When a fake CV gets you hired: how AI makes identity fraud easier

When the candidate isn't who they say

The FBI's Internet Crime Complaint Center put out a Public Service Announcement in May 2024 about a problem that was getting worse: people using deepfake tools to pose as someone else in remote job interviews ^[1]. The complaint wasn't hypothetical. The bureau had received reports of candidates using video, voice and images that didn't match the person who would show up for work, if anyone showed up at all.

Deel, a payroll and HR platform, reported in January 2025 that it had found infiltrators with fake identities working at hundreds of companies on its platform, some for weeks before being caught ^[2]. The company launched new identity verification tools in response.

It's a bit like turning up to collect a parcel with someone else's driving licence. Most of the time nobody looks that closely, and if the signature roughly matches, the parcel changes hands. In recruitment, when the interview is remote and the documents are PDFs, it gets harder to tell whether the person on the call is the one named on the CV.

What the AI Act says about recruitment

From 2 December 2027, AI used to select candidates or make decisions about promotion and termination counts as high-risk under Annex III of the AI Act ^[3]. Employers using such systems must follow the duties in Article 26, which include informing workers and their representatives before the system is used ^[4], and telling the person affected when a decision is made ^[5].

The Act doesn't mention identity fraud directly, but it does require high-risk systems to log events automatically under Article 12 ^[6]. That logging duty applies from the same date. If a decision to hire someone turns out to have been based on false credentials, the logs are what show who approved what, and when.

Why AI makes it easier

Generating a convincing fake CV, cover letter or reference used to take skill and time. Now it takes a prompt. Tools that generate text, manipulate images or mimic voices are widely available, and they're getting better quickly. A video call with the camera slightly blurred and the voice just credible enough can get someone through the first round.

The FBI's warning pointed to voice spoofing, face swaps and pre-recorded video segments being used to answer interview questions ^[1]. Once someone is hired remotely, they may work for weeks before the company realises the person doing the job isn't the person who interviewed.

Deel's discovery that this had happened at hundreds of companies suggests it isn't a rare problem ^[2]. The infiltrators often worked in IT or positions with access to systems, which raises a separate question: what did they do while they were there?

What this means for you

If your organisation hires remotely, or uses AI to screen applicants, it's worth asking a few questions now:

• Do you keep a record of which identity documents were checked, by whom and when?
• If a hire turns out to have used false credentials, could you show what your recruitment system or your screeners verified at each step?
• When you use AI to filter CVs or rank candidates, do you log which version of the model ran, what it recommended and who approved the shortlist?
• Do your staff know to be sceptical of a video interview where the picture is conveniently poor or the candidate's answers sound scripted?

How a digital witness would work here

The thing to seal is each step of the screening process: the candidate reference, the documents checked, the interview recording or notes, the AI model's output if one is used, and the person who made the final decision. Sealing takes a fingerprint of the record, not the record itself, so nothing leaves your systems.

Say a new hire turns out to have used someone else's passport. The company can show the sealed record of what was checked at recruitment: which document, which checker and which day. If the record hasn't changed since it was sealed, the fingerprint matches. Change one character and it won't.

What it doesn't do is prove the document was genuine, or that the decision was sound. It shows what the record said at the time it was sealed, which is often the evidence question when something is disputed months later.

Anyone the company shares the record with—an insurer, a lawyer, a supervisor—can check the fingerprint themselves. The verification is independent. You can try it with WitniumChain through the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. At each screening step, your recruitment system sends a fingerprint of the record to WitniumChain and stores the witness ID.
2. When something is questioned, you retrieve the record and calculate the fingerprint again.
3. If it matches the sealed one, nothing has changed. If it doesn't match, something has.

What to watch

The high-risk requirements for AI used in recruitment apply from 2 December 2027, including the logging duty in Article 12 ^[3]. That gives employers just under two years to get their systems in order.

Deel's new verification tools are one response. Others will follow. The deeper question is whether a log kept by the employer, which the employer could edit, will hold up when an infiltrator is discovered and the question is who missed what. A sealed record is harder to argue with.

Sources

1. FBI Internet Crime Complaint Center, "Malicious Actors Manipulate Photos, Videos, and Audio to Create Convincing Online Personas and Conduct Fraudulent Remote Job Interviews", Public Service Announcement I-052407-PSA, 28 May 2024, https://www.ic3.gov/Media/Y2024/PSA240528
2. Mynewsdesk, "Infiltratörer avslöjade på hundratals företag – Deel lanserar nytt skydd för distansrekrytering", press release, 8 January 2025, https://www.mynewsdesk.com/se/deel/pressreleases/infiltratoerer-avsloejade-paa-hundratals-foeretag-deel-lanserar-nytt-skydd-foer-distansrekrytering-3475485
3. Regulation (EU) 2024/1689 (AI Act), Article 6(2) and Annex III, with implementation timeline on the European Commission's AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
4. Regulation (EU) 2024/1689 (AI Act), Article 26(7), https://eur-lex.europa.eu/eli/reg/2024/1689/oj
5. Regulation (EU) 2024/1689 (AI Act), Article 26(11), https://eur-lex.europa.eu/eli/reg/2024/1689/oj
6. Regulation (EU) 2024/1689 (AI Act), Article 12, on the European Commission's AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12