How Do You Stop Fraudulent Candidates in Remote Interviews?

Between July 2022 and August 2023, several US and UK companies employed a remote IT worker called Andrew M. They shipped his work laptops to an address in Nashville, paid his salary, and gave him access to their networks.

Andrew M. was a real US citizen. He wasn't doing the work. According to the US Justice Department, his identity had been stolen, the laptops sat in a Nashville home with remote desktop software installed, and the people logged in were North Korean IT workers operating from overseas. Each was paid more than $250,000 over that year. The companies spent more than $500,000 on audits and clean-up.

None of it started with a hack. It started with a hire.

This guide explains how to stop fraudulent candidates in remote interviews: what candidate fraud is, how the Andrew M. case worked, why fraud is rising, how to spot it, and the eight checks that would have stopped it, without treating every applicant as a suspect.

What is candidate fraud?

Candidate fraud is when someone misrepresents their identity or ability to get hired. It takes three main forms: a stolen or fake identity, sometimes with a stand-in at the interview; a deepfake face or cloned voice on a live call; and hidden help the employer hasn't allowed, from an answer tool or a person off camera.

Using AI to tidy up a resume isn't fraud on its own. The line is help you haven't allowed, used to misrepresent who someone is or what they can do.

How a real candidate fraud case worked

The Andrew M. case is worth walking through, because every step is a point where a hiring team could have caught it. This is how the Justice Department described the scheme:

1. A stolen identity. A real US citizen's name and details were used to apply for remote IT jobs.
2. The hire. Media, technology and financial companies hired "him" as a remote worker.
3. The laptop. Each company shipped equipment to Andrew M. at a Nashville address. It was not his home. It was a laptop farm.
4. The access. Someone at that address logged in to the laptops and installed remote desktop software, so workers abroad could use them while appearing to be in Nashville.
5. The pay. Salaries were routed through accounts designed to hide where the money went, and the income was reported to US tax authorities under the stolen identity.
6. The bill. The companies spent more than $500,000 on audits and remediation once it came to light.

Notice what is missing: no single dramatic moment. Each step looked like ordinary remote onboarding.

Why is candidate fraud rising?

Three things changed at once.

• Hiring went remote. When every interview is a video call and every laptop is shipped, it is easier to put a different person, or a different face, in front of the camera. In June 2022 the FBI reported a rise in complaints about deepfakes and stolen personal data used to apply for remote IT and software jobs.
• AI tools got cheap and good. Gartner found that 39% of candidates used AI somewhere in their application, and in a 2025 survey of 3,000 candidates, 6% admitted to interview fraud. Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. That is a forecast, not a fact.
• Organized schemes moved in. In June 2025 the US Justice Department announced searches of 21 suspected laptop farms in 14 states. Workers linked to North Korea had landed jobs at more than 100 US companies using stolen and fake identities. One case alone involved more than 80 stolen identities and at least $3 million in losses.

A laptop farm is a house full of company laptops kept switched on so someone overseas can log in remotely, while the employer believes that person is working from the US.

How to detect candidate fraud in remote hiring

Most warning signs turn up at one of three moments.

• When applications come in. The same resume wording, phone number or email under different names. Reused internet (VoIP) phone numbers. A profile with almost no history you can check. The FBI lists several of these in its 2025 alert.
• During the interview. A camera that is always "broken". A pause before every answer. Eyes tracking text off screen. Answers that sound polished until you ask one simple follow-up.
• At offer and onboarding. A request to ship the laptop somewhere other than the home address. A sudden change of bank details. And the big one: the person who starts work not matching the person you interviewed.

Every one of these has an innocent explanation. Connections lag, people get nervous, and some candidates have disabilities that affect eye contact or speech. A warning sign is a reason to check, never a reason to reject on the spot.

How to prevent cheating in remote interviews

Cheating is a real candidate getting help they shouldn't have. You stop most of it with interview design, not surveillance.

• Make one round live and unscripted. Ask about the candidate's own past work and why they made a specific decision. Real experience holds up. Borrowed answers usually don't.
• Validate skills, not just answers. A short work sample or a task explained out loud shows what someone can actually do.
• Put your rules in writing. Tell candidates what help is fine, what isn't, and what happens if they cross the line. Gartner calls this the first step.
• Keep the recordings. Reviewers can replay answers and compare them across rounds.
• Meet in person when the role warrants it. For high-access roles, a final in-person step is the strongest check. Gartner found 62% of candidates are more likely to apply when in-person interviews are required.

How to prevent AI-generated candidate fraud

AI-generated fraud covers deepfake video, cloned voices and fully synthetic profiles. A few habits make it much harder to pull off.

• Watch for sync problems. The FBI's 2022 alert noted lips that didn't match the audio, and coughs or sneezes that didn't line up with the video.
• Break the script. Unplanned follow-up questions and real-time conversation are harder to fake than prepared answers.
• Confirm identity through a second channel. Match the person on the call against verified ID, not against the profile they sent you.
• Compare rounds. If the voice, face or knowledge changes between interviews, find out why before you make an offer.

How to stop fraudulent candidates: eight checks

No single control stops everything. Layers do. Here are eight, mapped to the moment in the Andrew M. case where each one would have helped.

How employers verify a candidate's identity

Good identity checks combine three things: a government ID, a live check that the person on camera matches that ID, and a background check that the personal details really belong to them. In the FBI's 2022 cases, background checks revealed that applicants were using someone else's personal information. Repeat the match at onboarding, before any access is granted.

Verify without treating people like suspects

Good candidates have options, and a process that feels like an interrogation will lose them.

Run the same checks for everyone in a role, so nobody is singled out for their name, accent or location. Tell candidates up front what you'll verify and why. Offer an alternative if someone can't use a camera or needs an accommodation. When something looks off, pause and verify, and let a person make the call instead of an automatic rejection. And look after what you collect: ID documents and recordings deserve tight access and a clear deletion date.

Strengthen interview verification with CloudInterview

Verification is only as good as the evidence behind it.

CloudInterview's AI Interviews keep scores, transcripts and recordings for every candidate, with the reasoning behind each rating, so your team can look back and compare. For roles where a deep, live technical conversation matters most, Interview Outsourcing adds a round with a specialist interviewer. And our Security page explains how that data is protected: SSO, role-based access, audit logs on every action, and encryption in transit and at rest.

Book a demo to see how it fits your verification steps.