TL;DR: Start with the stage where you have the least visibility, because that’s where the gaps are easiest to exploit. If screening interviews aren’t recorded, proxy interviewers can operate there undetected. If your platform has no in-session detection, deepfakes can clear the finalist round. If scorecards are filled from memory, panel discrepancies that would flag an impersonator go unnoticed. The stage-by-stage checklist in this article maps each control to the gap it closes. Work through it, note every “No”, and treat each one as an open entry point.
Candidate fraud is no longer rare, and it’s no longer easy to spot. The person on your video screen may not be the person who applied. Many TA teams treat fraud as a background check problem. By the time a candidate reaches that stage, recruiter cycles are spent, the pipeline is compromised, and in the worst cases an imposter already has access to your internal systems.
Candidate fraud is a distributed risk that enters at every stage of the hiring funnel. This article maps those five stages so you can audit your own process, identify where you are exposed, and build controls that protect both hiring quality and organizational security.
Map candidate fraud across the hiring funnel
Break the funnel into five distinct fraud stages
Candidate fraud is a catch-all term for five distinct problems. The synthetic identity that slips through resume screening looks nothing like the proxy interviewer who shows up in round three, and the forged degree that surfaces during a background check requires a different response than an AI-scripted phone screen.
We break the funnel into five stages: resume screening, screening interviews, credentials and portfolios, finalist vetting, and background checks and onboarding. Each stage produces distinct signals, and each one calls for distinct controls. Treating fraud as a single checkpoint misses the point.
Drivers of candidate fraud growth
Three elements have expanded the attack surface in the last four years.
- Remote hiring removed the in-person verification cues that used to catch impersonation.
- Generative AI made it cheap to produce convincing fake resumes, scripted answers, and synthetic identities at scale.
- Deepfake technology went from experimental to accessible. According to GetReal’s September 2025 survey of 668 business leaders, 41% said their organization had hired and onboarded a fraudulent candidate.
How fraudulent hires drain TA budgets
The cost of a fraudulent hire extends well beyond direct replacement. Recruiter cycles, pipeline disruption, and the delayed req are costs that accumulate before a background check ever runs.
A fraudulent hire also consumes recruiter cycles across every stage they advanced through, distorts your pipeline data, and delays the req they were filling. And if the imposter gained access to internal systems before they were discovered, the exposure moves outside TA’s remit entirely, into a Security and Legal conversation that starts with whether the organization had reasonable controls in place during hiring.
Stage 1: Flag fraud at resume screening
Resume screening is where fraud enters at the highest volume, and the volume problem itself is what makes it the hardest stage to staff. At high application volumes, the review burden makes it harder to flag anomalies than to advance candidates, and fraudsters take advantage of that pressure.
Flag inflated titles and fabricated credentials
The most common resume-stage tactics are the oldest ones: inflated titles, fabricated employment dates, and degrees from institutions the candidate never attended. What has changed is the scale and polish. AI tools can now generate a coherent, keyword-optimized resume for any job description in seconds, which means the volume of plausible-looking fraudulent applications has increased without a proportional increase in quality.
Detection signals at this stage are pattern-based: generic or mismatched resume content, inconsistent application details like repeated IP addresses, which suggest multiple applications are originating from the same device or network, a pattern consistent with coordinated fraud rather than independent candidates , or unusual email domains, and reluctance to complete identity verification steps. A single red flag should prompt closer review, not automatic rejection, since legitimate candidates can trip individual signals for benign reasons. Clusters of flags are the stronger basis for escalation.
“Every touchpoint you have with a candidate is where fraud could show up.” – Josh Elmore, Global Head of Talent Acquisition and People Operations at Zoom
Catch synthetic identities before they reach the interview stage
Synthetic identities go one level deeper than embellished resumes. These are fabricated personas that combine real and invented information: an authentic employment record paired with a false contact history, or a valid credential attached to a stolen identity.
Coordinated application fraud is a related pattern. Behavioral biometrics, submission timing, and repeated infrastructure signals are indicators that multiple applications are originating from the same source. A recruiter reviewing applications one at a time will not catch this pattern. The detection has to happen across the full applicant pool, not at the individual resume level. Some ATS platforms now provide application-stage fraud signals at the point of application, which reduces the volume reaching the interview stage.
