TL;DR: When fraud is suspected or confirmed, pause on advancing the candidate, and preserve every record: interview recordings, transcripts, scorecards, assessment results, ATS logs, and fraud detection signals. If the hiring manager has already interviewed the candidate, it’s reasonable to let them know the process is on hold while you take a closer look. Keep that communication brief and neutral, and don’t characterize what you’ve found. Do not communicate the fraud investigation to the candidate or notify the hiring manager beyond that brief hold notice until legal counsel has reviewed the evidence chain. When you do communicate, use neutral language that does not reference the fraud investigation. If a background check provider’s report contributed to your decision, the Fair Credit Reporting Act’s (FCRA) adverse action notice requirements apply before you finalize the rejection. Whether a fraud detection tool triggers the same requirements depends on whether it furnishes reports used for employment decisions.
Candidate fraud requires a disciplined response. Moving too fast creates FCRA violations and defamation exposure. Moving without documentation leaves you without a defensible evidence chain. This playbook covers the immediate response, the legal guardrails, the escalation structure, and the process changes that reduce how often you need it.
Identify red flags of candidate impersonation
Before you can respond to candidate fraud, you need to be confident that this is in fact fraud. Not every red flag is fraud, and treating a false positive as a confirmed case creates the exact legal exposure this playbook is designed to prevent.
Spot behavioral signals during the interview
The most common in-interview behavioral signals are: answers that sound polished but generic, long pauses before responses to unscripted questions, and an inability to go deeper when an interviewer probes a specific example. A separate but equally important signal is identity mismatch. When the person on the video call doesn’t match the resume, the phone screen, or the technical assessment. That inconsistency isn’t behavioral; it’s a direct red flag for impersonation and should trigger its own escalation path.
The most effective response is not accusation. Coach your interviewers to ask a follow-up question that requires the candidate to apply their stated experience to a specific, real problem your team has encountered. Something with enough operational detail that a scripted or AI-coached answer won’t hold up. Fraudulent candidates struggle with questions that have no scriptable answer. Candidates with real experience can usually answer them.
Catch assessment fraud in the data
Assessment fraud surfaces in the data, not the conversation, which makes it harder to catch in the moment. Look for completion times that are statistically improbable, answer patterns that match known AI-generated outputs, and assessment scores that are dramatically inconsistent with the candidate’s interview performance. If a candidate scores in the 95th percentile on a technical assessment but can’t explain their own solution architecture in a live follow-up, that gap is worth investigating before you advance them.
Document and escalate applicant data conflicts
Data conflicts surface before the interview stage: a LinkedIn profile that doesn’t match the resume, a phone number registered to a different name, an employment history that reference checks can’t confirm. When you spot a conflict, the worst response is to ignore it and hope the interview clarifies things. The second worst is to confront the candidate without documentation. Pause, document, and escalate. Catching conflicts at this stage costs far less than discovering them after an offer is extended.
The table below is a starting-point framework. Every signal requires human judgment and context before any action is taken. Use it to orient your thinking, not to dictate a fixed response.
| Observed behavior | Verification step | Actionable outcome | Stage |
|---|---|---|---|
| Mismatched video/audio or lip-sync delay | Compare session metadata across interviews. Check for synthetic media indicators such as unnatural facial movements, inconsistent lighting, or audio artifacts | Escalate to TA lead and legal, pause advancement | Pause and escalate |
| Evasive answers to identity questions | Ask unscripted follow-up requiring specific, verifiable detail | Log exact questions and responses, flag for review | Routine interview stage |
| Inconsistent work history across resume, LinkedIn, and references | Cross-reference all three sources, call references by phone | If unresolvable, remove from pipeline with neutral communication, after counsel review | After counsel review |
| Assessment score anomalies vs. interview performance | Compare completion time, answer patterns, and live follow-up depth | Require live re-assessment before advancing, after counsel review | After counsel review |
| Document discrepancies (ID, certifications, employment dates) | Verify with issuing institution or previous employer directly | Pause process, escalate to legal if fraud is confirmed | Pause and escalate |
Immediate response protocol for candidate fraud
Acting on a fraud suspicion before the evidence chain is complete is where FCRA violations and defamation exposure tend to originate. The steps below are ordered deliberately. Skipping ahead, especially to candidate communication, is where most teams create problems they can’t undo.
