How to Spot Fake Candidates in Tech Hiring: Red Flags, Verification and Best Practices

Fake candidates are applicants who misrepresent their identity, experience or work in a hiring process, and remote technical hiring makes them harder to catch. A polished resume and a confident video interview no longer prove that the person applying is the person who will do the job.

The consequences go beyond a bad hire. In a case sentenced in July 2025, the U.S. Department of Justice reported that a fraud scheme helped North Korean IT workers obtain remote jobs at more than 300 U.S. companies, generating more than $17 million in illicit revenue. The scheme relied on stolen identities, U.S.-based facilitators and company laptops hosted at a "laptop farm" so the workers appeared to be in the United States. A candidate hired under a false identity can also reach source code, customer data and cloud systems, which can turn a hiring mistake into a security incident.

State-backed schemes are only part of the picture. Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. Gartner has clarified that the prediction concerns material identity misrepresentation. Separately, AI tools can be used to generate convincing answers, alter video and audio, and build professional-looking digital profiles.

That does not mean recruiters should treat every unusual candidate as a fake candidate. A nervous interviewee, a thin online presence or a dropped video call is not a red flag on its own. What employers need is a process that checks several independent pieces of evidence, including identity, employment history, technical knowledge, project experience, credentials and consistency across the hiring process.

This guide explains what fake candidates are, how they exploit remote hiring, which warning signs to watch for, and which practical checks catch them without making recruitment unnecessarily complicated. You will also find interview questions and a step-by-step verification process that hiring teams can apply at each stage.

What Is a Fake Candidate?

A fake candidate is an applicant who materially misrepresents their identity, qualifications, employment history, technical experience or participation in a hiring process. Identity impersonation is a particularly serious form of candidate fraud, while other inaccuracies must be assessed according to their significance and context.

This can include:

• Using a fabricated or stolen identity

• Misrepresenting employment history

• Materially misrepresenting technical experience

• Using a proxy to participate in an interview

• Using undisclosed AI assistance in violation of assessment rules

• Using deepfake or face-swapping technology

• Presenting someone else's work as their own

• Providing inaccurate credentials or references

Not every inaccurate resume, use of AI or unusual interview behaviour indicates fraud. The purpose of candidate verification is to establish facts through reasonable, independent checks.

How to Spot Fake Candidates in Tech Hiring?

Identifying fake candidates requires a structured approach that goes beyond reviewing resumes and evaluating interview performance. Candidates who misrepresent their identities, qualifications, or professional experience may provide convincing applications, particularly when AI-generated content, proxy interviews, or manipulated digital identities are involved.

Employers can reduce these risks by combining identity verification, employment history checks, technical assessments, and consistent screening procedures. The objective is not to label candidates as fraudulent based on isolated warning signs but to identify inconsistencies that can be independently verified.

1. Review Candidate Information for Inconsistencies

The first step is to examine the information provided throughout the recruitment process. Resumes, applications, professional profiles, and interview responses should present a reasonably consistent account of the candidate's experience and qualifications.

Recruiters should pay particular attention to:

• Employment dates and job titles

• Educational qualifications and certifications

• Technical skills and project experience

• Professional profiles and contact information

• Responsibilities claimed during interviews

For example, a candidate may describe leading a major software development project during an interview while listing a substantially different level of responsibility on their resume.

Such discrepancies do not necessarily indicate fraud, but they provide a reason to seek clarification and verify the relevant information.

2. Evaluate Technical Knowledge and Claimed Experience

Technical interviews help employers determine whether candidates possess the knowledge and practical experience described in their applications. Candidates should be able to discuss their responsibilities, explain technical decisions, and describe how they approached challenges in previous projects.

Recruiters can assess technical knowledge by:

• Asking candidates to explain their contributions to specific projects

• Discussing why particular technologies or approaches were selected

• Exploring challenges encountered during development or deployment

• Introducing changes to technical scenarios

• Using practical assessments relevant to the position

For example, a candidate claiming experience in cloud infrastructure may be asked to explain how they handled a deployment issue, why they selected a particular configuration, and what they would change if the system needed to support more users.

