Experts warn of growing fraud by deceptive jobseekers – and tout benefits of using both human, software detection to verify identities
Despite the surge in people working from home over the past few years, two-thirds of hiring professionals in a recent survey said they support mandatory ‘live-only’ interviews as a way to verify candidate identities.
This shift comes as more organizations report encounters with jobseekers using artificial intelligence tools to misrepresent themselves during recruitment, found Software Finder, through images, videos or audio recordings.
A separate survey by Resume Genius found that 17% of hiring managers in the U.S. have encountered candidates using deepfake technology to alter their video interviews.
Concern about this deception is real and growing, according to Alan Mak, partner and national forensics practice leader at BDO Canada.
“Fraud's always happened, it's always been a risk... for example, with people purporting to be vendors redirecting payments. That used to happen with phone calls, then with emails — and now we see it with deepfakes.”
Growing range of deceptive tools
Ali Dehghantanha, professor and Canada research chair in cybersecurity and threat intelligence at the University of Guelph, agrees that deepfakes have become accessible to a much wider range of people.
“If you have this conversation back in 2022, the deepfake was in the hands of a few adversaries or professionals who knew how to use it; for example, they were mainly used to bypass authentication, when you are talking about criminal groups,” he says.
“And when you have this conversation with the public about these scenarios, they were like, ‘Oh, these are only done by the state-sponsored hacking teams, or those with lots of resources’ or ‘I shouldn't be worried about it, right?’”
But then advanced tools such as ChatGPT became a day-to-day tool available to the public, says Dehghantanha, and the number of deepfakes has expanded significantly.
“So, what we were seeing that in the past requires quite an infrastructure and good programmers to put together a payload now becomes accessible to much lower criminals or even the public. And that has its own consequences.”
The Software Finder survey also found that 72% of hiring professionals in the U.S. have seen or suspected candidates using AI-generated résumés. Other forms of deception are also on the rise, including:
- AI-generated portfolios (51%)
- fake references (42%), fake credentials (39%)
- voice filters (17%)
- face-swapping in video interviews (15%).
Mak notes that the sophistication of these tools means traditional verification methods are no longer enough.
“We said to clients, say, two years ago, ‘Instead of relying on just a phone call or an email, make sure you call them. Get them on screen, look them in the eyeballs, at least virtually, and make sure that the person on the other end is someone you're familiar with,’” he says.
“But now we cannot even be sure of that with the fake videos — they're getting really good, so it’s certainly a concern.”
Overestimating preparedness
Despite the prevalence of AI fraud, the survey reveals that three in four hiring professionals believe they could identify AI-generated content without detection software and 66% are carrying out manual reviews to detect fake credentials or deepfake content, while only 31% are using AI-generated or deepfake detection software
Mak cautions against overconfidence: “I chuckle at that stat, because of two reasons: One is, ultimately, we're all human. And [often] the interviewer fell in love with the candidate and overlooked red flags. So, ultimately, we're people, and we have decision biases, so that's a risk.
“The other is that I think people… underestimate how good technology is but overestimate their skills. I've seen some really good deepfakes.”
As technology evolves, it's a double-edged sword, he says, because it can improve how we do business, but the crooks are always one step ahead: “It's always playing catchup, that's part of the world we live in now.”
Dehghantanha agrees that it’s a “cat-and-mouse game” when it comes to detection software, as the tech may be able to detect anomalies now, but the deepfake software manages to say one step ahead.
Detection software to catch fraud
The detection software to combat deepfake and other AI deception is very good, says Mak, but it’s not foolproof.
Some of the ways in-person interviews can help is by incorporating personal questions or small talk, which can confuse or confound some bots, he says, along with interrupting their responses.
“It may result in an unnatural reset of the conversation, it might stumble. So those are things that you can try to do to catch whether it's a real person at the other end.”
Dehghantanha agrees that it doesn’t hurt to have the tech as another data point helping to combat fraud.
“Even if you are the best skilled person that you think you are, I can bet that in a few years, if not a few months, the AI is going to pass the level that you can detect.”
He gives the example of the academic world where, as a professor, he has seen the detection of AI-generated text becoming very difficult to differentiate from human-generated content.
As a result, he recommends open reporting policies, where people report any concerns about possible fraud, with no harm if they are wrong, and that employers hold regular in-person meetings every few months with remote employees.
