A senior backend engineer clears three rounds of interviews with ease. Answers are crisp, the take-home is flawless, and the hiring manager signs off within a week. Then the laptop ships to an address in another state, the person on the first stand-up sounds nothing like the person from the interviews, and the code commits stop matching the skills you paid for. This is candidate fraud, and in 2026 it has moved from an occasional oddity to a routine risk for every company hiring technical talent remotely.
The numbers explain why hiring teams are paying attention. In a 2025 survey of 3,000 job seekers, Gartner found that 6% admitted to interview fraud, either posing as someone else or having someone pose as them, and it predicts that by 2028 one in four candidate profiles worldwide will be fake. The FBI has issued repeated public warnings about state-sponsored IT workers using stolen identities to land remote jobs at US companies.
This guide explains the forms candidate fraud takes, the 11 red flags that expose fake IT candidates, how to catch deepfake interviews in real time, and a layered vetting process that stops fraud without slowing down legitimate hires. If speed is also a concern, read it alongside our guide to reducing time-to-fill for IT roles, because the best fraud controls are the ones built into a fast process rather than bolted on at the end.
Table of Contents
- What is candidate fraud in IT hiring?
- Why candidate fraud is surging in 2026
- 11 red flags of fake IT candidates
- How to detect deepfake interviews
- A layered vetting process that stops candidate fraud
- Staying compliant while you screen
- Candidate fraud in contract and C2C staffing
- What to do if you suspect fraud
- Frequently asked questions
- Conclusion and next step
What Is Candidate Fraud in IT Hiring?
Candidate fraud is any deliberate misrepresentation of identity, credentials or ability during the hiring process. It sits on a spectrum. At one end is the familiar embellished resume. At the other is a coordinated scheme in which one person interviews, a second person does the work, and the salary flows to a third party overseas.
Technical roles attract more of it than almost any other function. IT jobs pay well, are frequently remote, are assessed mainly through video calls and online tests, and grant access to source code, cloud consoles and customer data. That combination makes technical roles the prime target for candidate fraud, and a software or infrastructure role worth far more to a fraudster than a typical office position.
| Type of fraud | How it works | Where it usually surfaces |
|---|---|---|
| Credential inflation | Fabricated employers, degrees or certifications, often generated by AI to mirror the job description | Reference and education checks, deep technical questioning |
| Proxy interviewing | A more skilled person takes the interview on the real candidate’s behalf | Voice or appearance changes between rounds or on day one |
| Live AI assistance | The candidate reads answers generated in real time by a hidden tool | Unnatural pauses, eye movement, failure on follow-up questions |
| Deepfake video or voice | Face-swap or voice-cloning software masks the real person on camera | Visual artifacts, lip-sync lag, glitches when the head turns |
| Synthetic or stolen identity | A real person’s name and SSN, or a fabricated composite, are used to pass checks | Identity verification, I-9 and E-Verify mismatches |
| Bait-and-switch placement | The interviewed candidate is replaced by a different worker after hire | Productivity, communication style and login patterns |
| State-sponsored remote workers | Organized teams use US-based facilitators and “laptop farms” to hide their location | Device shipping, remote-access tools, network logs |
Why Candidate Fraud Is Surging in 2026
Remote hiring removed the in-person checkpoint
For decades, the final interview happened in a building. Someone walked in, shook hands and showed a driver’s license at reception. Fully remote hiring removed that checkpoint, and many companies never replaced it with anything equivalent. A candidate can now go from application to signed offer without anyone confirming that the face on screen belongs to the name on the paperwork.
Generative AI made fakes cheap and convincing
A tailored resume that once took hours now takes seconds. Real-time face-swapping and voice-cloning tools that required specialist skill a few years ago are now consumer software. The FBI’s Internet Crime Complaint Center warned as early as 2022 that deepfakes and stolen personal data were being used to apply for remote technical positions, and the tools have improved considerably since.
Organized schemes target IT and contract roles
The most serious candidate fraud is not opportunistic. The FBI’s 2025 guidance on North Korean IT workers describes teams that use stolen identities and US-based facilitators to obtain remote IT jobs, and it specifically notes that contract IT work is a common route in. Earlier alerts warned that some of these workers have stolen proprietary code and then extorted their employers once discovered. For companies hiring through vendor chains, that makes candidate fraud a security issue as much as a recruiting one.
A fraudulent hire is not only a wasted salary. With access to your repositories, cloud accounts and customer data, it can become a data breach with a payroll number attached.
11 Red Flags of Candidate Fraud in IT Hiring
No single signal proves fraud, and many have innocent explanations. A new LinkedIn profile may belong to a private person; a laggy video may just be poor broadband. What matters is clustering, because candidate fraud rarely shows just one symptom. Three or four of the flags below appearing together justify a closer look before you extend an offer.
Before the interview
- A thin or newly created online footprint. A senior engineer claiming ten years of experience with a LinkedIn profile created months ago, few connections, no endorsements and no public code history deserves a second look.
- Recycled contact details. The FBI highlights VoIP phone numbers and email addresses that reappear across multiple resumes. If your applicant tracking system shows the same number or email under different names, treat it as serious.
