How to spot a fake job candidate.

A fake job candidate is an applicant who is not the person they claim to be, or who is not a single real person at all. The term covers several different things: someone applying under a stolen identity, a profile built from invented details, a stand-in who takes the interview on someone else's behalf, and an organized operation that runs many applications from one place.

The problem is real but easy to overstate. In a Gartner survey of 3,000 job candidates, 6% admitted to participating in interview fraud, either posing as someone else or having someone else pose as them1. Looking ahead, Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake1. That is a forecast, and it means the other profiles in your pipeline are, and will remain, genuine people looking for work.

Hiring managers are seeing it more often. In Checkr's 2026 survey of 3,000 US managers involved in hiring, 40% said they had personally interviewed a candidate later revealed to be using a fake identity, up from 31% in 2025, and 86% said their organization experienced at least one type of hiring fraud in the past year2. Only 23% were extremely confident their process would catch a fraudulent candidate2.

The stakes are highest for remote roles with access to systems and data. US authorities have described North Korean IT workers using stolen and fake identities to get remote jobs at more than 100 US companies3. Our guide to North Korean IT worker schemes covers that threat in detail.

The earliest signals often come from the application itself and the way it was submitted. None of these proves anything on its own. Treat each as a reason to look more closely.

• Shared contact details. The same phone number or email address appears on applications from people with different names. The FBI recommends cross-checking HR systems for other applicants with the same résumé content or contact information, and notes that North Korean IT workers have reused phone numbers4.
• Near-identical résumés. Two or more applicants submit résumés with the same wording, structure and project descriptions, with only the name changed.
• Details that do not line up. Name spelling, claimed location, contact information, education and work history differ between the résumé, professional profiles and portfolio sites. US government guidance lists these inconsistencies as red flags5.
• Very thin online presence. The same guidance flags surprisingly simple portfolio websites and profiles5. Many genuine candidates keep a low profile, so weigh this lightly.
• Technical signals at submission. A form completed in a few seconds, a disposable email address, or a connection through a hosting provider or VPN can point to automation or an attempt to hide location. These are known as passive signals. Plenty of genuine people use a VPN for work or privacy, so these only matter in combination.

The FBI also suggests checking résumés for typos and unusual nomenclature4. Use that with care: spelling mistakes are common in genuine applications, and a typo should never count against a candidate on its own.

Video interviews are where proxy and impersonation attempts usually surface. In 2022 the FBI reported complaints about applicants using deepfakes and stolen personal information to apply for remote roles. Interviewers noticed that the lip movement of the person on camera did not fully match the audio, and that coughing or sneezing did not line up with what was shown6. In the same reports, background checks found that some applicants had given personal information belonging to another person6.

Other things worth noting include:

• The person on camera looks or sounds different from the person in an earlier round or the phone screen.
• Repeated refusal to join video calls, or a strong preference for text chat. US guidance on North Korean IT workers notes their preference for text-based chat over video5.
• Answers that arrive after a consistent delay, as if relayed by someone off camera, together with an inability to discuss the details of work listed on the résumé.
• Vague or shifting answers to simple questions about where they live, studied or worked. The FBI suggests using soft interview questions about location and education background4.

Poor connections, old cameras, nerves and background noise produce many of the same effects. Our guide to deepfake and proxy interviews explains why judging by eye is unreliable and what to do instead.

Fraud does not always end at the interview. Some of the clearest signals appear during onboarding, when equipment and pay are set up.

• A request to ship a work laptop to an address that is not on the person's identity documents, especially with a claim that they cannot receive items at that address5.
• Changes to address or payment details during onboarding, which the FBI asks HR staff to watch for specifically4.
• Requests to be paid in virtual currency5.
• Someone different from the interviewed candidate appearing on the first day, or a new hire who cannot be reached during working hours.

The address and laptop signals connect to laptop farms, where company laptops are hosted in one location so remote workers elsewhere can appear to be in the country. In October 2026 the US Justice Department announced actions against more than 40 suspected laptop farms in Texas, linked to a scheme that affected more than 70 US companies. The people involved face charges that have not been proven in court7.

A fraud process that leans on stereotypes will reject good people and still miss organized fraud. The following are not signs of a fake candidate and should play no part in a fraud review:

• An accent, or English as a second language.
• A name, nationality or country of origin. The red flag in government guidance is details that contradict each other, which says nothing about where someone is from.
• Gaps in employment, career changes or a short work history.
• A disability, an assistive technology, or a reason for wanting the camera off.
• A modest online presence on its own.

This is also a legal question. US equal employment guidance notes that an accent can reflect where a person lived or what language they grew up speaking, and says an employment decision can legitimately rest on accent only when it interferes materially with job performance8.

Treat a warning sign as a reason to verify. Apply the same checks to every candidate at the same stage, and let a trained person make the decision.

Spotting fraud by instinct is unreliable and unfair. A written process applied to everyone works better. The FBI recommends identity verification during interviewing, onboarding and throughout the employment of any remote worker4. Many teams start later than that: only 29% of companies verify identity as soon as someone applies, and 49% wait until after at least one live interview2.

1. Decide where checks happen. Look at passive signals at application, verify identity before the first live interview for shortlisted candidates, and confirm it is the same person before the final interview and on day one.
2. Verify identity, separately from background. A background check reports on a person's history. Identity verification confirms that the applicant is the person they claim to be, which is how NIST describes the purpose of identity proofing9.
3. Check claims at the source. Confirm past employment and education using contact details you find yourself through a search engine or business database, rather than those on the résumé5.
4. Send flags to a person. Route anything unusual to a reviewer who sees the reason, can ask the candidate for more information, and records the decision. Avoid automatic rejection.
5. Offer an alternative. Some candidates cannot or will not complete a camera-based check. Give them another route, such as a document review by a person, and make clear that choosing it does not count against them.
6. Train the team. Brief recruiters and interviewers on what to look for and what to ignore, and on how to escalate without confronting a candidate mid-interview.
7. Report suspected fraud. The FBI asks companies to report suspected schemes to ic3.gov, including any IP addresses, email addresses, phone numbers or names used6.

Do as much of the process in person as is practical for the role; the FBI recommends it where possible4. For fully remote hiring, the checks above do the same job at a distance.

Elsin follows the same principles. It reads passive signals at application, such as a hosting or VPN network, a disposable email, an impossibly fast form fill, or a device, phone or near-identical résumé shared with other applicants. Shortlisted candidates check their ID and face on their own phone, and a quick re-check before the interview and on day one confirms it is the same person. Nobody is rejected automatically: a signal sends the application to a human review queue with the reason written out, and the result is written back to Greenhouse or Ashby as a tag and a note.