Employers are encountering fraudulent job candidates who use real-time face swaps and cloned audio to pass remote interviews, then send a different person to onboarding. The article describes this as a real and growing hiring-fraud problem, especially for high-access technology and defense roles, and urges companies to verify identity beyond the initial interview.
A fraudulent applicant uses real time video face swapping and cloned audio during a remote technical interview to appear as a qualified candidate. The interview goes well, the role is offered, and the apparent candidate is hired. At onboarding, a completely different individual shows up to actually perform the job. This pattern specifically targets high paying, high access roles in technology and defense, where the payoff for gaining employment under a false identity is highest.
The scheme exploits a structural gap rather than a single technical flaw. Human resources teams verify identity during hiring, then hand off security responsibility to IT once the person is onboarded. No single team owns identity assurance across the full employment lifecycle, so a mismatch between the interviewed person and the onboarded person can pass through unnoticed. The findings describing “ghost candidates” note this is becoming a building consensus among identity and biometrics practitioners, not an isolated incident. Survey data cited in the article found that 98 percent of respondents had experienced candidate fraud firsthand, and 42 percent of those cases were only discovered after the person was already hired.
Organizations can reduce exposure by closing the handoff gap between HR and IT and by requiring continuous identity verification rather than a single check during the interview stage. Concrete steps include:
The underlying recommendation is not to buy a detection tool for every stage of hiring, but to establish a unified, accountable identity assurance process spanning pre hire, onboarding, and post employment stages. This mirrors identity misuse techniques tracked under MITRE ATT&CK technique T1656, where an adversary relies on an impersonated identity to gain trusted access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A ghost candidate is a fraudulent job applicant who uses real-time face swaps and cloned voice technology to pass remote interviews, then sends a different person to actually fill the role.
According to the cited survey, 42 percent of reported candidate fraud cases were only discovered after hiring, meaning more than half were caught earlier but a significant portion slipped through.
The article points to a gap between HR and IT, where HR handles identity verification during hiring and then hands off security responsibility to IT, leaving no continuous check across the employment lifecycle.
High-paying, high-access technology and defense roles are specifically named as targets, since these positions give fraudulent hires valuable system or data access.
Your best interview candidate might not be the person you hire. A ‘ghost candidate’ says, ‘I’m excited to discuss my experience.’ A live face swap and cloned voice carry them through a technical interview for a high-access role. Then someone else shows up for onboarding. That’s the gap: HR checked the interview; IT meets the new hire. Watch for a changed face or voice. Before granting access, match the onboarding person to the interview using your approved identity check.
Spanish police arrested a suspect accused of using real-time face-swap deepfakes during live video identity checks to obtain fraudulent digital certificates for later misuse. The article describes how the attacker relied on lighting tricks and camera injection to spoof document and biometric…
Scammers are using AI deepfakes to impersonate real OnlyFans creators on social media and trick fans into paying for “live chats” or exclusive interactions. Victims are funneled from TikTok to private messages (e.g., Snapchat) and then pressured to send money via Cash App, after which the scam…
Scammers reportedly cloned Osceola County Sheriff Steve Moser’s voice and used his photo in a voicemail to make a fake arrest-warrant call appear legitimate. Similar police-impersonation scams involving alleged missed jury duty or outstanding warrants have been reported in several states, using…
A real deepfake during Ireland’s 2025 presidential election falsely depicted candidate Catherine Connolly saying the election was cancelled, that she was withdrawing, and that her supporters should not vote. The UK Electoral Commission is developing a rapid detection system because similar false…
An Arup employee transferred $25 million to fraudulent accounts after joining a video call featuring deepfake impersonations of company executives. The case shows how realistic-looking executive impersonation can pressure employees into approving high-value payments, even when the request appears…
A Hong Kong employee at engineering firm Arup transferred about $25.6 million after joining a video conference where every other participant was a deepfake. The incident shows how convincing fake video identities can be used to pressure employees into approving high-value payments, and why…