These questions help assess practical understanding rather than memorized answers. However, difficulty answering a question does not automatically indicate misrepresentation, and interviewers should consider the candidate's overall performance and relevant experience.

3. Verify Identity and Professional Credentials

Identity and credential verification help employers confirm whether candidates are who they claim to be and possess the qualifications required for a position. These checks are particularly important for remote technical roles involving access to sensitive information or organizational systems.

Depending on the position, employers may verify:

• Government-issued identity documents

• Previous employment and job titles

• Educational qualifications

• Professional certifications

• References and relevant professional achievements

For example, if a candidate claims to have completed a professional certification, recruiters can confirm its validity through the issuing organization or an authorized verification service rather than relying solely on a submitted certificate.

Independent verification helps establish the credibility of important claims. However, organizations should collect only the information necessary for the hiring decision and follow applicable privacy and employment requirements.

4. Identify Potential Interview Manipulation

Remote interviews can create opportunities for candidates to misrepresent their identity or abilities through proxy participation, unauthorized AI assistance, or manipulated video and audio. Recruiters should therefore consider whether the information provided during interviews remains consistent with earlier stages of the hiring process.

Potential concerns that may require further verification include:

• Significant differences in claimed experience across interview stages

• Inconsistencies between verified identity information and interview participants

• Difficulty explaining previously submitted technical work

• Evidence of unauthorized assistance during assessments

• Unexplained discrepancies in identity documents or candidate information

For example, a candidate may submit a detailed technical assessment but struggle to explain the reasoning behind important decisions when discussing the same work during a live interview.

Such inconsistencies may justify additional questions, but they are not proof of fraud. Recruiters should avoid relying on facial expressions, speaking patterns, video quality, or nervousness as indicators of deception.

5. Maintain Verification Throughout the Hiring Process

Candidate verification should continue beyond initial screening and interviews. Information collected during recruitment should remain reasonably consistent through the offer and onboarding stages, particularly when employees will receive equipment or access to sensitive business systems.

Employers should review important onboarding details, including:

• Identity information provided during verification

• Contact details and residential addresses

• Company equipment delivery arrangements

• Payment and banking information

• Requests for system access or account privileges

For example, a remote candidate may request that company equipment be shipped to an address different from the one previously provided. Rather than treating the request as suspicious by default, the employer should confirm the change through an established verification process.

Maintaining these checks helps organizations confirm that the person who completed recruitment is the same individual receiving company resources and performing the assigned work.

6. Document Findings and Apply Consistent Decisions

When recruiters identify potential signs of misrepresentation, they should document objective discrepancies and verify the relevant details before making decisions. A consistent process helps organizations investigate genuine concerns while reducing the risk of unfairly rejecting legitimate candidates.

Recruiters should follow these steps when concerns arise:

• Record specific inconsistencies in candidate information

• Compare findings with earlier applications and interview notes

• Give candidates an opportunity to explain discrepancies

• Independently verify relevant employment or credential claims

• Escalate serious concerns to appropriate HR, compliance, or security personnel

For example, if a candidate provides conflicting employment dates, the recruiter should document both versions, ask for clarification, and verify the details through an appropriate source when necessary.

Technology can support this process by identifying inconsistencies and assisting with verification. However, automated results should be reviewed by qualified personnel rather than treated as definitive evidence of fraud.

Identifying fake candidates depends on combining multiple verification methods rather than relying on a single warning sign. A consistent, evidence-based approach helps employers identify potential misrepresentation while maintaining a fair and reliable recruitment process.

Why Are Fake Candidates Targeting Tech Jobs?

Fake candidates can appear in almost any hiring process, but technical roles can be a particular target because they often combine remote work, valuable access and specialized skills. Two factors explain most of the appeal.

1. Technical Roles Offer Valuable Access

A technology job gives a fake candidate more than a paycheck. It can also provide access to sensitive resources that are hard to reach from outside the company.

A technical hire may receive access to:

• Company systems

• Source code

• Customer information

• Cloud environments

• Internal tools

A fake candidate who passes the hiring process gains trusted access from inside the organization.