The controls above reduce the volume of fraudulent candidates who reach the interview stage, where in-session detection captures signals that resume analysis can’t provide.
Apply these controls at the resume screening stage
Practical controls at this stage are straightforward but require discipline:
- Cross-check LinkedIn profiles against the resume for date and title consistency.
- Flag applications with VoIP phone numbers as one signal in a cluster, not a standalone basis for rejection.
- Watch for VPN masking or geographic inconsistencies between the candidate’s claimed location and their IP-derived location.
- Verify credentials early in the process rather than waiting for the background check stage.
Most resume screening will never catch everything, and it isn’t designed to. Its job is to shrink the number of imposters who make it into live interviews, where each additional round they clear raises the cost of the eventual miss.
Stage 2: Catch fraud in screening interviews
Screening interviews are the first live interaction in the funnel, and they carry a specific vulnerability: the recruiter on the other end has no baseline for what this candidate should sound like, look like, or know.
Probe for scripted answers in early-round screening interviews
Phone screening interviews carry the least detection surface of any early-stage format. A candidate reading from a script, using an earpiece, or running a voice changer is harder to catch over a phone line than on video, and even video screens are typically short, formulaic, and run by recruiters managing dozens of reqs simultaneously.
Detection signals include voice mismatches across touchpoints, scripted answers that don’t respond to follow-up, and an inability to go deeper on resume claims when probed. AI-generated responses add a subtler layer: unnatural cadence, generic answers that technically address the question but lack personal specificity, and a consistent inability to produce concrete examples.
Async screening interviews let candidates script answers without live follow-up, but the same format also creates a permanent, reviewable record that a phone screen does not. BrightHire Screen runs structured, two-way voice interviews asynchronously, captures a full recording for human review, and detects impersonation, deepfakes, AI-assisted cheating, and identity inconsistencies during the session itself. Every flag is routed to a human reviewer before any decision is made.
Stage 3: Verify credentials and portfolios
By the time a candidate reaches the credential and portfolio stage, they have already passed two rounds of review. Fraud that survives to this point tends to be more sophisticated, and the detection approach has to match.
Tie coding tests to a live interview
Third-party coding assessments are a documented fraud vector: proxy test-takers complete them on behalf of the candidate, and AI tools generate solutions that candidates submit as their own. The problem is isolation. Nobody is watching, and nobody is comparing the test output against what the candidate says in a live conversation.
Live coding sessions where the candidate explains their approach, describes the tradeoffs they considered, and fields follow-up questions are harder to fake than asynchronous submissions. Brief the hiring manager to probe the reasoning behind specific decisions. A candidate who produced a sophisticated assessment but can’t discuss basic technical concepts live is showing a pattern worth escalating.
Ask candidates to explain their work, not just present it
Portfolio fraud follows the same pattern as coding fraud: stolen work, AI-generated content, and misrepresented contributions all collapse under the same test. Ask the candidate to walk through a specific decision they made in a portfolio piece: what they would change, what constraints they were working under.
Genuine authorship produces specifics. A candidate presenting someone else’s work defaults to generalities. Structured interview guides make this consistent, because they ensure every interviewer probes with the same depth rather than relying on individual instinct.
Stage 4: Pressure-test finalists for fraud
Fraud that reaches the finalist stage has already consumed interview hours across multiple panel members, and the cost of starting the req over compounds with every round the candidate cleared.
Compare identity signals across every recorded round
A proxy interview is when a different person completes the interview than the one who applied. This isn’t a fringe tactic, and it surfaces across hiring processes at every scale.
Detection signals include identity inconsistencies across interview stages, video and audio mismatches, and an inability to answer questions about the candidate’s own resume or earlier interview responses. The strongest detection comes from comparing the candidate across rounds. Does the person in round three sound, look, and communicate like the person from round one? Cross-round identity comparison is the control.
Cross-round comparison only works if every prior round was recorded, because the recording is the baseline. Replaying the recordings lets the team compare identity signals directly instead of relying on impressions.
