Pindrop recorded a rise of more than 1,300% in deepfake fraud attempts across contact centres and remote interactions in 2024, from roughly one per month to seven per day (Cyber Daily, February 2025). Recruitment is one of the channels absorbing that volume, because a hiring process is built to trust the person in front of the camera.

How fake candidates build a paper trail that survives HR checks

A convincing fake candidate never relies on the video call alone — the interview is only one layer of a forged file that has to hold together across the CV, the ID document and often a reference.

The CV is typically AI-written to match the job description almost too well; the passport or driving licence is a template forgery or a genuine stolen document; and the reference letter or employment certificate is fabricated because most HR teams still verify it with nothing more than a phone call. CheckFile covers the CV and diploma side in AI-generated CVs and fabricated diplomas, and the reference-letter angle in detecting a fabricated professional reference. CrowdStrike's threat-hunting service found that the group it tracks as Famous Chollima had built entire fake companies, complete with AI-generated websites, GitHub profiles and email infrastructure, to backstop these applications (CyberScoop, 2026).

The identity layer and the document layer are meant to reinforce each other: if the interviewer gets suspicious about the video, the forged passport and the plausible reference are there to reassure the recruiter that "the paperwork checks out."

The North Korean remote IT worker scheme the FBI is tracking

The dominant documented case of this fraud pattern is not opportunistic — it is a state-linked operation run by North Korean IT workers using stolen Western identities to get hired into remote technical roles.

The FBI's wanted notice describes the scheme directly: operatives use stolen or fabricated US identities, apply through ordinary job boards, and sometimes have a different, more technically fluent person sit the interview than the one who does the day-to-day work (FBI, Fraudulent Remote IT Workers from DPRK). Company laptops shipped to a US address are plugged into a "laptop farm" and accessed remotely from overseas, so the login traffic looks domestic. The Department of Justice's coordinated 2024 enforcement actions and a related prosecution describe a scheme using the stolen identities of at least 80 US persons that generated more than $5 million for the North Korean government (DOJ, Two US Nationals Sentenced; DOJ, Coordinated Nationwide Actions).

The best-known single incident is security-awareness vendor KnowBe4's own admission that it hired one of these operatives in July 2024. The candidate passed several rounds of video interviews and a background check using a stolen US identity, and was only caught after the new "software engineer" loaded malware onto a company laptop within minutes of receiving it; KnowBe4 shut off access 25 minutes after its security team flagged the activity (KnowBe4, How a North Korean Fake IT Worker Tried to Infiltrate Us). A cybersecurity vendor with a full security stack still let it through the interview stage.

Real candidate or deepfake — what to look for on the call

The clearest tell during a live interview is what happens when the candidate is asked to move unpredictably in front of the camera, because most consumer-grade face-swap filters cannot track a hand or an object passing in front of a face without glitching.

Dawid Moczadło, co-founder of Vidoc Security Lab, described exactly this in an account picked up by The Register: a candidate's face blurred and distorted on a Zoom call, and asking him to wave a hand across his own face broke the filter and exposed the swap (The Register, February 2025). That single test is now widely shared among recruiters and security teams as a quick, low-cost screen, though it is not the only signal worth checking.

What this means for UK and European employers hiring remote

A UK employer that unknowingly hires a fraudulent remote worker may have handed system or customer-data access to someone it cannot identify, which is a live UK GDPR problem, not a hypothetical one. The Information Commissioner's Office expects organisations to take reasonable steps to verify the identity of anyone granted access to personal data, and a fraudulent hire who exfiltrates that data is the kind of incident that triggers breach-notification obligations.

Experian's Future of Fraud Forecast, published in January 2026, found that two-thirds of UK hiring leaders already rank deepfake candidates as their most urgent screening threat (Experian plc, January 2026). That matches what staffing firms report anecdotally: fully remote IT and software roles — the focus of our staffing and recruitment solution — are targeted most, because nobody expects to meet the hire face to face.