2. Remote Work Makes Identity Harder to Verify

A traditional hiring process creates several natural opportunities to confirm who a candidate is. When recruiting, interviews, assessments and onboarding all happen online, employers have fewer chances to verify identity in person. The FBI has documented North Korean IT worker schemes involving fraudulent identities, proxy participation in interviews, remote access to company systems and AI or face-swapping technology during video interviews.

Remote hiring removes checkpoints that once happened naturally:

• An office visit

• An in-person interview

• Physical identification

• Direct interaction with future colleagues

Remote hiring is not inherently unsafe. It means identity verification has to be designed into the process rather than assumed. For higher-risk technical positions, that may mean verifying identity at more than one stage.

The Risk Goes Beyond Getting the Wrong Hire

Hiring someone who cannot perform the role has obvious costs, including wasted salary, additional recruitment and lost productivity. In technical roles, the exposure can be larger, because a hire with access to internal systems can turn a hiring mistake into a security incident.

The North Korean IT worker case described in the introduction involved 309 U.S. businesses and company-provided laptops hosted in the United States to make overseas workers appear to be working domestically. It shows how remote employment can be combined with identity fraud and access to company systems. Cases like this are one documented pattern, not a description of every fake candidate, but they show why the interview deserves close attention. It is often where a false identity or an inflated skill set first becomes visible.

How Do Fake Candidates Cheat in Video Interviews?

Video interviews are a useful way to assess communication and technical knowledge, but they also create new ways to misrepresent yourself. A candidate may receive real-time help from another person or an AI tool, use a proxy interviewer, or manipulate their video and audio.

One unusual behaviour does not prove that an interview is fraudulent. Poor internet quality, nervousness, background noise or unfamiliarity with video calls can all produce strange-looking interactions. Recruiters should look for several signals and verify concerns through additional steps.

1. Proxy Interviews

A proxy interview occurs when someone other than the actual candidate takes part in an interview on their behalf. It is hard to spot when the proxy has the candidate's resume and has prepared for the same questions, and the interview may look normal at first, especially during a structured screening call.

Proxy interviews are easiest to carry out when:

• The proxy has the candidate's resume and the likely questions

• The interview follows a predictable, scripted format

• Identity is checked only at the application stage

• A different person completes the later stages or the work

Follow-up questions about personal experience, covered in the technical interview section below, can help assess whether the person on screen understands the work described. They should be combined with appropriate identity checks.

2. AI-Assisted Interview Answers

Generative AI creates another challenge. Candidates may use AI tools to generate answers, solve technical questions or get real-time help during an assessment. The issue is not simply whether a candidate has used AI, since many legitimate professionals use it as part of their normal work. The concern arises when undisclosed help lets a candidate present capabilities they cannot demonstrate independently, in an assessment meant to measure exactly those capabilities.

Employers can reduce the risk by:

• Stating clearly whether AI tools are allowed in each assessment

• Testing applied reasoning rather than definitions

• Comparing written or take-home work with how the candidate discusses it live

Definitions are easy to look up or generate. Explaining and defending a choice in a live conversation is much harder to do with outside help.

3. Deepfake and Identity Manipulation

AI-generated video and face-swapping technology can make traditional visual identity checks less reliable. The FBI has warned that North Korean IT workers have been observed using AI and face-swapping technology during video job interviews to hide their true identities. This does not mean recruiters should try to decide whether someone is a deepfake just by looking at their face.

Instead, the FBI recommends several identity checks that do not depend on appearance:

• Scrutinize identity documents

• Cross-reference photographs and contact information

• Capture images of candidates so they can be compared with later meetings

No single check is enough on its own, so identity should be confirmed through several signals. Where candidate images or identification documents are collected, organizations should provide appropriate notice, limit collection to what is necessary, secure the information and follow applicable privacy and employment laws.

4. Change the Interview Pattern

Proxies, AI assistance and face-swapping all depend on a predictable interview. One practical defence is to use varied, job-relevant questions that test understanding rather than memorization. Recruiters can:

• Change an assumption in a scenario and ask how the solution would change.

• Return to an earlier answer later in the conversation and ask for more detail.

