Deepfake Job Interviews: How to Detect AI-Generated Video Candidates

In 2023, the FBI issued a public service announcement warning employers about a surge in deepfake job interview fraud. Criminals were applying for remote positions — particularly in IT, software development, and finance — using real-time face-swapping technology to appear as someone else during video interviews. Since 2022, reported incidents have increased by an estimated 1,300%. The problem has not slowed down.

This guide explains how deepfake interview fraud works, what warning signs interviewers can identify without technical tools, and how forensic analysis can provide additional verification.

How Deepfake Interview Fraud Works

The mechanics of real-time deepfake video are no longer limited to state-sponsored actors or research labs. Off-the-shelf tools — some free and open source — can run on a gaming laptop.

The typical setup:

1. The attacker creates a fake identity or steals a real person’s identity (name, resume, LinkedIn profile).
2. They install a real-time face-swap application — tools like DeepFaceLive, Roop, or commercial alternatives — which intercepts the webcam feed and replaces the attacker’s face with a target face in real time.
3. A virtual camera driver (OBS Virtual Camera, ManyCam, or similar) presents this manipulated feed as a standard webcam to the video conferencing platform.
4. During the interview, the attacker speaks and moves normally while the deepfake face appears on screen.

The target face is typically sourced from LinkedIn profile photos, social media posts, or a generated synthetic face. For higher-sophistication attacks, voice changers are added to the pipeline to alter the attacker’s speech.

What do they want? Remote positions with access to internal systems, source code, financial data, or customer records. Once hired, they harvest credentials, exfiltrate data, or install backdoors. In several documented cases, attackers worked for months before discovery.

Real-World Cases

• US Federal Case (2024): A North Korean IT worker network systematically applied for remote technical positions at US companies, using deepfakes and stolen American identities. Dozens of companies unknowingly employed them, providing salaries that funded the regime’s weapons programs.
• Finance Sector Incident (2024): A UK-based financial firm was defrauded of $25 million after a video call with what appeared to be company executives — all deepfake-rendered participants in a group meeting.
• Tech Startup Hiring (2023): Multiple startups reported hiring developers who passed video interviews but could not perform basic tasks once employed. Post-hire investigation revealed the interviewed person and the employed person were different individuals.

Visual Warning Signs Interviewers Can Detect

You do not need forensic software to notice early warning signs. Human observers can detect many deepfake artifacts with attentive observation.

Facial Edge Artifacts

The boundary between the deepfake face and the real background (or neck/hair) is frequently unstable. Look for:

• A subtle blurring or smearing at the jawline, ears, and hairline
• The face appearing to float slightly in front of the background rather than be part of the scene
• Color mismatch between facial skin tone and neck/hands

Lighting Inconsistencies

A deepfake face is rendered from a training dataset — its lighting is baked in, not calculated from the real environment. Warning signs:

• The face appears lit from a different direction than the room and background
• Shadows on the face do not match shadows on clothing or walls
• Specular highlights (eye reflections, forehead glare) are absent or positioned incorrectly

Unnatural Blinking and Eye Movement

Early deepfake models had notorious difficulty with eye blinks — the classic “blinking problem” is largely fixed now, but artifacts remain. Watch for:

• Blink rate anomalies — either too infrequent (early models) or mechanically regular
• Eyes that appear slightly glassy or unfocused compared to normal human gaze
• Lag between head movement and eye movement

Temporal Inconsistencies

Real-time face swap runs at limited frame rates. Under movement:

• The face may lag behind head motion by a few frames
• Rapid head turns can cause the deepfake to momentarily lose tracking, revealing the real face underneath for a frame or two
• Hair and accessories (glasses, earrings) may clip through or around the deepfake face overlay

Audio-Visual Desync

Voice changer pipelines introduce latency. Look for:

• Lip movements that are slightly ahead or behind the audio
• Mouth shape that does not precisely match phonemes
• Unnatural voice artifacts — metallic quality, formant distortion, sudden pitch shifts

Technical Detection Methods

Visual inspection is useful but not conclusive against high-quality deepfakes. Technical methods provide stronger evidence.

Video forensic analysis examines individual video frames for:

• Compression artifact inconsistencies between the face region and background
• Frequency domain anomalies (FFT analysis) specific to neural rendering
• Temporal coherence failures across frames

Metadata analysis of recorded video files can reveal:

• Virtual camera driver signatures in device metadata
• Inconsistencies between declared recording device and actual technical characteristics
• Missing or suspicious encoding parameters

Liveness detection challenges during the interview:

• Ask the candidate to hold up an object (a pen, a specific number of fingers) — this tests whether the face-swap system can adapt to unexpected requests in real time
• Request head rotations at specific angles — extreme angles reveal face-swap artifacts
• Ask them to move their face close to the camera — zoom stress tests the compositing quality

How Companies Should Protect Themselves

Before the Interview

• Require a government-issued ID verification step via a third-party identity platform (Persona, Onfido, Stripe Identity) before scheduling a video interview.
• Cross-reference the application resume photo, LinkedIn photo, and ID photo — inconsistencies are a red flag.
• For sensitive roles, require an in-person interview or notarized identity verification.

During the Interview

• Use video conferencing platforms with built-in liveness detection where available.
• Assign a second observer whose sole job is to watch for visual artifacts rather than assess competence.
• Conduct a spontaneous challenge — ask the candidate to perform an action not predictable in advance.
• Record the session (with consent) for post-hoc forensic review.

After the Interview

• Run recorded video frames through forensic analysis tools before making an offer.
• For high-sensitivity roles, make the final offer contingent on successful identity re-verification.

Using FakeRadar for Video Frame Analysis

FakeRadar’s Pro tier supports video upload and frame-by-frame analysis. For suspected deepfake interview recordings:

1. Export the video recording from your conferencing platform.
2. Upload the file to FakeRadar — the system extracts key frames and analyzes each for deepfake signals using Hive AI classification, FFT frequency analysis, and ELA heatmaps.
3. Review the per-frame confidence scores and artifact heatmaps. Frames during rapid head movement or emotional expression are most likely to show artifacts.
4. Use the shareable analysis link to include forensic evidence in a hiring decision report or security incident response.

A single deepfake hire in a sensitive technical role can cost an organization far more than the time invested in verification. The tools to defend against this threat exist — using them is now a baseline due diligence requirement for remote hiring.

Deepfake interview fraud is not a theoretical future threat. It is happening today, at scale, across industries. The candidates passing your video screening may not be who they appear to be.

Check a suspicious recording now: Upload to FakeRadar for frame-by-frame deepfake analysis. Or learn more about how our detection methods work on the blog.