A verification checklist before you extend an offer

The most effective control is not a single clever question on the call — it is checking that the identity, the documents and the interview all describe the same person before an offer goes out.

• Verify the ID document itself (structure, fonts, security features, MRZ checksum), not just a photo of it.
• Cross-check the CV's claimed employer against a reference contacted through a switchboard number you look up independently, never one supplied by the candidate.
• Ask for one unscheduled, camera-on task in a later round — live coding, a screen share, a document held up to the camera.
• Confirm bank and next-of-kin details provided at onboarding match the verified identity, not a third party.
• Treat resistance to a second, unscheduled video call as a flag worth escalating, not an inconvenience to smooth over.

Manual reference and document checks alone are not a reliable backstop: the ACFE's 2024 Report to the Nations found that only 37% of document fraud is caught by internal manual controls, with a median detection delay of 87 days (ACFE, Report to the Nations 2024). By the time a manual process catches a forged reference or a mismatched ID, the fraudulent hire may already have completed onboarding and been granted access to systems or client data.

Where CheckFile fits in a remote hiring workflow

CheckFile does not replace the hand-wave test or a properly sourced reference call — it checks the documents a fake candidate still has to submit even when the face on the call is real-time AI-generated. Our platform analyses the ID document, the CV and any diploma or reference letter attached to the same candidate file against each other for structural and metadata inconsistencies, with AI-generated content forensics available as an optional layer configured to sector risk. In practice, that means detection grounded in multi-layer analysis of the ID, the CV and the diploma or reference letter attached to the same file, rather than a judgement call made on video alone. The same cross-document logic applies whether the risk is a forged UK biometric residence permit or the synthetic and templated identity documents increasingly used in this specific scam. CheckFile analyses your files and surfaces signs of AI-generated content as a complement to your existing controls — it is not a replacement for a proper interview process, a reference check, or, for UK right-to-work cases, statutory identity checks.

If remote hiring is a meaningful share of your recruitment volume, our deepfake detection module is built for this scenario, alongside the broader document security controls underpinning the platform. Pricing scales with volume rather than headcount on our plans page; teams evaluating the fit across sectors can start from our industry verification guide. See the full product from the CheckFile homepage.

Frequently Asked Questions

Does asking a candidate to wave their hand in front of their face actually detect a deepfake?

It catches many consumer-grade real-time face-swap filters, which struggle to render an object passing in front of a tracked face without glitching. It is not foolproof against higher-quality software, so treat it as one signal among several rather than a definitive test.

How common is this, really, or is it mostly a North Korea-specific problem?

On specialised recruiting and cybersecurity forums, a recurring question is whether this is a niche nation-state issue or something ordinary employers should worry about — and the answer is both. The North Korean scheme documented by the FBI and DOJ is the largest known organised version, but the underlying face-swap tools are consumer-grade, so opportunistic fraud — someone else sitting a technical interview for a friend — uses the same techniques on a smaller scale.

What should we do if we suspect we already hired someone using this method?

Restrict system and data access immediately rather than waiting to build a full case, following the same logic KnowBe4 applied when it cut a new hire's access within 25 minutes of a security alert. Preserve laptop and login logs, involve your legal and security teams before any confrontation, and report the case to Action Fraud if you are UK-based and suspect organised fraud rather than a one-off CV embellishment.

Can document verification software alone stop a deepfake interview scam?

No single tool closes this gap alone, because the scam is designed to defeat several checks at once — the interview, the ID document and the reference. Document verification tools such as CheckFile add a layer that checks the paperwork for inconsistencies a recruiter is unlikely to spot manually, but they work best combined with live interview scrutiny and independently sourced reference checks.

Is this only a problem for IT and tech roles?

IT and software roles are the most reported category because they are easiest to perform fully remotely with no physical deliverables, but CrowdStrike has noted the same networks branching into other remote functions, including customer support and sales. Any fully remote position with system or data access carries the same underlying risk, regardless of job title.