Initiate an emergency hiring pause
Stop all advancement activity for the candidate immediately. Don’t send a rejection. Don’t schedule the next interview. If the hiring manager has already interviewed this candidate, it’s reasonable to let them know the process is on hold while you take a closer look, but keep that communication brief and neutral, and don’t characterize what you’ve found. Keep the candidate’s application status unchanged in your ATS while you build the evidence chain. Before taking any action the candidate will see, bring in your HR business partner and legal counsel.
Preserve and log every record
Preserve every record related to the candidate’s process: interview recordings, transcripts, scorecards, assessment results, applicant tracking system (ATS) activity logs, fraud detection signals, and any communication between the candidate and your team. If you’re using a third-party background check or fraud detection service, preserve the full report.
Create a single, time-stamped record that captures:
- What signal was detected and when
- Who detected it
- What verification steps were taken
- What the result of each step was
- Specific signals and session data if fraud detection tooling surfaced them during the interview
Every signal is documented in audit-ready records, giving teams a defensible trail.
Every communication related to the fraud case should be logged: who was notified, when, what they were told, and what action they took. This audit trail has two functions: it demonstrates a consistent, criteria-based process if the decision is ever challenged, and it prevents the same candidate from re-entering your pipeline under a different identity.
Protect your hiring process from legal liability
The legal risk in a fraudulent candidate response runs in two directions. Move too fast without documentation, and you face defamation or discrimination claims from the candidate. Advance a candidate you haven’t verified, and you risk extending an offer to someone who shouldn’t have access to your systems. The guardrails below address both.
Know when FCRA applies
FCRA applies when your hiring decision is based “in whole or in part” on information from a third-party consumer reporting agency. Background check providers are covered. Whether a fraud detection or identity verification tool qualifies depends on whether it furnishes reports used for employment decisions bearing on character, reputation, or similar traits, as defined in 15 U.S.C. § 1681a.
Confirm with counsel before assuming FCRA applies to your specific tooling. If any third-party report contributed to your decision to disqualify the candidate, FCRA requires pre-adverse action notice before you finalize the decision. That notice must include a copy of the consumer report and a summary of the candidate’s rights.
Time the notices
- Send the pre-adverse action notice with a copy of the report and the CFPB’s Summary of Rights. This signals that you’re considering adverse action, not that you’ve already decided.
- Wait before finalizing the decision. FTC guidance doesn’t set a waiting period between the two notices. Many employers allow at least five business days to give the candidate time to dispute the report’s accuracy.
- Send the final adverse action notice if you proceed, including the consumer reporting agency’s contact information, a statement that the agency didn’t make the decision, the candidate’s right to a free copy of the report within 60 days, and the candidate’s right to dispute the report’s accuracy or completeness with the agency.
The critical threshold is “in whole or in part.” Even if other factors contributed to your decision, if the background report played any role, adverse action procedures apply under 15 U.S.C. § 1681m. Some jurisdictions require the final notice to state the specific reason for the decision. Confirm with counsel which requirements apply in the locations where you hire.
Document observations, not conclusions
A defamatory statement is a false statement of fact, published to a third party, that damages someone’s reputation. Libel is defamation in written form. In the context of candidate fraud, the risk shows up in two places: internal documentation that uses conclusory language (“this candidate fabricated their identity”) rather than observed facts (“the candidate’s stated employment at Company X could not be verified”), and external communication that shares fraud suspicions with anyone outside the need-to-know circle.
Know the limits of qualified privilege
The qualified privilege defense protects good-faith internal communications, such as evaluations, investigative reports, and disciplinary documentation, between parties with a legitimate shared interest. It can be lost through malice or excessive publication, and what constitutes each varies by state. Confirm with employment counsel what protections apply in the jurisdictions where you hire.