Run in-session deepfake detection on every live interview
Deepfake technology has made live video impersonation possible in real time. Interviewers sometimes notice visual or auditory artifacts, such as irregularities around the face boundary, warping during quick head movements, or lip-sync lag. But these are impressions, not diagnoses, and should be flagged for review by a detection tool rather than used as the basis for a rejection decision.
These artifacts are subtle and getting subtler. Training interviewers to spot them manually is a reasonable first step, but it’s not a scalable one. In-session deepfake detection tools run during live interviews across Zoom, Microsoft Teams, and Google Meet, with signal depth varying by platform. Zoom carries the fullest coverage with a proprietary deepfake model and unique session metadata. Teams includes deepfake detection plus IP-derived signals covering geolocation and VPN use.
Use structured scorecards to surface panel discrepancies
Panel feedback is an underused fraud signal. When one interviewer’s experience diverges sharply from the rest of the panel, the discrepancy itself is data. Inconsistent physical descriptions, conflicting assessments of the same competency, or one interviewer reporting that the candidate seemed to be reading from notes while others didn’t notice are all patterns worth investigating.
Structured scorecards make these discrepancies visible. When every interviewer evaluates the candidate against the same criteria and submits feedback tied to specific observations, divergent assessments stand out. When scorecards are filled in from memory hours after the call, those signals blur. AI-generated scorecard auto-fill produces pre-populated scorecards from the interview transcript itself, so feedback reflects what the candidate said during the call rather than what the interviewer remembered walking out of the room.
Stage 5: Background checks and onboarding
The final stage is the last checkpoint before a fraudulent hire becomes an insider threat. Background checks are sometimes treated as a formality, but for fraud prevention this stage is where employment and credential verification must happen through institutions, not candidate-supplied references.
Verify documents through authoritative sources
Forged degrees, fabricated employment verification letters, and falsified identity documents are persistent problems. Fraudulent candidates frequently present meticulously crafted documents, often paired with VPNs and proxy servers to disguise their actual location.
Detection signals include inconsistencies between documents and earlier application data, verification failures when contacting issuing institutions directly, and mismatched personal data across systems. Confirming past employment through authoritative sources rather than the references the candidate provides is a basic control that time pressure can push teams to skip.
Call the company main line, not the candidate’s contact
Reference checks are only as reliable as the references themselves. Fake references, coached references, and AI-generated reference responses all undermine the value of this stage. Detection signals include references who can’t answer specific questions about the candidate’s role and responsibilities, scripted or generic responses, and unverifiable contact information.
The control here is the same principle that applies across the funnel: verify against authoritative sources, not against information the candidate controls. Call the main line of the company listed, not the direct number the candidate provided for their manager.
Apply stage-specific controls at every funnel milestone
Knowing where fraud enters the funnel is only useful if each stage has a corresponding control.
Build an auditable record at every stage
Every stage of the funnel should produce a record that a hiring panel can reference during the debrief. Structured scorecards, interview recordings, and audit trails serve two purposes: they improve decision quality for legitimate candidates, and they create the evidence base that fraud detection depends on.
Every interview should produce an auditable ATS record: AI-generated notes and pre-filled scorecards. When a hiring manager asks why a candidate was rejected, the answer should live in the candidate record, not in someone’s recollection of a Slack thread.
A stage-by-control map for detecting fake candidate profiles
The map below connects each funnel stage to its primary fraud tactics and the controls that address them. Use it as a reference when auditing your own process.
| Funnel stage | Primary fraud tactics | Detection signals | Mitigation controls |
|---|---|---|---|
| Resume screening | Synthetic identities, AI-generated resumes | IP anomalies, generic content | Cross-reference profiles, flag VoIP numbers |
| Screening interviews | Scripted answers, AI-assisted coaching | Unnatural cadence, evasiveness | Recorded two-way interviews, human review |
| Credentials and portfolios | Proxy test-takers, stolen work | Cannot explain own work | Live coding, deep follow-up questions |
| Finalist vetting | Proxy interviewers, deepfakes | Identity inconsistencies across rounds | In-session detection, cross-round comparison |
| Background checks and onboarding | Forged documents, fake references | Verification failures, scripted references | Authoritative-source verification |
Standardize rubrics to expose the gaps fraud exploits
A structured rubric removes the evaluative variation that fraud exploits. When every interviewer works from the same criteria, a candidate who performs inconsistently across rounds stands out rather than blending into divergent feedback.
