How agencies can spot candidate fraud in remote hiring

What candidate fraud looks like in remote hiring

Candidate fraud covers a wide range, from a CV that stretches the truth to a person who is not who they claim to be. For an agency placing remote tech candidates, the cases that hurt most sit at the identity end: someone interviews under another name, a stand-in sits the technical call, or a stolen identity carries a clean background check. A placement like that damages the client relationship long before anyone works out how it happened.

The scale is hard to measure, but the signals point one way. In a Gartner survey of 3,000 job candidates in the second quarter of 2025, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them. Gartner also predicts that by 2028, one in four candidate profiles worldwide will be fake.

Remote technical roles attract the most serious attempts because they pay well and often come with access to code, data and customer systems. The FBI has warned about applicants using deepfakes and stolen personal information to apply for remote IT, programming, database and software jobs. In a later alert, it described North Korean IT workers using AI and face-swapping technology in video interviews to hide who they are. Gartner's Jamie Kohn put the stakes plainly in the firm's announcement: “Candidate fraud creates cybersecurity risks that can be far more serious than making a bad hire.”

Most recruiters will never meet a state-backed operative, though. The everyday patterns are smaller and easier to catch when someone is looking for them:

• Proxy interviews, where the person on the technical call is not the person who starts the job.
• Borrowed or stolen identities, with real personal details that belong to someone else and therefore pass a background check.
• Manipulated video or audio, where lip movement does not match the voice or the face looks altered.
• Recycled contact details, such as one phone number or email address appearing on several CVs under different names.
• Staged references, where the referee is a friend, an accomplice or the candidate writing from another inbox.

Checks at the sourcing stage

The cheapest place to stop a fake candidate is before your recruiter spends an hour on them. Start with consistency: does the work history line up across the CV, the professional profile and what the candidate says on the first call? A profile created recently with a long senior career behind it is a question to ask, not proof of fraud.

Keep a simple duplicate check in your applicant tracking system. The FBI's 2025 guidance tells employers to cross-check HR systems for other applicants with the same resume content or contact details, because the same phone numbers and email addresses have turned up on resumes for supposedly different people. An agency sees far more applicants than a single client does, so it is often better placed to spot that repetition.

Look closely at where the candidate says they live and where their activity suggests they are. A mismatch between the stated location, the hours they reply in and the payment details they offer later deserves a follow-up question. Ask it plainly and note the answer in the candidate file.

Checks at the interview stage

Video interviews are where impersonation usually happens, so treat at least one call as an identity check as well as a skills check. Ask the candidate to keep the camera on, compare the face with the identity document they will later provide, and watch for audio that runs out of step with the lips. The FBI's 2022 alert noted that in some reported interviews, coughs and sneezes did not line up with what appeared on screen.

Ask questions only the real person can answer in detail. Specific projects, the tools a former team used, the place they studied and how a typical working week ran are hard to fake live. The FBI recommends this kind of soft question about location and education, and suggests completing as much of the hiring and onboarding process in person as possible.

Keep the person consistent from stage to stage. If your screening call, the client's technical interview and the final conversation each show a different face, nobody can say the same candidate went through all three. A short check at the start of each call against the photo in your file closes that gap.

References deserve the same scrutiny. In a recent ERE interview, analyst Kyle Lagunas recommended looking up the IP addresses and phone numbers of the people giving references, and said that several references coming from the same IP address is a common giveaway. Call referees on a number you found yourself, at a company you can verify, rather than one the candidate supplied.

Checks at the offer and start date

The offer stage is the last point where the agency still shapes the process. Run identity verification against an official document before the offer, not after the start date, and make sure the name on that document matches the background check, the contract and the payroll details. KnowBe4, a security awareness training company, learned the limits of standard checks in July 2024: a software engineer it hired after four video interviews, a background check and reference checks turned out to be a North Korean IT worker using a stolen US identity.

The company says it caught the new hire only because its security software detected malware loading on the work laptop as soon as it arrived. Two warning signs from that case and from FBI guidance belong on an agency's offer checklist. KnowBe4 names a laptop shipping address that differs from where the person is supposed to live as a red flag, and the FBI tells employers to watch for changes of address or payment platform during onboarding.

Tell the client what you checked and when. A one-page note listing the identity document seen, the date of each verification and who carried it out lets the client pick up where you stopped.

Who owns the check between agency and client

The biggest weakness may be that nobody owns the problem at all. Speaking to ERE about his research, Kyle Lagunas described it this way:

When nobody owns it, you can’t create accountability. You can’t create standards. You can’t get commitment.

In an agency placement the gap is wider, because two organisations can each assume the other did the checking. The FBI's 2025 alert tells employers to verify that third-party staffing firms run robust hiring practices and audit them routinely, so expect clients to ask you to show yours. Agree the split in writing before the first submission, not after a bad start date.

One workable split, to adapt to each client contract, looks like this:

Whatever split you agree, the client still decides what a new hire can reach on day one. KnowBe4 says its new employees start in a highly restricted area with no access to production systems. Rules on background checks and on handling identity documents differ by country, so take the legal side to counsel before you change how you collect documents.

None of this needs an expensive tool to begin. Most of it is habit: a duplicate search, a camera-on identity check, a referee you found yourself and a written note to the client. An agency that can show those habits gives clients one more reason to trust its shortlist.