Why fake candidates are rising now, and what to do about it from Monday

Fake candidates are not new. Faked diplomas and invented employers have been around as long as CVs. What is new is the volume, and the fact that the most damaging cases are now run as a business. This post explains why, and then gets practical.

It is the last of three introductory posts. If you are new here, start with what a fake candidate is and who is behind them.

Three forces, arriving together

Remote hiring. Before 2020, at some point in almost every process a person walked into an office. That moment did more verification work than anyone gave it credit for. Remote hiring removed it. Identity is now checked late, if at all, often after the offer, sometimes never. A global talent pool also makes inconsistencies easy to explain away: a foreign phone number, an unusual university, a time zone that does not quite fit.

Generative AI. The cost of a convincing fake collapsed. A CV tailored to a job ad takes a minute. A complete persona with a photo, a profile and a work history takes about a day. During the interview, browser extensions generate answers in real time. Microsoft’s threat intelligence team documented operators using AI face swaps on stolen ID documents and voice changers on calls. And an honest but underqualified applicant now has the same tools, which is why the “ChatGPT candidate” is the most common profile we see.

Industrial scale. Somebody built a business model on top of the first two. The North Korean programme charged by the US Department of Justice in December 2024 gave its “IT warriors” monthly targets of at least $10,000. Laptop farms serve hundreds of companies from one apartment. Recruiters on the fraud side offer developers 35% of a salary to be the face while “ghost developers” do the work. Job scam losses reported to the FTC grew from $90 million in 2020 to $501 million in 2024. That is not a trend. That is a market.

The fake CV is optimised for the filter. The honest CV is optimised for the truth. The filter cannot tell the difference.

The uncomfortable part: the ATS filter is helping them

Most applicant tracking systems rank candidates by keyword match to the job ad. That is precisely the thing a generated CV is best at. Some go further and hide a wall of job keywords as white text in the PDF: invisible to the recruiter, perfectly visible to the filter. Meanwhile, real candidates with non-linear careers, gaps, a career change, a year of parental leave, rank lower than a fabricated profile that hits every keyword.

So the first step is not a new tool. It is accepting that “matches the job” and “is real” are two different questions, and your process currently only asks the first one.

From Monday, without budget

Here is what we tell every team after a talk. None of it costs money. All of it works.

1. A one-page signal list for the whole team. Yellow signals mean ask. Red signals mean stop and verify. Print it, pin it in the ATS, go through it once with the team. Ours looks roughly like this.

• Fresh LinkedIn profile next to "10 years of experience"
• Profile matches the ad keyword by keyword
• Pseudo-precision ("improved efficiency by 37.4%")
• Exotic universities and only top-brand employers

• The same phone number or email on two candidates
• Contact details that do not work
• Employers or universities that cannot be confirmed
• "Camera doesn't work", the second time

2. Train the hiring managers, not only the recruiters. Hiring managers run the technical interview and make the decision. They need to know the five things you can hear and see on a call: a four to six second pause before every answer; eyes going sideways or down instead of at the camera; generic answers with no personal context; an unexpected follow-up used to buy time (“can you repeat the question?”); whispers or an echo in the background. One of these is nerves or bad wifi. Three at once is a pattern.

3. Checkpoints at each stage, not one check at the end. Verification at offer stage is too late and too expensive. Put a light check at application (CV against public profile, contact data), a medium check before the technical interview (camera on, a document shown on screen), and a hard check before the offer for anyone with red signals.

Three questions that work

On the call, three questions have done more for us than any tool.

“What’s the weather like in your part of town?” A local detail that is not in the CV. A person who lives in Łódź knows what Bałuty looks like in November. A persona does not.

“What’s your name?” Asked mid-conversation, casually. Someone juggling several identities pauses for four seconds. A real person laughs and answers.

“How do you approach designing an architecture?” How, not what. A real engineer tells a story with a mistake in it. A fake gives the textbook answer.

Verify in layers

Level 1, every candidate: CV against LinkedIn, contact data works, an alert screening call. Level 2, yellow signals: camera mandatory, a certificate or document shown on screen, a quick OSINT check. Level 3, red signals: hard identity verification and two phone references you find yourself, not the ones on the CV.

The point of layering is that most candidates are real and deserve a light touch. Heavy verification for everyone is expensive, slow and off-putting for the honest majority. Heavy verification for the few with clusters of signals is cheap, fast and fair.

When to add tooling

At some point the checklist stops scaling. Hundreds of applications a month. Roles with access to code, payments or customer data. Hiring across borders where every inconsistency has an innocent explanation. A recruiter at 5pm on Friday will not check PDF metadata, compare phone number blocks across applicants, or notice that the skills section is identical to one from last month.

That is what we built TalentShield to do, and what candidate fraud detection means in practice: run the checks on every application, inside the ATS you already use, and show the recruiter the signals with the reasons. It does not reject anyone. It sorts the pipeline so the human check goes where it is needed. If you want to see what it finds on your own applicants, book a demo. Start with the one-page list on Monday either way.