Hiring in the Age of Deepfakes: Protecting Your Company from Synthetic Applicants

Deepfake video, AI-generated voices and synthetic resumes are letting fake candidates pass virtual interviews and get hired. Once inside a company, these impostors can steal data, install malware or divert funds, often while working a fully remote role. This piece covers how the threat works and the practical steps hiring teams can take to catch it before day one. It’s tough enough to hire the right person in today’s competitive talent market. Candidates ghost interviewers, skill sets don’t match job descriptions and the race for top technical talent is relentless. Now companies face a new problem: job candidates who aren’t real. Armed with deepfake video, AI-generated voices, synthetic resumes and fabricated identities, these impostors can pass virtual interviews and start work remotely without ever setting foot in an office. Once inside, they can steal data, install malware or divert funds. What used to be a hiring headache is becoming a security risk that most hiring teams aren’t yet set up to catch. It’s a fitting problem to talk about this October. This year’s Cybersecurity Awareness Month theme from the National Cybersecurity Alliance is “Don’t Make It Easy for Them,” built around the idea that security comes from consistent daily habits, not one perfect decision. That applies as much to who a company lets onto its payroll as it does to passwords or phishing links and a rigorous interview process is one of those habits. The numbers tell the story. By 2028, one in four job candidates worldwide could be fake, built from AI-generated profiles, voices, documents and video. The trend is already unfolding. Seventeen percent of U.S. hiring managers say they have encountered deepfake applicants in video interviews, with technical and IT roles bearing the brunt of these attempts. Those jobs are remote-friendly and hard to verify from a distance, which makes them attractive targets. Persona, an identity verification firm, blocked more than 75 million AI-driven face-spoofing attempts in 2024 alone. That volume points to an organized, fast-growing fraud economy. Synthetic applicants have moved into the mainstream of hiring. Cybercriminal groups run many of these schemes. Nation-state actors run others, often with specific intelligence objectives. The U.S. Department of Justice has linked dozens of remote-infiltration cases to state-sponsored operatives using fraudulent identities to secure jobs at American companies. The goal in many of these cases is funneling wages back to fund government programs. One case became public when a candidate’s facial movements didn’t quite match his speech during a video interview. His resume looked flawless. That small mismatch was the tell that unraveled the scheme. Remote work has expanded the attack surface for bad actors. When a new hire never needs to show up in person, a fraudulent identity is easier to maintain and a fake employee already has legitimate access to the systems and data an attacker is after. Once onboarded, these impostors can map a company’s infrastructure for a later attack, target intellectual property or divert payroll and vendor payments to accounts they control. Because many of these roles are remote, they can operate undetected for weeks or months, long enough to cause serious damage before anyone notices. Defending against synthetic candidates starts before an offer letter goes out. It begins in the interview itself. Here are six ways to build verification into that process: Tools only work when the people using them know what to look for. Recruiters and hiring managers should be trained to recognize the signs of a synthetic applicant: delayed audio responses, mismatched lip movements, an unusual smoothness to a voice or answers that sound polished but never quite address the question. The better a hiring team gets at spotting these anomalies, the less likely a fake candidate slips through. Sharing intelligence with industry peers helps too. Suspicious profiles, new tactics and emerging fraud patterns, shared across companies, help everyone stay ahead. No single company sees the full picture on its own. October is a natural forcing function here. Most security teams already use Cybersecurity Awareness Month to refresh phishing and password-hygiene training and recruiters and hiring managers deserve a seat in that same cycle, since they’re now on the front line of a threat that looks nothing like a suspicious email. Companies that put these defenses in place will stop most attempts. Attackers will keep refining their methods and each failed attempt teaches them something new. As deepfake technology improves, the gap between a genuine candidate and a synthetic one will keep narrowing. Facial rendering is already convincing and voice synthesis is often hard to tell apart from a human voice. Generative AI in hiring calls for a change in how companies think about trust. Verification, not paranoia, is the right response. The friction that used to exist in hiring, like a handshake, a badge photo or an ID check at reception on day one, has largely disappeared in a remote-first world. Companies need deliberate ways to replace it. Trained interviewers, a defined verification step before every offer goes out and identity verification tools like biometric and voice forensics together create multiple checkpoints where a fraudulent candidate is likely to get caught. That combination is what separates genuine talent from synthetic threats. Cybersecurity Awareness Month tends to focus on passwords and phishing links. This year, hiring deserves a place on that list too. Ready to keep synthetic candidates out of your hiring pipeline? GuidePoint Security works with organizations to assess identity risk across the employee lifecycle, including hiring and build verification processes that catch AI-generated candidates before an offer goes out. Together, GuidePoint Security and Adaptive Security help organizations train recruiters and hiring managers to recognize deepfake video, voice and identity fraud before it becomes a security incident.