I asked a room full of TA leaders at Shine 2026: how many of you are sure you have fake applicants in your pipeline? Almost every hand went up.
That’s where we are now. Fraud has become a major issue that every hiring team is grappling with. Most TA leaders we talk to have at least one story of a candidate who turned out to be someone else, something else, or somewhere else entirely. And, Gartner expects one in four job candidates to be fraudulent by 2028.
The big question is: what can TA teams do about it? To start to answer that question, I sat down with three people who see this from very different perspectives: Soups Ranjan, Co-Founder and CEO of Sardine, which builds fraud prevention infrastructure for banks and fintechs; Brendan Ittelson, Chief Ecosystem Officer at Zoom, who built Zoom’s trust and safety organization in its early days; and Joshua Fattal, a privacy, AI, and data security attorney at Morrison Foerster.
They laid out what candidate fraud looks like today, the shape a defense is starting to take, the legal terrain it has to work inside, and where the threat is heading.
Key takeaways
- Candidate fraud comes in many forms, not just deepfakes. Synthetic identities, location misrepresentation, AI-assisted cheating, and proxy interviews are all part of the mix.
- The emerging defense is collective, not individual. Finance solved this with shared-signal infrastructure across institutions. Hiring’s version would draw signals from the platforms already involved in the process.
- The defense is shifting toward signal-based thinking. Per-interview checks like asking candidates to turn their head don’t scale. The reframe: what do you actually need to know about this candidate, and what signals would tell you?
- Fraud is going agentic — and the defense has to follow. As AI starts running fraud attacks end to end, a defense that waits for a human to review every flag can’t keep up.
What candidate fraud looks like today
Deepfake content is growing roughly 900% year over year, with the volume of deepfake files jumping from about 500,000 in 2023 to a projected 8 million in 2025. Three seconds of someone’s voice is enough to clone it with 85% accuracy. And the tools to generate a realistic passport, complete with hologram, are widely available.
It’s safe to say TA teams are up against a lot.
Soups walked through a progression of deepfakes from his own work: jittery and obviously off twelve months ago, smoother and harder to spot six months ago, and indistinguishable from a real video call today. And easy to pull off.
“It’s moved from just a niche item that well-funded actors could use to something that is now mainstream, accessible by most individuals.”
— Brendan Ittelson, Chief Ecosystem Officer, Zoom
Which means the question for TA teams isn’t whether fraud is in the pipeline. It’s what kind.
“Candidate fraud” gets used as a single term, but the panel made clear it covers a range of different attacks:
- Deepfakes on video interviews — synthetic faces and voices mapped onto an actual call.
- Synthetic identities built from stolen or fabricated credentials.
- Candidates pretending to be in one country while connecting from another, with VPNs and mismatched phone numbers as the tells.
- Real candidates using ChatGPT or other tools to feed them answers in technical screens.
- Proxy interviews, where someone else takes the call on the candidate’s behalf.
Each has different stakes and different defenses. AI-assisted cheating during a technical screen is closer to a traditional mishire, though it can show up at higher volumes. The identity-fraud end of the spectrum is where the stakes climb: Joshua walked through how a North Korean operative hired into a U.S. company can stack a security incident, breach notification obligations under various state laws, and sanctions law violations for having paid them — all from one bad hire.
The shape a defense is starting to take
Fighting fraud with shared signals
Banks figured out a long time ago that no single one of them could catch fraud on its own. So they started sharing what they saw.
That’s what Sardine does for the banks and fintechs it works with. If a device, email, or phone number gets used to commit fraud at one bank, that signal gets shared with the others. One bank on its own can miss a repeat fraudster. Ten banks sharing what they see usually won’t.
While hiring can’t currently share data in the same way finance can thanks to the The Gramm-Leach-Bliley Act, Brendan pointed at where the pieces of a shared layer could come together for hiring — LinkedIn integrating with Zoom profiles to validate identity, World ID for proof of humanness, deepfake detection vendors building on top. No single one of those solves candidate fraud. Together, they start to look like the kind of infrastructure finance built.
“I think collectively we could build something super powerful together where we eliminate candidate fraud.”
