AI Deepfake Job Candidate Scam

This scam targets employers rather than individual consumers. A remote job applicant applies with a polished CV, a professional-looking photo, and strong references. During video interviews, the applicant is actually a different person than the one who will do the job — or in more advanced cases, a real-time AI face filter and voice modulation tool are used so the person on camera does not match the person who eventually shows up to work, or does not exist as presented at all.

The goal varies. Some operations are simple identity fraud: a skilled but sanctioned, unauthorised, or otherwise ineligible worker uses a fabricated identity to get hired, often for remote IT, developer, or customer-support roles where no in-person meeting ever happens. Others are more sinister — the 'employee' is a front for a state-linked or criminal operation seeking access to company systems, source code, customer data, or a legitimate payroll relationship that can later be used to launder money.

Because remote hiring has become routine and video interviews are treated as sufficient identity verification, companies — especially fast-growing tech and remote-first employers — have proven especially exposed. The scam is notable because the 'victim' is the hiring organisation, but downstream harm (data breaches, payroll fraud, laundering) can affect customers and employees too.

The fraudulent candidate typically builds a convincing profile on professional networking sites and job boards, sometimes reusing a real person's photo and credentials (harvested from social media or a data breach) or generating an entirely synthetic headshot with AI image tools. A polished, keyword-optimised CV is submitted, often assisted by AI, tailored precisely to the job description.

At interview stage, real-time deepfake or face-swap software is layered over a video call so the face on screen differs from whoever is actually answering questions — sometimes a more experienced person is coaching or literally speaking through a voice changer off-camera. Technical or coding assessments may be completed by a third party entirely. Because interviewers rarely cross-check appearance against a notarised ID document, the mismatch goes unnoticed.

Once hired, the fraudulent employee (or the operation behind them) gains access to laptops, VPN credentials, internal systems, and a payroll relationship. Some cases end quickly, with the 'employee' collecting a paycheck for equipment never fully used, or requesting the company-issued laptop be shipped to a residential address that is actually a mail-forwarding or drop location. More serious cases involve the operation retaining access for as long as possible to exfiltrate source code, customer data, or credentials, or to launder salary payments through the arrangement.

Fast-moving remote hiring processes are built for speed and convenience, not adversarial identity verification. Recruiters and hiring managers are trained to assess skills and cultural fit, not to detect deepfake video artefacts, and most have never been told this is even a risk category to consider.

The scam also exploits trust transference: once a candidate passes a technical interview, subsequent steps (reference checks, onboarding, IT provisioning) treat that early trust as established fact rather than re-verifying it. Global remote hiring, distributed teams, and video-first culture mean an employer may never meet a hire in person during the entire employment relationship, removing the natural friction that used to catch impersonation.

Apologies, my camera keeps glitching — can we just do this interview with audio only?

I'd prefer not to use the identity verification link, can I just send a photo of my ID instead?

Please ship my laptop to [address] — I'm relocating there next week for a family matter.

I can start immediately and would prefer payment via [cryptocurrency wallet] for tax reasons.

Sorry for the delay responding, I was having connectivity issues during our last call.

Require a live, unscripted moment during interviews that is hard to fake in real time — ask the candidate to turn their head fully to profile, hold up a hand in front of their face, or follow an unexpected instruction mid-sentence; current face-swap tools often glitch or lag under these conditions. Cross-check the candidate's face and voice consistently across every interview stage, since fraud rings sometimes swap the visible 'face' between rounds.

Verify identity documents against a trusted third-party identity-verification service rather than a photo emailed by the candidate, and confirm that the bank account and shipping address provided at onboarding match the verified identity. For sensitive or highly technical roles, consider a single in-person or notarised video identity check before granting system access, and stagger access provisioning so a new hire cannot reach critical systems in the first days of employment.