- A resume that mirrors the job description. Every required skill appears, in the same order and phrasing as your posting, with no sign of the uneven, specific detail real careers produce.
- Employers you cannot verify. Companies with no web presence, a website registered recently, or references who only answer by email and never by a verifiable company phone line.
During the interview
- Camera problems that only affect video. The candidate insists on keeping the camera off, uses a heavy blurred background, or loses video exactly when asked a difficult question.
- Visual and audio mismatch. Lip movement that trails the words, a face that blurs or warps at the edges, or lighting on the face that does not match the room.
- Rhythmic pauses before every answer. A consistent two or three second delay, eyes tracking across the screen, and polished, textbook responses that collapse when you ask “why”.
- No depth on their own projects. The candidate can describe a system from the resume in general terms but cannot explain a trade-off they personally made, a bug they fixed or what they would change now.
- A different voice or manner between rounds. Accent, fluency, vocabulary or even apparent age shifts between the screening call, the technical round and the final interview.
After the offer
- Unusual equipment and payment requests. A request to ship the company laptop to a different address than the one on file, pressure for payment to a third-party account, or reluctance to appear on camera for onboarding.
- Suspicious activity in the first weeks. Unapproved remote-desktop software, logins from locations that do not match the stated address, or multiple sessions on one account from different places in a short window.
How to Detect Deepfake Interviews in Real Time
Detection software is improving, but when it comes to video-based candidate fraud, a trained interviewer with a few simple techniques catches a surprising share of deepfake interviews today. Build these into the technical round rather than using them as an ambush, and apply them to every candidate equally.
- Ask for natural movement. Invite the candidate to turn their head to the side, or to raise a hand past their face. Real-time face-swap models still struggle with profile views and objects crossing the face.
- Change the context. Ask them to share their screen and walk through a small live coding task, then switch back to camera and discuss it. Switching modes disrupts scripted and AI-assisted setups.
- Go three questions deep. After any answer, ask why that approach, what went wrong, and what they would do differently. Fraudulent candidates rarely survive the third follow-up on their own experience.
- Keep one interviewer consistent. Have the same person join the first screen and the final round. That person is best placed to notice a different voice or face.
- Record with consent. Where your policy and state law allow, record interviews with clear consent so the hiring manager can compare them with the new hire’s first week.
A word of caution: an accent, a nervous manner or modest home equipment are not fraud indicators. Screening must focus on identity consistency and demonstrated skill, never on national origin or presentation. We cover this in the compliance section below.
A Layered Vetting Process That Stops Candidate Fraud
The most effective defense against candidate fraud is not one expensive tool. It is a sequence of inexpensive checks placed at the stages where each type of fraud is easiest to catch. Gartner recommends verifying identity during the assessment process, not only at background screening, and extending fraud detection beyond the start date.
| Stage | What to check | Fraud it catches |
|---|---|---|
| 1. Sourcing and application | Duplicate contact details, profile age, verifiable employers and public work | Synthetic identities, fabricated careers |
| 2. Recruiter screen | Short video call with camera on; confirm location, work authorization and availability | Camera-avoidance, basic impersonation |
| 3. Identity verification | Government ID matched to a live selfie or video before the technical round | Stolen identities, proxy candidates |
| 4. Technical assessment | Live, structured problem-solving with follow-up questions, not only take-home tests | AI-assisted answering, credential inflation |
| 5. Final interview | In person where practical, or a verified video session with a consistent interviewer | Deepfakes, bait-and-switch |
| 6. Onboarding | Form I-9 and E-Verify, equipment shipped only to the verified address, live video onboarding | Location masking, laptop farms |
| 7. First 90 days | Access monitoring, manager check-ins, comparison with interview recordings | Worker substitution, insider threats |
Put the heaviest checks where the risk is
Not every requisition needs every control. A fully remote role with production access, admin rights or financial data needs all seven stages. An on-site role with limited system access may need far fewer. Grading roles by candidate fraud risk and access level keeps candidate experience smooth for most hires while concentrating effort where a fraudulent hire would do real damage. This matters especially for security roles; our cybersecurity staffing guide covers how to assess those candidates in depth.
Design technical rounds that expose fakes
The same structured interview that predicts on-the-job performance also exposes fraud. Ask candidates to reason aloud through a real problem from your environment, then change a constraint halfway through. Our DevOps engineer screening guide shows how to build this kind of scenario-based round for infrastructure roles.
Tell candidates what you check
Transparency is one of the cheapest deterrents to candidate fraud. State in the job posting and first email that you verify identity, conduct live technical interviews and run background checks. Honest candidates rarely object, and a meaningful share of fraudulent ones simply withdraw. Keep the verification step fast, though; a clunky process pushes genuine talent toward competitors and can hurt your offer acceptance rate.
Staying Compliant While You Screen for Candidate Fraud
Fraud controls must sit inside employment law, not beside it. The points below are general guidance for US employers, not legal advice; confirm your process with employment counsel.
- Background checks need consent. Third-party background reports fall under the Fair Credit Reporting Act, which requires written disclosure and authorization, plus pre-adverse and adverse action notices if you act on the results.
