The Last Thing AI Can't Fake in Hiring

A few years ago, the hard part of hiring was finding good people. Now a growing share of the work is making sure the people applying for jobs are who they claim to be.

The mechanics behind that are fairly mundane. A CV takes seconds to generate. A portfolio can be assembled from someone else's work. A video interview can be run through real-time face and voice software that is cheap and improves every few months.

In 2024, the security training company KnowBe4 publicly explained how it had hired a remote engineer who turned out to be a North Korean operative. He used a stolen US identity and an AI-edited photo, and he passed four video interviews and a background check. The company only caught him when his new work laptop started loading malware. 

Gartner now expects that by 2028, one in four candidate profiles worldwide will be fake. Their research also found that 6% of the surveyed job candidates admitted to participating in interview fraud, either by impersonating someone else or having someone impersonate them.

KnowBe4’s incident shows other companies they need to watch out for fraud. If they can be fooled, it's safe to assume most hiring managers can be too.

Why the usual signals stopped working

Most hiring processes rest on an assumption nobody wrote down. Producing a convincing application took effort, so effort served as a rough proof of authenticity. That effort meant a tailored CV, a proven LinkedIn history, and a candidate who could talk sensibly on camera for forty-five minutes. None of it proved identity. It just made faking identity at scale expensive, so it was rare.

Generative AI removed that cost. Application materials can be produced or adapted quickly, while stolen identities and manipulated images can make a false profile look credible. At the same time, remote hiring, which much of Europe adopted for good reasons, means more people are hired without anyone on the team ever meeting the candidate in person.

The usual response is to add steps: another interview round, a take-home test, a request to turn your head on camera. However, more interviews and more steps don’t necessarily establish identity. Each step slows things down for every honest candidate and barely inconveniences a determined fraudster.

What a personal connection can tell you

One signal that technology cannot reliably reproduce on its own is a recruiter’s long-standing relationship with the candidate.

A good recruiter who puts someone forward isn't working from an application. They may have placed this person before. They may have worked alongside them, or followed their career through three conversations over five years. They often know the candidate's former managers. They know how the candidate behaves when a project goes badly. That knowledge comes from a history of real interactions, not just a convincing digital profile one can fake.

This is why I think the people who predicted AI would replace recruiters had it backward. AI is very good at the parts of recruiting that were never where the value sat: building sourcing lists, matching keywords, booking calls. Meanwhile, human judgment in assessing someone’s track record and reputation becomes more important when applications are easier to manufacture. When almost everything can be faked, an introduction from someone with something to lose becomes the most trustworthy input in the whole process.

The "something to lose" part matters. A recruiter's reputation travels with every candidate they introduce. If they introduce one fraud, they lose that client and probably the next few. That is a stronger incentive to get it right than any checkbox in an applicant tracking system.

People vouch, machines verify

None of this means going back to a gut feeling and a phone call. Knowing someone is not the same as checking their passport. A trusted introduction should never be a reason to skip verification.

The model I believe in splits the work based on what each side does best. People do what software can't. They vouch for a candidate's history, skills, and character from real experience. Identity verification checks whether the person presenting themselves matches the identity documents they provide. Depending on the process and required level of assurance, technology can validate identity documents, compare a live facial image with a document photo, and detect attempts to spoof a biometric check. The US National Institute of Standards and Technology sets out requirements for remote identity proofing, including document validation and presentation-attack detection, in its Digital Identity Guidelines.

These checks can be built into the hiring process without automatically adding another interview round, although they still require careful implementation and may involve extra steps for some candidates. Verification results also have limits: they don't establish whether someone can do the job or whether their professional history is accurate.

Each layer also covers the other's blind spot. A recruiter can be taken in by a stolen identity, especially if they only ever knew the person online. A verification check can confirm that a real passport belongs to a real person. What it can't tell you is whether they're the same person the recruiter has spent years working with. Used together, referrals and identity checks give employers separate evidence about the candidate's professional history and identity. 

Suggested read: Trust Infrastructure: How Digital Trust Becomes a Growth Engine in the Age of AI Agents

Where recruiters should start

Recruiters should begin by looking at where their candidates come from. If most of them arrive as cold applications that nobody has a relationship with, that is where fraud exposure sits.

They should give more weight to introductions from people who will stand behind them, and treat that network as a security asset, not just a sourcing channel. At the same time, they need to move identity verification early enough in the process to catch problems before an offer is made, while being clear with candidates about what will be checked and why. Adding interview rounds solely as a security measure is unlikely to solve the problem: it can burden genuine candidates without reliably establishing who is on the other side of the screen.

For a long time, trust in hiring was treated as something soft: culture fit, a good feeling after a call. It deserves a more concrete place in the process. The companies that hire well over the next few years will know exactly where each candidate's trust comes from. It comes from a person who will vouch for them, and a check that helps verify their identity.