✳ CYBERR / GUIDE
Hiring in the Deepfake Era.
A practical guide to candidate identity risk, the warning signs and the checks every hiring team should know.
Get the guide ↗A REAL CASE, PRACTICAL LESSONS
When an interview is not what it seems.
Deepfake hiring fraud uses AI-generated video, voice or documents to hide a candidate’s identity. Cyberr experienced this firsthand during a backend engineering interview. The team’s investigation revealed a pattern of warning signs and lessons for every organisation that hires remotely.
Deepfake technology is being successfully used in the hiring process to hide identities, creating significant business risk.
Criminals, fraudsters, and in some cases, nation states are using this technology as part of their arsenal to harvest information and infiltrate organisations.
We know first hand what this looks like in practice, as it happened to us when we posted a role for a backend engineer. Fortunately we caught them before it was too late, and our subsequent investigation uncovered a host of red flags and learnings.
This guide is built from our investigation, and includes practical advice on how to reduce risk in your hiring process.
Who should read this guide?
Talent leaders, HR leadership, CPOs, CISOs and security leaders responsible for the integrity of the hiring pipeline.
What the guide covers
- Who is behind these schemes and the motives driving them
- The scale of the problem across the UK, Europe and North America
- The red flags that identify fraudulent candidates in practice
- A verification framework to build into your hiring process
- The data protection and employment law considerations that apply
Foreword by Jake Moore
Jake Moore is Global Cybersecurity Advisor at ESET and a regular commentator on cybersecurity and AI for BBC, ITV and Sky News, drawing on fourteen years in the police Digital Forensics and Cyber Crime Unit.
THE CASE STUDY
Watch what happened.
The five-part series follows the real hiring incident behind the guide, from a credible first impression through to the team’s final decision.
On paper the applicant looked highly credible. Relevant backend engineering experience, a strong CV and a well-formed professional profile all pointed the right way, and the candidate had approached Cyberr’s CEO directly. This first episode sets out the picture the team had at the start, before anything looked out of place.
EPISODE 02Episode 2: Something Felt Off (1:09)The first interview produced a collection of small warning signs: audio and video that did not quite line up, noticeably delayed responses, and heavy reliance on a virtual background. No single one of these is proof of anything. What raised concern here was the pattern of them appearing together in one conversation.
EPISODE 03Episode 3: The Unexpected Test (1:43)The candidate had volunteered that they were a native Romanian speaker, so the team tested that claim during the conversation. The response, and the reluctance that came with it, added another inconsistency to the picture. It is a simple illustration of the value of checking information a candidate has offered up themselves.
EPISODE 04Episode 4: Do You Know What Cyberr Does? (1:23)Next the candidate was asked a straightforward question: what does Cyberr actually do? The answer was vague. That sat awkwardly against the earlier decision to approach Cyberr’s CEO directly, and it raised further questions for the team about the candidate’s motivation and their understanding of the company.
EPISODE 05Episode 5: I Don’t Believe You Are Who You Say You Are (2:13)With the inconsistencies stacking up, the team put the question directly to the candidate about who they really were. This final episode covers that confrontation, how the situation was handled in the moment, and how the interview and the wider internal investigation were brought to a close.
A single warning sign is not proof of fraud. The value of this case is in the pattern of inconsistencies and the checks the team used to understand them.
Read the written account →Samantha Swift also discussed the case at length in the longer-form Cyber All Day conversation.
Frequently asked questions.
What is deepfake hiring fraud?
A candidate uses AI-generated video, voice or documents to misrepresent their identity during recruitment.
Who should read this guide?
Talent leaders, HR leaders, CISOs and security leaders responsible for the integrity of a hiring pipeline.
What does it cover?
The motives, scale, warning signs and practical verification steps that hiring teams can use, including data protection considerations.