A structured interview framework ties every interview to a plan with defined competencies, surfaces the guide live during the call, and generates a pre-filled scorecard when the call ends.
Audit your process against this stage-by-stage checklist
Use this checklist to audit your current process, where each “No” answer represents a stage where fraud can enter undetected.
- Do you cross-check application data against external profiles at the resume screening stage?
- Are screening interviews recorded and reviewable by someone other than the interviewer?
- Do you compare candidate identity and communication style across interview rounds?
- Does your interview platform run any form of in-session fraud or deepfake detection?
- Do hiring panels submit structured scorecards tied to specific criteria, not open-text impressions?
- Are employment and credential verifications conducted through authoritative sources?
- Do you have an auditable record of why each candidate was advanced or rejected, stored where your team can access it during debriefs and compliance reviews?
Some ATS platforms now offer application-stage fraud signals. Check your ATS vendor’s current documentation.
The distinction between these capabilities and purpose-built in-session detection is where in the process the signal is captured: pre-interview signals flag application-stage anomalies, while in-session detection captures behavioral, visual, and metadata signals during the interview itself.
Our candidate fraud detection runs in-session across all supported platforms, routes every flagged signal to a human reviewer, and rolls every signal into an audit-ready record.
Start with the stage where you have the least visibility
The checklist in this article is the starting point: work through it, identify where your process has no recorded baseline, no in-session detection, and no structured scorecard, and treat each gap as an active entry point.
Controls don’t have to be built all at once. Start with the stage where you have the least coverage, add the recording and structure that creates a reviewable baseline, and layer in detection tooling from there. If you want to see how in-session fraud detection works across live and async interviews, request a demo and we’ll walk through what the signals look like in practice.
Frequently asked questions (FAQs)
Candidate fraud is no longer a fringe risk. Some fraudulent candidates clear every round without triggering a flag, and others aren’t discovered until after they’ve been onboarded.
Proxy interviewers and deepfake impersonation are hardest to detect without in-session monitoring, which makes screening interviews and finalist rounds the stages where detection tooling matters most.
AI can flag signals associated with proxy interviews, such as identity inconsistencies, deepfake artifacts, and session-level anomalies, across Zoom, Teams, and Meet during live interviews, and in BrightHire Screen during async screening interviews, with every flag routed to a human reviewer for the final decision.
TA leaders aren’t the ones who argue negligent hiring claims in court, but they are the ones whose process gets examined when a claim is made. Whether your organization’s recruitment controls are sufficient to satisfy a duty-of-care standard is a question for your legal team. But the audit trail TA owns, interview records, scorecard documentation, and the rationale behind each hiring decision, is what that review will draw on. A fraudulent hire who gained system access before discovery typically triggers a Legal and Security escalation, and your documentation is what determines how prepared TA is to respond.
Train interviewers to probe resume specifics, watch for reading or coaching cues, and flag inconsistencies for review rather than making accusations. Our candidate fraud guide recommends asking location-specific and project-specific questions, noting pauses and evasiveness, and tracking multiple signals together rather than acting on any single red flag.
Key Terms Glossary
Proxy interview: An interview completed by someone other than the actual candidate, typically a more qualified stand-in hired to pass technical or behavioral rounds on the applicant’s behalf.
Synthetic identity: A fabricated persona that combines real and invented information (authentic employment records, valid credentials, false contact details) to create a plausible but fraudulent candidate profile.
Structured interview: An interview format where every candidate is evaluated against the same criteria using a standardized guide and scorecard, reducing the variability that fraud exploits.
Human-in-the-loop: A fraud detection model that separates signal identification from decision-making: automated systems flag anomalies, and a human determines whether to act on them.
Interview proxy: A person who completes an interview on behalf of the actual candidate. This is a form of imposter fraud.
Deepfake interview: An interview in which AI-manipulated video or synthetic media is used to impersonate a candidate or alter their appearance or responses.
Identity verification: The process of confirming that the person participating in the interview is the same person who applied for the role.
