Deepfake job interviews: what hiring teams and candidates should keep

This is general information for hiring teams and for candidates, mainly in the US, the UK and the rest of Europe. It is not legal, employment or immigration advice, and it is not a substitute for reporting a suspected crime to the FBI’s Internet Crime Complaint Center or to local police. Official tips below are summarised from named FBI and IC3 alerts; they can change, and they are not a guarantee that a person on a video call is who they claim to be.

What official agencies have actually said

On 28 June 2022, IC3 published an alert, “Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions.” It reported an increase in complaints that deepfakes and stolen personally identifiable information were being used to apply for remote and work-from-home roles, especially in information technology, programming, database and software work, including some roles with access to customer data, financial data or corporate systems. It defined a deepfake as a video, image or recording convincingly altered to misrepresent someone as doing or saying something they did not do or say. Complaints described voice spoofing, or potentially voice deepfakes, during online interviews, including lip movement and on-camera actions that did not line up with the audio, and coughing or sneezing that did not match what was shown. Some victims reported that their identities had been used, and that background checks later showed the personal details given by an applicant belonged to someone else.

On 23 January 2025, a further IC3 alert, “North Korean IT Workers Conducting Data Extortion,” recommended identity-verification throughout interviewing, onboarding and employment of remote workers. In that section, the FBI stated that North Korean IT workers “have been observed using artificial intelligence and face-swapping technology during video job interviews to obfuscate their true identities.” The same alert also recommended completing as much hiring and onboarding as possible in person, and checking for reused phone numbers, email addresses and near-identical résumés.

On 23 July 2025, IC3 published alert I-072325-4-PSA, “North Korean IT Worker Threats to U.S. Businesses.” It described U.S.-based facilitators who, among other things, attend virtual interviews and meetings on behalf of North Korean IT workers, help buy AI models and background-check services, and receive company laptops. Its tips for virtual meetings include mandating video with an unobscured background, asking the person to point the camera out of a window and answering questions about the claimed location, and asking them to wave a hand in front of their face “as it may prompt a malfunction in AI generated video.” The word is “may.” A clean wave does not prove the person is genuine. The same alert says to capture images for later comparison, because sometimes one person passes the interview and a different person does the work, and not to grant system access until a background check is complete.

The FBI’s 2025 Internet Crime Report, in its section on AI used in cybercrime, discusses employment fraud separately. It describes voice spoofing, or potentially voice deepfakes, during online interviews of applicants, and notes lip movement and other actions that do not fully line up with the audio. It reports that in 2025, victims reported losses of almost $13 million to AI-involved employment type scams. That figure is what was reported to IC3 under that heading. The report also says there did not seem to be significant dollar loss associated with some of this activity where the apparent goal was access to private computer networks rather than a direct cash theft. Those are not a count of every fake interview.

Two problems that get mixed together

A widely watched 2026 video, Graham Raabe’s “I Sent an AI to My Job Interview. So Did the Company,” published on 12 October 2026, is one example of public interest in AI on both sides of a hiring call. That video is a creator experiment. It is not an official case report, and it should not be read as proof of how common either practice is.

The official warnings above are mainly about a fake or disguised candidate: a deepfake or a stand-in on a video call, sometimes using stolen identity details, aiming at a remote job and, in the later FBI alerts, sometimes at network access. That is a security and identity problem.

A different problem is a company using an automated interview tool to question a real applicant. That may be a policy, contract or fairness issue, but it is not the same as a deepfake applicant. A TimeBind of your own assignment or portfolio does not tell you whether the interviewer was a person or a tool. Keep those questions separate.

If you are hiring

The FBI’s July 2025 and January 2025 alerts are written for businesses, not as a consumer gadget list. The practical points, as those pages state them, are:

• Verify identity in the interview, at onboarding, and later. Cross-check photographs and contact details against profiles, portfolios and payment platforms, and look for reused phone numbers, email addresses or near-identical résumés.
• Verify prior employment and education directly with the institutions named, not only from documents the applicant sends.
• Prefer in-person steps where you can. If the meeting is virtual, require visible video, an unobscured background, and simple location or movement checks. Treat those checks as incomplete. The hand-wave tip is phrased as something that may disrupt a generated video, not as a test that a person has passed.
• Keep a copy of what you were sent and, where you are allowed to, a recording or stills from the call, so you can compare the person at a later meeting. The July 2025 alert specifically notes that a different individual may do the work after someone else has passed the interview.
• Do not grant system access, and do not ship a laptop to an address that is not the one on the identity documents, until the checks you rely on are done.
• If you suspect this activity, the official alerts ask you to report it to ic3.gov and to your local FBI field office.

Save the résumé, covering letter, portfolio files, identity images and any assignment exactly as they arrived, with the message or portal record that brought them. If you TimeBind those files, you are dating what you received, not proving that the person on the call was the person named in the documents.

If you are a candidate

A genuine applicant can still be asked to prove which files were theirs, especially if a later dispute arises about a take-home test, a portfolio, or a recording of the round. The useful habit is ordinary and boring:

• Keep the exact files you submitted: the CV, the portfolio export, the take-home assignment, and any identity or right-to-work document you were asked to send, as those files, not only a later revision.
• Keep the application or email as sent, including the date and the address you sent it to.
• If the process allows you to keep a copy of a recorded interview or a written exercise, store that copy unaltered.
• If you TimeBind anything, date the files you actually submitted, before you overwrite them with typo fixes.

None of that proves you were the person on the video call, and it does not prove you will get the job. It only supports the account that those exact files existed by that date and still match.

What a TimeBind can and cannot show

A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The fingerprint is made in your browser and the file stays on your device. You get a Proof of Time Certificate. Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15.

In this situation, that record is useful for the paperwork around a hire: the résumé as received, the assignment as submitted, a portfolio export, or a recording you were allowed to keep. It can help you show that those exact files existed by that date.

It does not detect a deepfake. It does not show who sat in front of the camera, whether a face-swapping tool was used, or whether a different person later did the work. A TimeBind of a fabricated CV is still a fabricated CV, with a date. Do not treat a timestamp as a substitute for the identity checks in the official alerts, or as a way to prove you “are not AI.” For short definitions of deepfake, liar’s dividend and related terms, see the AI fakes and file-integrity glossary.

Sources checked

• FBI Internet Crime Complaint Center, “Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions,” 28 June 2022.
• FBI Internet Crime Complaint Center, “North Korean IT Workers Conducting Data Extortion,” 23 January 2025 (including the face-swapping observation in the remote-hiring recommendations).
• FBI Internet Crime Complaint Center, alert I-072325-4-PSA, “North Korean IT Worker Threats to U.S. Businesses,” 23 July 2025.
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report, section “Artificial Intelligence (AI) Used in Cybercrime,” employment subsection (PDF).
• FBI Internet Crime Complaint Center reporting site, ic3.gov.

A related free checklist for suspicious calls or video meetings is the AI Voice Scam Red-Flags Checker. It does not analyse a recording or detect a stand-in, and it is not a hiring decision tool.

Start a dated record of the files you already have

Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.