Candidate Deception Poses Growing Risk for Employers

Candidate fraud is becoming a more complex challenge for employers as job seekers use artificial intelligence (AI) to misrepresent their qualifications and sophisticated bad actors attempt to secure positions that provide access to company systems and sensitive data.

Detecting deception requires more than background checks and identity verification. It demands closer collaboration among talent acquisition, IT, security, and hiring managers throughout the recruitment and onboarding process.

At Cherry Bekaert, a public accounting and consulting firm headquartered in Raleigh, N.C., warning signs emerged after a new hire had already started work, explained Grant Clough, the firm’s director of talent acquisition, speaking at an event hosted Oct. 5, by recruitDC, a professional networking community in the Washington, D.C., area.  

Clough said he received a message from Tyler Heslop, Cherry Bekaert’s security governance manager, questioning the new employee’s identity.

“ ‘I don’t think he’s who he says he is,’ ” the message read. Clough’s initial reaction was panic, he said half-jokingly. But the incident underscored the importance of having established relationships with colleagues who can help identify potential fraud.

“Tyler and I work closely together. You need to figure out who your Tyler is, in order to have these constructive conversions about candidate deception,” Clough said.

Specialty Credential: Talent Acquisition

Red Flags Can Emerge After Hiring

Heslop, co-presenting at the recruitDC event, said that concerns surfaced during onboarding, including a discrepancy where the new hire’s laptop had been sent to Virginia while the employee explained that he was in Ohio because his father was in the hospital.

Heslop also found that the employee’s communications sounded suspiciously like ChatGPT-generated responses.

“I was like a bloodhound on a hunt,” Heslop said. “I had to dig into this. I got to the point where I thought ‘this person doesn’t seem real.’ ”

Further investigation revealed additional inconsistencies. The employee’s LinkedIn profile had no photograph, and the picture on his identity verification documents did not appear to match the candidate.

Recruiters are often the first line of defense against candidate fraud, Heslop said, but the nature of the threat is changing.

“This is something new. It is happening a lot more frequently than people believe,” he said. “You will need to ask yourself: At what level of red flag am I willing to not ignore this?”

The experience also showed that following established hiring procedures does not guarantee that a fraudulent candidate will be caught.

Clough initially worried that someone on his team had failed to follow protocol. But the firm had completed an I-9 employment eligibility verification, E-Verify check, background screening, and a third-party identity verification.

Clough cited a figure indicating that 68% of candidate fraud was uncovered through human observation, highlighting the role that recruiter judgment and employee vigilance can play alongside formal screening tools.

“There is no panacea for this,” he said. “As we get better at detecting fraud, people will get better at coming up with new scams and ways to get around safeguards and we all need to continually look for signals at every step in the process.”

AI Complicates Candidate Screening

Not all candidate misrepresentation looks the same. Some applicants use AI to improve their resumes or prepare for interviews, while others use it to fabricate work experience, invent skills or claim employment at companies where they never worked.

The challenge is distinguishing legitimate AI assistance from real misrepresentation.

“Some AI use in the hiring process is materially deceptive, some is context dependent, and some is acceptable assistance,” Clough said.

Employers should establish clear expectations around AI use with hiring managers and communicate them to candidates before assessments begin, he said. Recruiters can explain whether AI tools may be used during interviews, skills tests, or take-home assignments, including which tools and applications are permitted.

Clear rules also give recruiters a consistent framework for evaluating suspicious behavior instead of relying on individual interpretations of what constitutes cheating.

Event: All Things Work 2026

Strengthen Verification and Security

Employers can take several steps to reduce their exposure to candidate fraud, Clough and Heslop said.

One step is to reconsider when identity, employment, and education verification occurs. Cherry Bekaert traditionally conducted background checks after an offer, a practice that became more common following the ban-the-box movement, which sought to delay questions about criminal history.

The firm is piloting a process that moves identity, employment, and education checks to the pre-offer stage, while retaining criminal background checks post-offer.

Employers should also examine inconsistencies across application materials, identity documents, and professional profiles. LinkedIn’s identity verification features may provide another useful signal, while purported employers listed on a candidate’s profile can be checked for legitimacy.

Technology safeguards become particularly important after hiring. Heslop said Cherry Bekaert uses standard geofencing practices for device access and management, and he can examine IP addresses and login locations when someone accesses company systems.

But technical controls are not foolproof.

“Bad actors will know how to circumvent these safeguards,” Heslop said. “If they are trying to get a job at your company, they will be persistent. If they fail once, they will try again and again until they succeed.”

The firm is exploring issuing equipment in person, he said, acknowledging that the approach presents logistical challenges but can be effective.

Recruiters and security teams can also coordinate to monitor suspicious patterns after onboarding, including repeated unexplained absences, unusual availability, and discrepancies between an employee’s stated location and actual work activity. Such signals warrant appropriate investigation rather than automatic conclusions about misconduct.

Other potential safeguards include conducting in-person interviews, using video screens instead of phone-only interviews, asking candidates to disable virtual backgrounds during interviews, and requiring in-person equipment pickup when practical.

Some employers may also use hybrid job postings to communicate that occasional office attendance could be required, even for positions that are largely remote. Clough said this approach has likely deterred potentially fraudulent applicants, although securing hiring managers’ support can be difficult.

Ultimately, candidate deception cannot be addressed by talent acquisition alone. HR leaders should establish clear escalation procedures and ensure recruiters know whom to contact when something does not add up.

“You need an agent swarm of Tylers to orchestrate against some of these issues,” Clough said. “Tyler and I would not have been as successful during this experience had we not been working together.”