In some cases, limited external disclosure may be protected under the common interest doctrine, but whether it applies is a determination for your legal counsel. The doctrine is not uniformly recognized across jurisdictions.
Write observations, not conclusions
The operational rule is to document what you observed, not what you concluded. Example of defensible documentation: “The candidate’s video feed showed a lip-sync delay of approximately 2 seconds and the candidate could not answer follow-up questions about their stated project work.” By contrast, “This candidate is an imposter” is a conclusion, not an observation, and is not defensible.
This also applies to written records: “the candidate’s stated employment at Company X could not be verified” is defensible. “The candidate fabricated their employment history” is not.
Call counsel at these trigger points
Bring in HR and legal before any candidate-facing action. Outside counsel is required once fraud is confirmed or a trigger point applies: the candidate has already received an offer, the candidate has already started, the fraud involves a third party, or the conduct may cross into criminal territory.
Wire fraud charges can apply when impersonation happens over electronic communications across state lines, carrying up to 20 years in prison. Give counsel a clean evidence chain to work from.
Navigate sensitive conversations after a confirmed identity mismatch
The conversations that follow a confirmed fraud case carry legal exposure when the wrong information reaches the wrong person before counsel has reviewed the evidence chain. The candidate, the hiring manager, and the recruiting team all need different information, delivered differently.
Use neutral language with the candidate
The candidate-facing communication should be a standard, neutral rejection with no reference to the fraud investigation. An approach that works: “After careful review of your application and interview, we have decided to move forward with other candidates whose qualifications better align with the position at this time.”
If the candidate asks why, keep the response neutral. Federal law doesn’t require you to explain a rejection, per FTC guidance on adverse action, but FCRA requires adverse action notices when a consumer report contributed to the decision, and some state or local laws impose additional requirements. Confirm with employment counsel what applies in your jurisdiction.
If the candidate disputes the decision, route it to legal counsel immediately. Do not reference the investigation in writing. If any element of your evidence chain is later challenged, that reference becomes a defamation exposure.
Escalation protocols when fraud signals are confirmed
A fraud signal response that lives entirely inside the TA team leaves the process unchanged, and leaves the same gap open the next time an impersonator reaches your pipeline. Escalation protocols ensure the right people know what happened, when, and what changes as a result.
Define your internal notification chain
The notification chain for a confirmed fraud case: TA lead (you), HR business partner, legal counsel, hiring manager for the affected requisition, and your security team, if your organization has one and the candidate received any system access or internal information. Each person on that chain gets a different level of detail. Legal gets the full evidence log. The hiring manager gets the outcome and the process implication. Security gets the scope of any exposure.
Align your hiring manager on what happened and what changes
Hiring managers who invested time in interviewing a candidate whose identity could not be verified often react in one of two ways: they want to confront the candidate directly, or they want to pretend it didn’t happen and move on. Neither serves the process. Your job is to give the hiring manager a clear, factual summary of what happened, what the process changes are, and what they should do differently in future interviews. This is a calibration conversation, not a blame conversation.
Harden your hiring process against fraud
The response playbook above addresses what to do when fraud appears. The fixes below reduce how often it does. These are the process fixes that address the root causes, not just the symptoms.
Verify identity at application
Verify identity before the first interview, not after the last one. Practical steps include requiring a photo ID and real-time selfie through a secure verification service, using liveness detection (technology that confirms a real person is present, not a photo or video) to confirm the person matches the ID, and cross-referencing public profiles against the resume. Even without dedicated tooling, a spot-check step, such as cross-referencing phone numbers and public profiles, can catch fraudulent applications before they reach an interview.
Mandate structured interview rubrics
Structured interviews are a fraud defense, not just a quality-of-hire practice. When every interviewer asks scenario-based questions tied to defined competencies, documents evidence in real time, and submits a scorecard grounded in observed performance, candidates using proxy support or AI-coached responses have a much harder time bluffing through.