— Soups Ranjan, Co-Founder and CEO, Sardine
Trust signals beat detection alone
A lot of fraud defense in hiring still looks like a per-interview check — asking the candidate to turn their head on camera, asking about their local coffee shop, looking for telltale glitches in the video. Brendan called this out directly: those checks can work, but they don’t scale, and they don’t adapt as the technology gets better.
The alternative the panel kept returning to is signal-based. The question shifts from “is this person committing fraud right now?” to “what do I actually need to know about this candidate, and what signals would tell me?” For some companies, that’s full identity lineage. For others, it’s just proof of humanness. The right answer depends on the risk profile of the role and the company.
“Do I really want to know the candidate and their identity lineage, or do I just really care to know that this is a human?”
— Brendan Ittelson, Chief Ecosystem Officer, Zoom
Soups walked the room through what this looks like inside Sardine itself. The company built an agent that runs daily against its own applicant pool, looking for telltale signals: candidates claiming a U.S. location while connecting from a VPN, phone numbers that don’t match the country on the resume, and other tells. Each candidate gets a risk score the recruiting team can use to triage. The agent cut the volume of applicants the team had to review by more than half.
The legal terrain of candidate fraud
Even a well-designed fraud defense has to operate inside a legal regime that’s still being built. Joshua’s quick map: there are 600 to 1,000 AI-related laws and bills currently in consideration in the U.S. The Colorado AI Act, the first comprehensive state-level AI law, takes effect in June — and is being completely revised in the two weeks before it does. That’s the shape of the moment.
Two specifics matter for fraud defenses. Biometric laws (covering face and voice prints) have private rights of action in several states, so a candidate can sue directly over consent. And laws on automated decision-making apply to more than rejections — moving a candidate down a list because a tool flagged them can fall under the same obligations as turning them away.
“It’s incredibly murky. Clients come to us for advice, and I have to tell them in two weeks it actually may be different.”
— Joshua Fattal, Privacy, AI and Data Security Attorney, Morrison Foerster
Transparency with candidates is key
Another common form of fraud involves real candidates using ChatGPT or similar tools to get through technical screens and assessments. It comes with a legal question attached. If you’re going to use proctoring software, AI monitoring, or any tool that watches what a candidate is doing while they take an assessment, what do you have to tell them about it?
Joshua’s answer was direct. The compliance bar is lower than most teams fear, but it does have to be met. The path through it starts with transparency.
In practice that means three things. Before the assessment, candidates should get a clear notice about what tools will be in use — proctoring software, face scanning, whatever applies. The notice should be specific enough that a candidate knows what’s being collected and why. And if a candidate ever asks to see the record of their own assessment, the team should be able to produce it.
“Think carefully about what your actual goal is. Then design the tool to collect as little data as effectively as possible to meet that goal.”
— Joshua Fattal, Privacy, AI and Data Security Attorney, Morrison Foerster
The takeaway is more reassuring than it sounds. Many TA teams hesitate to add fraud defenses to their assessment process because they’re worried about the legal exposure. The bar to clear isn’t onerous. It’s candidate consent, clear notice, and the ability to produce the record. Most of the work is upfront and one-time.
The future of fighting fraud is agentic
For all the changes the panel covered, Soups argued the biggest one is still ahead. Today, fraud attacks still involve humans in the loop — someone buying stolen identities on the dark web, someone pretending to be the person on the resume, someone running the interview from a fake setup. The tools are getting more sophisticated, but the loop has people in it.
That’s about to change. Soups described what’s coming as an agentic fraud system: AI that buys credentials, builds an identity, applies for jobs at Fortune 500 companies, and runs the interview — all without a human at the controls. The threat scales the way any agentic system scales. One actor running a hundred attacks at once is no longer a logistics problem.
The defense has to match the shape of the threat. A fraud team that wakes up a human every time something flags doesn’t scale against an attacker that doesn’t need to wake up at all.
“I don’t need to wake up a human, ever. I want to have AI battling AI.”
— Soups Ranjan, Co-Founder and CEO, Sardine
Final takeaway
The panel didn’t lay out a finished defense. What they sketched is the shape of one: collective rather than individual, signal-based rather than score-based, and built for a threat that’s about to get more automated. The teams getting ahead of it are treating fraud the way finance did a decade ago — as a layered problem solved across platforms and partners.
For a deeper look at how to spot and protect against candidate fraud, see BrightHire’s full guide.