- Do not over-document the I-9. Employees choose which acceptable documents to present for Form I-9. Demanding specific documents, or more than required, can amount to unfair documentation practices. E-Verify confirms employment eligibility after the offer is accepted.
- Watch biometric laws. ID-to-selfie matching may collect biometric data. States such as Illinois regulate this closely, so use a vendor with a compliant consent flow.
- Apply checks consistently. Run the same verification steps for every candidate in a role. Selectively scrutinizing people based on name, accent or country of origin creates discrimination risk.
- Respect work authorization rules. Visa status is not a fraud signal. Our guide to H-1B, OPT and TN work authorization explains what employers can legitimately ask.
Candidate Fraud in Contract and C2C Staffing
Contract hiring is where candidate fraud concentrates, and the reason is structural. In a corp-to-corp arrangement the candidate may sit several layers down a vendor chain, with each layer passing along a resume it has not personally verified. By the time the profile reaches you, no one in the chain may have seen the person on camera or checked an ID.
If you use contractors, ask every supplier to name who performs identity verification, when, and how. Require that the person interviewed is the person placed, written into the contract with a right to remove and replace at no cost. Candidates can learn how these arrangements work in our explainer on W2, C2C and 1099 IT contract jobs, and employers weighing the options can compare them in our guide to staff augmentation versus managed services.
Contract-to-hire adds a useful safeguard: a paid working period in which output, communication and system access patterns are observed before a permanent commitment. See how that model works in our contract-to-hire IT staffing guide.
What to Do If You Suspect Candidate Fraud
Handle suspected candidate fraud calmly and methodically. Confronting a candidate abruptly can tip off an organized group, and quietly terminating a hired worker without securing systems can leave you exposed.
- Pause, do not accuse. Put the process on hold with a neutral message such as “we need to complete an additional verification step”.
- Document everything. Save the resume, messages, recordings where consented, contact details and any identity documents supplied.
- Request live verification. Ask for a short camera-on call with a government ID, or an in-person meeting if the candidate claims to be local.
- Secure access if already hired. Involve IT security before any conversation with the worker. Revoke credentials, preserve logs and recover devices.
- Report it. The FBI asks businesses to report suspected state-sponsored IT worker activity to IC3, and to alert any staffing supplier involved.
How a Staffing Partner Reduces Candidate Fraud Risk
A specialist IT staffing firm sees thousands of technical profiles a year, which means it recognizes recycled resumes, duplicate contact details and scripted interview patterns faster than an internal team that hires occasionally. The right partner treats candidate fraud prevention as part of the service and verifies identity before submitting a candidate, not after you have already invested three interview rounds.
When evaluating agencies, ask directly how they prevent candidate fraud, whether they meet every candidate on camera, and what guarantee applies if a placement proves fraudulent. Our 12-point guide to choosing an IT staffing agency lists more of the questions worth asking, and our breakdown of IT staffing agency costs shows what that level of vetting typically adds to a bill rate.
Frequently Asked Questions About Candidate Fraud
What is candidate fraud?
Candidate fraud is the deliberate misrepresentation of identity, qualifications or ability during hiring. It ranges from fabricated credentials and proxy interviews to deepfake video calls and organized schemes that use stolen identities to obtain remote jobs.
How common are fake candidates in IT hiring?
It is growing quickly. In Gartner’s 2025 survey, 6% of job seekers admitted to interview fraud, and the firm predicts one in four candidate profiles worldwide will be fake by 2028. Remote technical roles are among the most targeted by candidate fraud.
Can you really spot a deepfake in a video interview?
Often, yes. Ask the candidate to turn their head, pass a hand in front of their face or switch between screen share and camera. Watch for lip-sync delay and blurring at the edges of the face, and confirm identity with a government ID matched to a live image.
Is it legal to verify a candidate’s identity before hiring?
Generally, yes, provided you obtain consent, follow the Fair Credit Reporting Act for background checks, comply with state biometric laws and apply the same checks to every candidate. Form I-9 and E-Verify rules still govern employment eligibility after the offer.
Are contract IT roles more exposed to candidate fraud?
Yes. Remote contract roles, particularly those filled through several layers of vendors, are a common entry point because each layer may assume someone else verified the candidate. Require suppliers to confirm the person interviewed is the person placed.
How do staffing agencies prevent fake candidates?
Good agencies verify identity early, meet every candidate on camera, check references by phone through verifiable company contacts, run structured technical screens and replace any fraudulent placement at no cost.
Conclusion: Verify Early, Verify Consistently
Candidate fraud thrives in hiring processes that assume the person on the screen is the person on the paperwork. Close that gap with a few deliberate checkpoints: verify identity before the technical round, make interviews live and conversational, keep one interviewer consistent, ship equipment only to verified addresses and watch the first 90 days closely. None of these steps is expensive, and together they make a fraudulent hire far harder to pull off.
KJIT Solutions INC places IT professionals across the United States on contract, contract-to-hire and permanent terms, and our recruiters screen candidates before they ever reach your interview panel. If you want a technical hiring pipeline you can trust, talk to our team today. You can also explore more hiring and workforce insights on our blog.