How to spot fake candidates in remote interviews

The FBI says these workers "cannot be identified reliably with a single indicator". So the useful question is not whether one moment looked odd. It is whether a pattern holds from the application to the first weeks of work, and whether you can check the facts behind it.

What people mean by a fake candidate

In hiring, the phrase usually covers four different things. Each one leaves its evidence in a different place, so it helps to name them apart:

• A stand-in on the call. Someone other than the applicant takes the interview. See proxy interviews.
• Someone feeding answers. The applicant is on camera while a helper off camera supplies the answers.
• Hidden AI help. An app on the candidate's computer suggests answers in a window the interviewer cannot see. See how to detect Cluely and hidden AI tools.
• A stolen or made-up identity. The person is real, but not the person named on the application. See how to verify a candidate's identity.

Hiring teams report all four. In Checkr's 2026 survey of 3,000 US managers, 40% said they had interviewed a candidate later found to be using a false identity. In its 2025 survey, 35% said someone other than the listed applicant had taken part in a virtual interview. In a Gartner survey of 3,000 job candidates, reported by HR Dive, 6% admitted taking part in interview impersonation. More numbers, with samples and dates, are on the interview integrity statistics page.

Signs before the interview

Resume and application

The FBI's advice is plain: "Check applicant resumes for typos and unusual nomenclature." Watch also for lines lifted from your own job post, and for job titles that do not match how that employer names its roles.

Phone numbers and email addresses

The FBI lists "reused phone numbers (particularly voice-over-IP numbers) and email addresses" as a sign. If your applicant tracking system lets you search, look for the same number or address on more than one application.

Profiles

Compare the online profile with the resume: dates, titles, how long the profile has existed. LinkedIn's verification badge helps, since LinkedIn says identity verification "is performed by CLEAR" in the US, Canada and Mexico. It confirms who holds the account. It does not tell you who is on your video call.

Past employers and schools

The FBI recommends confirming "prior employment and higher education history directly". Use contact details you find yourself, not the ones the candidate supplies.

Signs during the video call

Camera and video

Ask for cameras on. The FBI's words: "Mandate video and request that their backgrounds be unobscured." Its 2022 warning on deepfakes in interviews describes lip movement that does not "completely coordinate with the audio", and coughs or sneezes that are "not aligned" with the picture.

Quick live checks you can ask for

If the video looks odd, the FBI suggests asking the candidate to "wave their hand in front of their face", which may "prompt a malfunction in AI generated video". It also suggests asking them to "point the camera out a window" and talk about where they are. One engineer on Reddit described asking a candidate to turn the camera and describe the room: "He couldn't do it, so we ended the call."

ITWs cannot be identified reliably with a single indicator

How they answer

Interviewers often notice a pause before each answer, eyes fixed on one spot, or polished answers that cannot go one layer deeper. These are worth a follow-up question. They are not proof: nervous, careful and neurodivergent people show them too, and people working in a second language pause to think. As Lever puts it, "each of these signals individually doesn't mean much".

Audio

Listen for a second voice, typing while you talk, or an echo of your question. Recruiters on Reddit describe seeing lip sync: "Lip sync, seen it a few times."

Signs after the offer and on day one

Some problems only show once the person starts. The FBI warns of cases where "the on-the-job work is completed by a different individual" than the one who interviewed. One recruiter described a hire who "passed the background check, I9, everything", and a different person started. Another wrote: "luckily we fired them within 2 days of starting".

• Equipment. The FBI says to "only send to the address listed in the employee's identification documents".
• Payroll. Watch for people who "change their bank accounts often".
• IT. Watch for "unauthorized installation of remote access software".

The North Korean IT worker pattern, briefly

The US Justice Department says North Korean IT workers obtained "employment with more than 100 U.S. companies" in one set of cases, and the FBI has warned of workers "using artificial intelligence and face-swapping technology during video job interviews". The pattern combines all four forms above. Our guide to North Korean IT workers covers how the scheme runs and what the FBI told employers to do.

How to identify fake candidates in recruitment: a 12-step checklist

1. Read the resume for typos, odd job titles and lines copied from your job post.
2. Search the phone number and email; note any that appear on other applications.
3. Confirm past employers and schools directly, with contact details you find yourself.
4. Compare the online profile with the resume: dates, titles, photo and how old the profile is.
5. Ask for cameras on, with a clear background.
6. Watch whether lips match the voice, including coughs and laughs.
7. If the video looks odd, ask for a hand wave in front of the face and a slow turn of the camera.
8. Ask follow-up questions that build on the candidate's own earlier answers.
9. With consent, keep notes and images to compare across rounds.
10. Ship the laptop only to the address on their ID.
11. On day one, check it is the same person you interviewed.
12. In the first weeks, watch for frequent bank changes and unapproved remote-access tools.

Step 9 follows the FBI's advice to "Capture images for comparison with future meetings." Asking for consent first is our addition.

Signs are not proof: what to check instead

Signs give you a reason to look closer. A decision about a person should rest on facts: that the same person is there all through the call, that the video comes from a real camera, and that no hidden helper is running. The FBI's own phrase for this is "identity in depth": checks layered "throughout the employment lifecycle", not one test at the start.

Where Verified Call fits

Verified Call checks the person on the call, before it starts and while it runs, without joining. It checks for hidden AI answer tools, camera software, face swaps, deepfakes and AI avatars sent through camera software, and someone else answering. It checks that the voice on the call matches the person who did the check.

It works inside the video calls you already run. No bot in the participant list. It checks on the person's own computer, so it sees what a video call cannot carry: a tool hidden from screen sharing, or a face sent in through camera software. Each call is checked fresh. The host sees a plain result, with proof beside any flag, and a person can decline the check and still join with the host's link; the host sees that they declined.

We publish how we test, false alarms included. In our own testing, each of 4 hidden AI answer tools was found in 30 of 30 tries, with 0 of 30 false alarms with no AI tool open and 0 of 30 with everyday apps open (October 4, 2026). Camera software and direct cameras were read right in 20 of 20 live calls (October 2, 2026). Every condition is on the Research page.