• Vary the order and wording of questions so answers cannot be prepared in advance.

These questions do not need to be traps. The goal is to find out whether the candidate understands the work they are describing and can reason through unfamiliar variations.

5. Do Not Confuse Nervousness With Fraud

Not every unusual behaviour is evidence of fraud. Interviews are stressful, and ordinary behaviour can look suspicious on a video call. A genuine candidate may:

• Pause before answering

• Look away from the screen

• Have connection problems

• Use an unusual resume format

• Communicate differently from what the recruiter expected

The goal is to identify inconsistencies that can be verified, such as two different employment dates, not to judge how nervous someone appears.

How Should Employers Verify Candidate Identity?

Candidate verification should not be a single event. The strongest approach is to create several reasonable opportunities to confirm that the person who applied, the person who interviewed and the person who eventually works for the organization are the same person.

1. Verify Identity at the Right Stage

Identity verification can be introduced at different points depending on the sensitivity of the role. For higher-risk positions, employers may need to verify identity at several stages instead of relying only on the information submitted in the application:

• During interviewing

• During onboarding

• Throughout employment

The FBI recommends identity verification at these stages for organizations concerned about North Korean IT worker schemes. NIST's identity-proofing guidance also emphasizes establishing evidence that reliably identifies an applicant before assigning an appropriate level of identity assurance. Roles involving greater access or higher consequences may justify stronger evidence, subject to applicable legal and privacy requirements.

2. Compare Information Across the Hiring Process

Information should stay reasonably consistent from application to onboarding. Recruiters can compare:

• Resume details

• Application information

• Interview responses

• Employment dates

• Education history

• Contact information

• References

• Identity documents

• Onboarding information

• Equipment and system-access details

A single discrepancy may have an innocent explanation. Several unexplained discrepancies across different stages deserve closer examination.

3. Verify Credentials Independently

Where credentials matter to the role, employers can verify them independently rather than relying only on documents the candidate supplies. The credentials most worth checking include:

• Degrees

• Certifications

• Previous employers

• Professional achievements

Employers should verify prior employment and higher education history directly with the relevant businesses and educational institutions, as the FBI recommends, using contact details they have found independently.

4. Verify Before Granting Sensitive Access

Verification should not stop once an offer has been accepted. A new hire who receives access to source code, cloud infrastructure, customer information or internal systems may carry a much higher security risk than someone who has only completed an application. Organizations should confirm that the verified candidate is the person receiving company equipment, credentials and system access.

This matters most in fully remote environments, where equipment is often shipped directly to employees. The FBI advises that employers:

• Send work equipment to the address listed on the employee’s identification documents, or verify an alternative address with additional documentation.

• Complete relevant background checks before granting system access.

These are recommendations from the FBI for addressing North Korean IT worker schemes, not universal legal requirements for all hiring. Employers should apply them in accordance with local laws and their own risk-based policies. Requests to change a delivery address after an offer should prompt verification rather than automatic rejection.

What Are the 10 Red Flags of a Fake Candidate?

No single red flag proves fraud, but a cluster of them is a strong reason to verify. Treat each of the following signals as a prompt for further checks:

1. Vague Technical Experience

A candidate may list several technologies or projects without being able to explain what they actually did. Look for specific explanations of responsibilities, decisions and outcomes rather than broad statements.

2. Conflicting Employment History

Employment dates, job titles or company names may differ between the resume, LinkedIn profile, application and interview. Investigate the discrepancy rather than treating it as immediate proof of fraud.

3. Unverifiable Credentials

Degrees, certifications, employment claims or references may be difficult to confirm through independent sources. Where the credential matters to the role, verify it directly.

4. Inconsistent Professional Profiles

The resume, LinkedIn profile, portfolio and other accounts may contain conflicting information. Differences in dates, job titles, locations or project descriptions are useful signals for further verification.

5. Cannot Explain Claimed Projects

A candidate may list impressive projects but struggle to describe their own contribution. Ask detailed questions about the decisions they made and the problems they encountered.

6. Changes in Communication Across Stages

A significant shift in communication style, technical depth or familiarity with their own background can warrant additional questions. Differences in communication alone are not proof of fraud.

