How to spot and prevent recruitment scams

In 2024, US cybersecurity firm KnowBe4 hired a software engineer for its internal AI team. For that remote role, the company reviewed resumes, did background checks, and verified references before making a job offer. They finally chose someone, but it turned out to be a big mistake. Their new hire was a North Korean hacker.  

The hacker used a combination of AI-enhanced images and identity theft to land the job. In this article, we’ll discuss these and other recruitment scams that HR teams should watch out for. We’ll also look at aspects of the KnowBe4 case and go over some lessons learned from that incident. 

What are recruitment scams? 

A recruitment scam is a form of fraud where individuals or groups deceive job seekers or employers. They do this to steal money, steal identities or data, or access sensitive systems. 

• Scams that target job applicants often involve fake job postings, bogus interviews, and requests for money or personal information 

• Scams targeting employers may involve using stolen identities, forged credentials, or AI-generated profiles 

According to the Canadian Anti-Fraud Centre (CAFC), there were over 50,000 scam and fraud cases reported in 2024. This resulted in losses worth $648 million.  

Types of recruitment scams 

For this article, we’ll be focusing on scams targeting employers. Here are some examples of fraud that job seekers do to get employed: 

1. AI-enhanced images 

How it works  

Images are altered using AI to come up with fake identities. In some cases, this technology is used to match stolen identity documents.  

That’s what happened in the KnowBe4 case. The hacker took a stock photo, then edited it using AI to come up with a new identity.  

How to spot it 

Look for unnatural lighting, warped backgrounds, or inconsistent shadows. Pay close attention to hands, teeth, and eyes – AI often struggles with these details. Faces that look overly smooth can be a giveaway. 

2. AI deepfake 

How it works 

Deepfakes are photos or videos showing a person, usually a famous figure, saying or doing things they didn’t actually say or do. This technology mimics voices, facial movements, and expressions, often used to deceive people.  

AI deepfake is different from AI-enhanced images. AI deepfake involves video and/or audio to impersonate a real person.  

How to spot it 

“Most deepfakes will have common characteristics such as incongruencies in the skin and other parts of the body,” says lawyer Imran Ahmad. He’s the Canadian head of the technology group at Norton Rose Fulbright, a law firm based in Toronto.  

There are other signs, according to Ahmad: shadows around the eyes, unusual blinking patterns, and unrealistic movement of the mouth. 

Here’s a video showing how scammers are using AI deepfake to get jobs: 

Canadian employers have become even more concerned about the use of AI deepfake at the workplace. 

3. Identity theft 

How it works 

An applicant steals someone else’s identity, pretending to be that person. People usually do this if they have a criminal record or a spotty employment history. 

How to spot it 

Details in different identification documents might not add up. Check the quality of the scans or originals – any pixelated sections? Misspelled words? Sections that look different from the rest of the document?  

Everyone is on social media in some form. Do a quick online search for the applicant to see whether they have a digital footprint, and how far this dates back. Check if all images and details match. 

4. False references  

How it works 

In this type of recruitment scam, the applicant submits fake references to give good feedback on their previous work performance. In a 2021 case, a former civil servant committed fraud when they posed as the referee for their own job application.  

Another similar scam involves the use of reference houses – these are organizations that promise to give references for a fee.  

How to spot it 

Verify reference credentials – check for a digital footprint, as in the previous example. Do an online search to see if they are with the organization that they claim to represent.  

Wherever possible, contact the referee via their work email address or their work phone. Use the company’s main switchboard to get through to the person.  

5. Resume fraud 

How it works 

According to a Forbes article, 70 percent lie on their resumes. Most people are guilty of embellishing their CVs to get noticed for the job. It’s also become common practice to use AI to align individual resumes with job postings, resulting in a better match. 

Minor exaggerations are common, but employers should decide where to draw the line. Blatant misrepresentation calls for serious action. Here’s an example: Yahoo fired its CEO in 2012 for lying on his resume. 