“The moment you communicate this to [job] applicants, those who are fake just drop their application,” says Dehghantanha.
Training on deepfake ‘a moving target’
The Software Finder survey also found that only 37% of hiring professionals have received training on AI-driven hiring fraud.
Dehghantanha cautions that the pace of technological change makes training a moving target.
“The field is changing so fast that getting caught up with the technology and giving proper training is difficult... after six months, we find that, okay, other than some basic advice, the rest of the technology and everything else does not work unless we keep updating it.”
Mak says that hands-on, scenario-based training is most effective.
“What's most effective would be real examples that you can show people and then point out to them what they're looking for. That's what really resonates — especially if they fail the test.”
In-person interviews and credential checks
With many hiring professionals supporting live-only interviews and 54% backing stricter credential checks, the Software Finder survey suggests many organizations are rethinking their processes.
BDO Canada, for example, does in-person interviews even for remote positions, says Mak.
“We now expect that at least at one point during the interview process, it's going to be a live interview, just because we've seen firsthand what deepfakes can do, and it's getting kind of scary how good it is.
“I think a year ago it was more obvious. Now, you really have to pay attention to see if the screens are glitching, eyeballs are not connecting, that sort of thing.”
With offices across Canada, the company can facilitate these types of interviews, he says.
“We'll invite them in, we'll say, ‘We want you to at least meet with several of your colleagues, with different partners, different practices to make sure that you're a good fit.’”
Dehghantanha recommends similar measures for sensitive roles: “For anything critical, sensitive, try to make sure that — even if it is down your supply chain — you are bringing them for an in-person interview for in-person checking.”
Stricter credential verification
With more than half of hiring professionals in the Software Finder survey supporting stricter credential verification, Mak stresses the importance of thorough background checks.
“My personal bugaboo has been the lack an in-depth background search that's conducted by many employers. Oftentimes, HR is doing a cursory background check. It might be an internet search, it might be snooping their LinkedIn profile — but given the tools that are available today, it's very easy to create profiles and create at least a handful of glowing references, online reviews, that sort of thing, where it sounds like the candidate is good.”
Mak warns against dismissing discrepancies or irregularities on a person’s resume, saying he’s a lot more vigilant about digging into those to understand them — especially for more senior roles.
“If someone says they went to the school in this program, then we do our check, get transcripts or contact someone at the registrar's office. But if it doesn't check out, we have to figure out why.
“I can think of two instances where it didn't make sense and we confirmed that the candidate had misrepresented their experience.”
Personal referrals, once a gold standard, are now also under scrutiny, he says.
“I'm wary of fake referrals with fake personas. I've heard about them, I've read about them, but that's one of the risks that we have now.”
HR’s role in combatting deepfakes
Overall, responsibility for combating AI fraud must be shared across the organization, Mak says.
“This is an organization-wide risk, a priority. I think it should come from the very top, whether it's CEO or COO, in terms of setting the tone; practically, it's an IT issue, because they're the subject matter experts,” he says.
“But the logistics would be HR, like making sure that the employees do the training and the consequences that they know, that's where the lever is.”
Dehghantanha agrees that the IT or cybersecurity team are the one who should initiate or put pressure on for training to combat AI risks.
“I have seen even the compliance team trying to push that in the organization — and then the expectation is that HR and others would facilitate the conversation with the employees and, of course, in themselves, in their own team.”
Red flags to detect deepfake threats
Visual indicators:
- Unnatural facial expressions or emotions that don’t match the speaker’s tone
- Subtle distortions: inconsistencies in skin texture, flickering, or blurring around the face edges
- Slight delays or awkward transitions in lip movements
- Note: AI is rapidly improving at mimicking micro expressions and refining details, making detection harder over time
Audio indicators:
- Robotic, monotone, or unnatural speech patterns
- Intonation and emphasis that feel off
- Lagged responses that don’t align with real-time conversation
- Absence of background noise or overly consistent ambient sound
Contextual cues:
- Unusual phrasing, grammatical errors, or shifts in tone that don’t match the speaker’s typical style
- Media shared from unfamiliar sources or unverified platforms
- Urgent requests that pressure quick action and deviate from standard protocols
Validation strategies:
- Implement unique behavioural tests (e.g., pre-agreed codewords with authorized personnel)
- Use real-time challenges, such as time-sensitive or context-based verification questions
Source: BDO Canada