7. Proxy Interview Indicators

A candidate may seem unusually dependent on prepared answers or struggle with questions about their personal experience. Unexpected follow-up questions can show whether the person participating understands the experience being described.

8. Undisclosed AI Assistance

A candidate may rely on AI to generate answers in an assessment that is meant to evaluate independent reasoning. The key concern is whether the help breaks the rules of the assessment or lets the candidate misrepresent their abilities.

9. Potential Identity Manipulation

Unusual identity documents, inconsistent photographs, unexplained location changes or other identity discrepancies may require further verification. Stolen identities and AI-based face manipulation have both been seen in remote IT hiring schemes.

10. Inconsistencies During Onboarding

Information that changes after the offer, such as address, payment details or equipment arrangements, is another chance to verify. Identity checks should continue through onboarding and remote employment rather than ending after one check.

A Better Way to Use Resume Red Flags

Resume red flags should be treated as starting points for verification, not as automatic evidence of fraud. A candidate may have a short employment gap, an unusual career path or a different job title on LinkedIn. These things can have legitimate explanations.

The useful question is not "Does this candidate look fake?" It is "Is there an objective inconsistency that I can verify?" That distinction helps recruiters investigate genuine concerns without rejecting legitimate candidates. Once a resume raises a question, the technical conversation is where most of those questions get answered.

Why Technical Claims Need More Than a Resume Check

A resume lists programming languages, frameworks, cloud platforms and major projects. It does not show who made the decisions, who fixed what broke or how much of the work belonged to the candidate. That is why a candidate can list impressive experience without having personally done the work described.

Technical verification should therefore focus on the candidate's understanding of their own experience. The next section shows how to test that in an interview.

How to Catch a Fake Candidate During a Technical Interview

The technical interview is an important opportunity to assess whether a candidate understands the work described on their resume. The objective is not to create a stressful puzzle. It is to understand how the candidate thinks and whether they can explain their own experience.

1. Ask About Specific Experiences

Instead of asking only general technical questions, ask about situations the candidate has personally encountered. For example:

• "What was the hardest technical problem you faced on this project?"

• "Why did you choose this approach instead of the alternative?"

• "What broke when you deployed it?"

• "What part of the project did you personally build?"

• "If you had to redesign this today, what would you change?"

These questions help interviewers assess whether the candidate understands the underlying work, especially when the answers are evaluated consistently and in context.

2. Ask the Candidate to Explain Their Own Work

Candidates should be able to explain their projects at different levels of detail. A strong follow-up is to ask them to explain the same technical decision twice:

• First to another engineer, with the technical detail the decision involved

• Then to a non-technical manager, in simple language

This can provide additional insight into the candidate’s understanding, while allowing for differences in communication style.

3. Use Live Problem Solving Where It Makes Sense

A practical exercise can provide additional evidence of technical ability. A good exercise has these qualities:

• It resembles the actual work as closely as possible.

• It cannot be answered by copying from a resume.

• It lets you watch how the candidate approaches a problem, not just the final answer.

How To Build Layers of Protection Into the Hiring Process?

No single verification method can reliably identify every fake candidate. A candidate could pass a resume screen but fail a technical interview. Someone could perform well in an interview but have an identity discrepancy during verification. Another candidate could have a legitimate identity but misrepresent their technical experience.

That is why a layered process works better than a single detection signal. A practical hiring process could look like this:

1. Application Stage

Check for inconsistencies in employment history, qualifications, contact details and professional information, and compare the resume with the application form and LinkedIn profile. Early discrepancies are easy to resolve with a simple question but harder to untangle after an offer.

2. Recruiter Screen

Ask specific questions about recent roles and projects instead of confirming the resume, such as what the candidate built in their last role. Look for relevant detail and consistent explanations, while allowing candidates time to recall specifics and clarify their responses.

3. Technical Interview

Test reasoning, technical depth and the ability to adapt when assumptions change. Ask why the candidate chose one approach over another, not just what they chose.

