Remote hiring rests on an assumption nobody writes down: that the person on the call is the person who sent the CV, and that they exist. For years the assumption was safe enough. It stopped being safe once real-time face replacement and coherent document generation became things that run on an ordinary laptop.
The short version: you cannot solve this by watching the video. Visual tests catch some cases today and will catch fewer every year. Effective defence moves verification to where the fraud gets expensive — administrative facts that cannot be generated: the country of the bank account, the identity document matched against the contract, references reached through a channel the candidate did not supply.
Three different frauds that look alike
Separating them matters, because they need different controls.
A stand-in on the interview. A competent person passes the technical interview on someone else’s behalf; a different person takes the job. The oldest variant, and it needs no AI at all — just a second person in front of the camera.
A fabricated identity. The candidate does not exist: generated photo, invented CV, employment history at companies that cannot be checked. Sometimes the goal is the salary; more often it is access.
Real-time face replacement. A real person conducts the interview, but you see someone else’s face. This is the variant that changed most in the last two years.
The pattern is documented at scale. The US Department of Justice and the FBI have published advisories on an organised scheme in which workers obtain remote IT roles under assumed identities, supported by intermediaries running “laptop farms” inside the target country. Those advisories are worth reading at the source — they describe a specific operational playbook rather than a generic warning.
Visual tests: what still works
Honestly: this is a race where the defender is structurally behind.
| Test | What it exploits | Status today |
|---|---|---|
| Turn head 90° | Replacement degrades at steep angles | Partial, weakening |
| Hand across the face | Model loses the mask edge | Partial, easily rehearsed |
| Sudden lighting change | Swapped face reacts inconsistently | Still useful |
| Stand up and step back | Forces a new framing and background | Useful, rarely anticipated |
| Hold ID next to the face | Document and face in one frame | Useful in combination |
| “What’s today’s date?” | Verifies nothing at all | Useless |
None of these is a gate. Together they raise the cost, which is the point — but if your entire defence is this table, you will have a problem within a year.
Where the fraud actually gets expensive
The defender’s advantage lies outside the interview. The controls below are dull, cheap, and much harder to circumvent than any camera test.
Geographic consistency. Bank account country, identity document issuer, real activity timezone, phone number country. A mismatch between these is the strongest single signal in the process — and precisely what the scheme needs intermediaries to hide.
Equipment shipping address. A request to send the laptop somewhere other than the stated residence, “because I’m staying with family right now”, is a textbook element of the intermediary pattern.
References obtained independently. Do not call the number the candidate gave you. Find the company yourself and call its published number. A fabricated reference stops working the moment the channel does not originate from the candidate.
One in-person meeting, or notarised identity verification, before production access is granted. For roles with broad access, that is the cost of a single day against a risk you cannot unwind later.
What not to do
Do not decide on the basis of an AI text detector. Detectors misfire often, and a CV — short, formulaic, frequently written in English by a non-native speaker — is close to the worst possible input. Rejecting on that basis is both unfair and statistically unsound. We covered the limits of these tools in AI detection tools.
Do not turn the interview into an interrogation. Genuine candidates encounter these tests too, and they draw conclusions about the company. Put verification where it belongs: in the formal steps.
Do not treat “camera on” as identity confirmed. That assumption made sense in 2019.
A minimum process you can ship in a week
- During the interview: two dynamic checks (stand up and step back; ID next to the face), unannounced.
- After the interview: geographic consistency — document, phone, bank account, stated location.
- References only through a channel you sourced yourself.
- Before access is granted: identity confirmation independent of the candidate.
- First 30 days: restricted permissions and a look at activity hours against the declared timezone.
Step five is the one teams skip, and it catches cases that passed everything else — sustaining work in a timezone you are not actually in is expensive to fake across several weeks.
The wider pattern
This is the same mechanism behind voice cloning: the cost of forging a signal that was self-authenticating for decades has fallen to roughly zero. The conclusion is identical each time — move trust off the signal that can be generated and onto one that cannot.