“Every touchpoint you have with a candidate is where fraud could show up.” – Josh Elmore, Global Head of Talent Acquisition and People Operations at Zoom
We run fraud detection during the interview itself across BrightHire Screen (our AI interviewer for early-round interviews), Zoom, Microsoft Teams, and Google Meet, surfacing flags to the hiring team without interrupting the interview flow.
Signal coverage varies by platform. For teams running structured interviews on Zoom, every signal, review, and decision is documented in audit-ready records, giving teams a defensible trail. If you’re evaluating fit with your current stack, our integrations page covers ATS compatibility. Verify references by telephone and cross-check the reference’s identity against LinkedIn or other professional networks.
Involve hiring managers in the reference review. They often know which questions expose real expertise. A reference who can’t describe the candidate’s actual project work in specific terms is a signal worth documenting.
Close the loop after every confirmed case
After a confirmed fraud case, three steps close the loop:
- Flag the ATS record with observations only (what was detected, when, and by whom) visible only to those counsel has identified as needing to know. Do not record conclusions or fraud labels in fields accessible to recruiters or hiring managers by default.
- Notify internal security if the candidate received system access, internal documents, or product information, and document the scope of exposure.
- Identify the process gap that allowed advancement. Was the signal missed at application, screening, or live interview? Each answer points to a different fix.
For GDPR or CCPA compliance, confirm with employment and privacy counsel which deletion and access request obligations apply to your hiring data in the jurisdictions where you operate.
The bottom line
Catching candidate fraud is a legal event. Pause before communicating, document before concluding, and involve counsel before acting. Miss that sequence and you risk an FCRA violation, a defamation exposure, or a hire whose identity was never verified and who already has system access. The stronger your prevention layer, the less often you need this playbook.
Request a demo to see how in-session fraud detection surfaces risk signals during interviews and how structured interview infrastructure reduces how often impersonation gets through your hiring process.
Frequently asked questions (FAQs)
Not without legal review. Sharing fraud suspicions with a third party outside your need-to-know circle can defeat the qualified privilege that protects internal documentation, and creates defamation exposure if any element of your evidence is later challenged. Consult your legal counsel before any external communication about a confirmed or suspected fraud case.
Rescinding an offer requires the same FCRA adverse action process if a third-party consumer report contributed to the decision. Confirm with employment counsel whether the same steps apply given your specific tooling and jurisdiction. Involve legal counsel immediately, preserve all evidence, and don’t communicate the rescission until counsel has reviewed the documentation and approved the language.
Share only what the vendor needs to improve their detection. Qualified privilege, where it applies, generally protects good-faith internal communications, but its scope varies by state and can be lost through excessive publication or disclosure to parties outside the need-to-know circle. Confirm with legal counsel what can be shared under your vendor agreement without waiving that protection.
Document the recruiter’s role in submitting the candidate, preserve all communication, and involve legal counsel before confronting the agency. If the recruiter knowingly submitted a candidate with fabricated credentials or identity, the conduct may constitute wire fraud under 18 U.S.C. § 1343, which is a criminal referral decision for your counsel to make, not a matter for your vendor or procurement team to resolve.
It can be. Federal statutes that may apply include wire fraud (18 U.S.C. § 1343, up to 20 years) and, where another person’s identity is used, aggravated identity theft (18 U.S.C. § 1028A, a mandatory additional 2 years, running consecutively). Your legal counsel determines whether the facts meet the threshold for referral.
Key terms glossary
Proxy interview: An interview completed by someone other than the named candidate, typically using video or audio manipulation to appear as the applicant.
Structured interview rubric: A standardized evaluation framework that ties interview questions to defined competencies and requires evidence-based scoring.
CFPB: Consumer Financial Protection Bureau, the federal agency that publishes the Summary of Your Rights Under the Fair Credit Reporting Act, which must accompany a pre-adverse action notice.