4. Identity Verification

Confirm identity at an appropriate stage, particularly for higher-risk positions. Decide in advance which stage triggers the check so every candidate for the role is treated the same way.

5. Reference Checks

Verify important employment and performance claims through sources you have identified independently. Ask references about specific projects and responsibilities so you can compare their answers with the candidate's.

6. Final Interview

Revisit significant claims from earlier conversations and compare the new answers with your interview notes. If details have changed, give the candidate a chance to explain before drawing any conclusion.

7. Onboarding

Confirm that the verified person is the person receiving company equipment, credentials and system access, and that delivery and payment details match what was gathered during hiring.

This approach also helps avoid false positives. A candidate should not be rejected merely because they have a weak online presence, speak with an accent, use an unusual resume format or experience technical problems during a video interview. The decision should rest on evidence relevant to the hiring requirements, with consistent procedures and an opportunity for candidates to explain discrepancies.

What Should Recruiters Do When They Spot Multiple Red Flags?

Spotting several red flags in one candidate puts a recruiter in an uncomfortable position. Act too quickly and you may reject a genuine candidate over a simple misunderstanding. Wait too long and a fraudulent hire could reach company systems. A clear, repeatable response removes the guesswork, and the steps below show what to do when the signals start to add up:

1. Document What You Observed

Record the specific discrepancy, with the dates, the source of each version and where you saw it. For example: "The candidate stated they worked at Company X from 2021 to 2024, but their application lists 2022 to 2024." That is useful. "The candidate seemed fake" is not, because nobody can check it.

2. Ask the Candidate for Clarification

Give them a chance to explain the discrepancy before you draw conclusions. Ask a neutral question, such as "Can you help me understand the dates on your application?", and avoid wording that sounds like an accusation.

3. Compare With Earlier Materials

Check the answer against the application, resume and earlier interview notes. Notes from earlier interviews are most useful here, because they show what the candidate said before anyone raised a concern.

4. Verify the Relevant Details

Confirm the credential or employment detail through a normal verification step where appropriate. Contact the employer or institution directly, using details you found independently, and keep the check limited to the specific claim in question.

5. Escalate Serious Cases

Involve the appropriate security, legal, compliance or HR stakeholders rather than investigating alone. This applies when the evidence points to identity fraud or a possible security risk, not to a simple resume error.

This approach protects legitimate candidates as well as the organization. The goal is to establish facts, not to turn recruiters into fraud investigators.

The Future of Candidate Verification Is Not Just About Detecting Deepfakes

Deepfakes and generative AI will keep making digital impersonation harder to identify through visual inspection alone. Hiring teams will need to move away from the idea that there is one perfect test for candidate authenticity.

Identity verification, technical assessment, interview behaviour, reference checks and access controls each answer a different part of the problem. Together, the process should establish:

• Whether the person applying is the same person interviewing

• Whether the candidate actually worked on the projects they describe

• Whether they have the technical knowledge the role requires

• Whether their information stays reasonably consistent throughout the hiring process

These questions become much harder to manipulate when they are assessed independently. NIST's 2025 Digital Identity Guidelines offer a framework covering identity proofing, authentication and related digital identity processes. For recruiters, candidate verification is now part of the overall security of a remote hiring process.

Conclusion

Fake candidates are getting harder to spot because the tools used to create convincing digital identities are easier to access. A polished resume can be generated in minutes. Technical answers can be produced on demand. Interviews can be manipulated through proxy participants or AI assistance, and deepfake technology can make visual identity checks less reliable.

That does not mean hiring teams need to make recruitment complicated. The strongest approach is to create several reasonable opportunities for verification. Look for inconsistencies before the interview, and ask candidates to explain the work they claim to have done. Use follow-up questions that require reasoning rather than memorized answers, and add practical technical exercises where appropriate. Verify identity for roles where the risk justifies it, and recheck important information before granting access to sensitive systems.

Most importantly, treat red flags as signals to investigate, not automatic proof of fraud. The central question in remote technical hiring is whether the organization can establish, through reasonable and independent checks, that the person who applied, the person who interviewed and the person who will do the work are the same person with the skills and experience they claim. A layered verification process makes that much easier to establish.