For most of the last decade, hiring risk meant a candidate who exaggerated their experience. Today it increasingly means a candidate who does not exist, or one who is not the person on the video call. Generative AI makes it cheap to fabricate a CV, a profile, a portfolio and even a live face and voice.

Gartner predicts that by 2028 one in four candidate profiles worldwide will be fake. In a Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, either posing as someone else or having someone else interview for them. And the experience of hiring managers suggests the problem is already common: in Checkr's 2026 Hiring Hoax survey of 3,000 US managers, 40% said they had interviewed a candidate later revealed to be using a fake identity, up from 31% a year earlier.

Why this is a CTO problem, not only an HR problem

Technology roles are the most attractive target. They are often remote, well paid and come with access to code, infrastructure, customer data and production systems from the first week. A fraudulent hire in finance might steal a salary. A fraudulent hire in engineering can copy source code, plant malicious changes or open a route for a wider attack.

That makes candidate verification part of your security model. The question is not only "can this person do the job?" but "are we sure who we are giving access to, and what can they reach on day one?"

Warning signs during hiring

• Video that lags or blurs when the candidate turns their head, or a reluctance to turn the camera on at all.
• Answers that sound fluent but generic, with long pauses before technical follow-up questions.
• A LinkedIn profile that is new, thin or inconsistent with the CV, and references that are hard to reach.
• Requests to send equipment to a different address from the one on file, or to be paid into an unusual account.
• A noticeable change in skill, voice or behaviour between the interview and the first weeks of work.

Five layers of protection

1. Verify identity before the final interview. Check government ID against a live selfie through an identity verification service, and confirm the details match the CV and the right-to-work documents.

2. Make technical assessment live and interactive. Pair programming, whiteboard design sessions and follow-up questions on the candidate's own past work are much harder to fake than a take-home test.

3. Add an in-person or verified final stage for sensitive roles. For roles with production or data access, meet in person, or use a verified video stage with an identity check at the start.

4. Design day-one access for least privilege. New starters should get the access they need for their first tasks, not everything. Use managed devices, monitor unusual activity and widen access as trust is established.

5. Use partners who vet properly. If you use agencies or contractors, ask how they verify identity, check references and assess skills, and make those checks part of the contract.

If you suspect a fraudulent hire

Act quickly but calmly. Restrict the person's access to systems and data while you check, so any damage is contained. Preserve logs and records of interviews, documents and device activity. Verify identity again through an independent route, such as an in-person meeting or a fresh identity check. Involve your security, legal and HR teams together, and review how the person passed your process so the gap can be closed for the next hire.

Questions to ask your hiring partners

• How do you verify a candidate's identity, and at which stage?
• Do you run live technical assessments, and who conducts them?
• How do you check that the person interviewed is the person who starts?
• What happens if a placed candidate turns out not to be who they claimed?

Balance security with candidate experience

Good candidates rarely mind proving who they are if the process is clear and respectful. Explain why checks exist, keep them quick and do them once. Gartner found that 62% of candidates said they were more likely to apply for a role that required in-person interviews, a sign that honest applicants value a process they can trust.