How to spot an AI-generated (fake) candidate

A few years ago, "fake candidate" meant someone who padded a CV. Today it can mean a person who does not exist: a generated photo, a fabricated work history, a borrowed identity, and a stand-in, or a deepfake, on the video call. The incentive is real. A remote job pays a salary and can grant access to systems and data.

This guide covers what candidate fraud looks like in 2026, the signs at each stage, and the checks that catch it without treating every applicant as a suspect.

How big is the problem?

Bigger than most hiring teams assume, and growing. Gartner predicts that by 2028, 1 in 4 candidate profiles worldwide could be fake. In the same research, 6% of around 3,000 surveyed candidates admitted to interview fraud, either posing as someone else or having someone pose as them.

The most organised version is state-backed. In June 2025 the US Justice Department announced coordinated actions against North Korean remote IT worker schemes, including searches of 29 suspected "laptop farms" in 16 states. It said the workers had obtained jobs with more than 100 US companies, and one indictment alleged the identities of more than 80 US people had been compromised.

Volume makes it easier to hide. Applications per recruiter are up 412% since 2023, according to Greenhouse data, and LinkedIn handles around 11,000 applications a minute. When a recruiter is skimming hundreds of CVs, a well-made fake looks like every other strong profile.

First, separate AI help from fraud

Using AI to write a CV is now normal. A 2025 Hiscox survey found 53% of applicants used AI to help write their CV in the past year. That is not fraud, and treating it as fraud will cost you good people.

A useful line: AI that helps a real person describe real experience is assistance. AI that invents the person, the experience or the identity is fraud. Your checks should target the second without punishing the first.

It helps to think of fraud on a spectrum:

1. Embellishment. Real person, inflated claims. The same Hiscox survey found 37% would not correct embellishments AI added to their CV.
2. Fabrication. Real person, invented roles, employers or qualifications.
3. Proxy interviewing. A real candidate, but someone else sits the interview.
4. Synthetic or stolen identity. The person on the application is not the person who will do the job, sometimes with a deepfake on camera.

Signs at the application stage

No single sign proves anything. Look for clusters.

• A profile that is perfect for the job description and thin everywhere else. Exact keyword matches, no specific numbers, no projects you can look up.
• A short or recently created online footprint for someone claiming ten years of senior experience.
• Employers that are hard to verify, such as companies with no trace, or websites built recently.
• Contact details that do not line up. A phone number, time zone and stated location that point to different places.
• Many near-identical applications across roles, sometimes from different names with the same phrasing.

Signs in the interview

The FBI's Internet Crime Complaint Center described these years ago, and they still hold. In its public service announcement on deepfakes in remote job interviews, employers reported lip movements that did not match the audio, and coughs or sneezes that did not line up with what appeared on screen. Background checks then showed some applicants were using someone else's personal details.

Other patterns hiring teams report:

• Delays before every answer, followed by fluent, generic responses, as if someone or something else is supplying them.
• Refusal to turn on video, constant "camera problems", or a fixed, oddly lit face that does not react naturally.
• Answers that collapse on the second question. The first answer is polished. Ask "what exactly did you do on that project, and what went wrong?" and the detail disappears.
• A different person at each stage. Voice, accent or knowledge level changes between the screening call and the technical round.

Signs after the offer

Some of the clearest signals arrive late:

• a request to ship the laptop to an address that is not the candidate's home;
• pressure to be paid into an unusual account, or through a third party;
• reluctance to attend any in-person step, even once;
• identity documents that do not match the person you met.

The DOJ case above describes laptop farms: company laptops sent to US addresses and accessed remotely from abroad. A changed shipping address deserves a question, not an assumption, but it should never pass unnoticed.

Checks that work, in proportion

Build a ladder and climb it as the stakes rise:

1. Ask specific, verifiable questions early. Real experience produces specific answers: names of systems, numbers, mistakes, trade-offs.
2. Keep the same structured screening for everyone. Consistency makes outliers visible and keeps the process fair.
3. Insist on video for at least one live conversation, and ask the candidate to do something unscripted, such as share their screen and walk through their own past work.
4. Verify identity at offer stage with documents matched to the person you interviewed, using a lawful, consistent process.
5. Check references by calling numbers you find independently, not the numbers on the CV.
6. For sensitive roles, hold one step in person.

One warning. Do not reach for software that claims to read "nervousness" or "deception" from faces. Beyond being unreliable, emotion recognition in the workplace has been banned under the EU AI Act since February 2025, and the Commission's guidance reads that to include candidates in the hiring process. Judge what people know and can do, not how they look while saying it.

How MetaDay handles this

At MetaDay, our AI recruiter runs the operational side of hiring: sourcing, outreach, follow-ups, screening calls, interviews and scheduling, inside boundaries the company approves. That matters for fraud in two ways.

First, every candidate gets the same structured conversation, so the hiring team is comparing like with like, and a profile that sounds perfect on paper but thin in conversation stands out against the others. Second, it gives the team its time back for the part where fraud is hardest to hide. The run hands over a ranked top three, and the final interview and the decision stay with people. That is the moment for live, unscripted questions and identity checks.

We also hold ourselves to the standard we ask of candidates. Every candidate is told they are speaking with an AI and can choose to speak with the team instead. Honesty should run in both directions.

FAQ

Is using ChatGPT to write a CV considered candidate fraud?

No. Using AI to describe real experience is assistance. Fraud is inventing experience, qualifications or identity, or having someone else take the interview.

What are the most common signs of a deepfake candidate?

Lip movements that do not match the audio, unnatural facial movement, refusing video, and answers that lose all detail when you ask a specific follow-up question.

How do I verify a remote candidate's identity?

Match identity documents to the person you interviewed at offer stage, call references on independently found numbers, and hold at least one live, unscripted video or in-person conversation.

Fraud thrives on rushed, inconsistent hiring, and a calm, consistent process is the strongest defence you have.