How to spot it 

Go over the candidate’s resume to check for inconsistencies. Verify their credentials and qualifications with the granting bodies/organizations.  

Do an assessment to see if their skills match what’s on their resume. At the interview stage, ask detailed questions. Go for competency-based questions. Ask them about any real-life incidents and get them to talk about these at length.  

6. Bait and switch 

How it works 

This is common when companies hire third party subcontracting agencies for recruitment. A bait and switch involves having a qualified candidate at the interview stage. Once hired, another person – usually someone more junior – turns up onsite to do the work. 

For remote jobs, a candidate turns up for interviews and, once hired, will outsource the job to someone else. This tactic appears to be common in the tech sector. 

How to spot it 

During video interviews, the background is usually dark. This blurs the applicant’s features, designed to confuse the interviewer when someone who looks slightly different turns up onsite.  

Other signs include scripted answers to technical questions and some hesitation in turning on the camera.  

These are just a few examples of recruitment fraud that companies face. If your organization falls victim to any type of scam, report it to the CAFC right away.  

Legal and financial risks of falling for a recruitment scam 

Falling victim to any sort of scam can have damaging effects on your organization and people. Here’s what can happen if you get scammed by a new hire: 

• Data breaches: The scammer could gain unauthorized access to your company’s files, potentially leaking employee information or sensitive business data 

• Intellectual property theft: The scammer could get their hands on trade secrets, patents, and other forms of intellectual property 

• Damaged reputation: There’s probably no better example than KnowBe4 – a security company that unknowingly hired a North Korean hacker. They recovered from this by sharing their story for others to learn from  

• Financial loss from hiring the wrong person: Hiring the wrong person costs time, money, and resources spent on recruitment, onboarding, and training 

• Further losses if scam is detected later: If the scammer starts working for your company, they also start collecting salaries, bonuses, and other forms of compensation. These are considered losses 

How to protect your company from recruitment fraud  

With advancements in technology, recruitment scams have become harder to detect. Thanks to KnowBe4’s decision to share the job fraud incident, more people are aware of strategies used by scammers.  

Here are some ways to shield your organization from recruitment scams: 

Train your hiring team on fraud 

Encourage your team to be observant. Pay attention to the smallest details. If they find that something is off, ask questions.  

Introduce a training program on how your hiring and HR teams can spot AI fraud. This quiz on spotting AI deepfake is a good starting point.  

Invest time and effort where needed 

HR technology has led to efficiencies in hiring, onboarding, and other people-related tasks. Still, there are assignments that require time, effort, and focus. Devote the energy needed in these tasks; avoid cutting corners.  

A clear and thorough hiring process helps businesses attract top talent and avoid costly mis-hires. 

Do reference checks; verify credentials 

One of KnowBe4’s lessons learned is to call the referee (it’s #3 on their 10-point list). An email screening might not be enough; talk to the referee on the phone. Contact them through their office landline, if possible. Otherwise, check to see if they’re on LinkedIn or have any digital presence elsewhere.  

There are legal considerations when carrying out reference checks. Watch this video for more details (skip to 37:35 for the section on reference checks): 

Do in-person or on-cam video interviews 

Meeting a candidate face to face is the best way to verify identity, ask questions, and look out for nonverbal cues. But if that’s not possible, go for a video interview with these guidelines: 

• camera on 
• good lighting 
• clear background (no blurring or effects) 

Send these pointers ahead of time so that the candidate can prepare. Take these steps to help minimize growing incidents of deepfake in remote jobs. 

Reducing risk from recruitment scams 

The KnowBe4 case is a reminder that even well-prepared companies can be fooled. Scammers are adapting fast, and so must HR. Technology, credentials, and appearances can all be faked. But strong hiring processes can still make a difference. 

Use the lessons from KnowBe4 to review your safeguards. Train your team, verify identities, and don’t skip the basics. Finding the right candidate for your organization will be worth it.  

Subscribe to CHRR+ to access employment law cases for other cautionary tales in the workplace