Home What governments say How common it is Why detection is losing What it costs an attacker Where the rules are going Is remote hiring going away? Security & roadmap Request pilot →
Primary sources  ·  Updated August 2026

Hiring fraud, in
other people's words.

Almost everything written about deepfake candidates recycles the same handful of unsourced statistics. This page does the opposite. Every claim below is quoted from the document it came from, dated, and linked — government advisories, court records, peer-reviewed research and named company disclosures. Where we could not find a primary source for a widely-repeated figure, we left it out, and said so at the bottom.

We sell a product in this market, so treat our opinions with suspicion. The sources below are not ours. They belong to the FBI, the US Department of Justice, eleven governments, the European Union, the UK Home Office, the US Bureau of Labor Statistics and several peer-reviewed research teams. Read them and reach your own conclusion.
Government primary document Peer-reviewed academic research Industry survey or company disclosure
01 — What governments say

The substitution is documented,
not theorised.

Government
“Capture images for comparison with future meetings. Sometimes an individual is employed to pass the initial interview, but the on-the-job work is completed by a different individual.”
The FBI, listing defensive measures for US businesses. The same advisory tells interviewers to “ask the individual to wave their hand in front of their face as it may prompt a malfunction in AI generated video”. — IC3 Public Service Announcement I-072325-4-PSA, 23 July 2025
Government
“Implement identity verification during hiring and throughout employment.”
The same agency, a year earlier. Note the second half of the sentence: not once at the door, but for the duration of the job. — IC3 Public Service Announcement, 16 May 2024
Government
“North Korean IT workers are increasingly likely to use third-party proxies to facilitate the creation of online accounts, participate in job interviews, and even establish in-person contact to create a false sense of trust and obtain work contracts.”
A joint alert from eleven governments and more than twenty agencies — the United States, Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom. It also flags an account that shows signs of being operated by multiple people, where “the individual whom a hiring or procuring official interacts with may change depending on the time of day”. — Joint alert, 31 July 2026
Government
The conduct included circumventing employer vetting, drug testing included
Guilty pleas covering more than 136 US victim companies, $2.2 million in revenue to the regime and the identities of more than 18 US persons. The conduct pleaded to included “defeating or circumventing employer vetting (including drug testing)”. Meeting someone once, in a room, is not the same as knowing who does the job. — US Department of Justice, 14 November 2025
Government
Searches across 16 states; more than 100 US companies infiltrated
A coordinated nationwide action: 29 suspected laptop farms searched, roughly 200 computers, 29 financial accounts and 21 fraudulent websites seized. — US Department of Justice, 30 June 2025
Government
Two facilitators sentenced to 108 and 92 months
The scheme they enabled reached more than 100 US companies, used the identities of at least 80 US persons, and generated over $5 million. — US Department of Justice, 15 April 2026
02 — How common it is

Both sides of the table
report the same thing.

Industry
35% of managers have seen someone other than the applicant in a virtual interview
From a survey of 3,000 US managers. In the same survey, 31% had interviewed a candidate later revealed to be using a fake identity. — Checkr, “The Hiring Hoax”, September 2025
Industry
6% of candidates admit to interview fraud outright
From a survey of 3,000 job candidates — “either by posing as someone else or having someone else pretend as them”. The same research projects that one in four candidate profiles worldwide will be fake by 2028. Self-reported wrongdoing is a floor, not a ceiling. — Gartner, 31 July 2025
Industry
A major IT services firm halted assessments for 20,000 candidates over impersonation
In June 2026 Infosys deferred online assessments and in-person evaluations for more than 20,000 applicants after detecting impersonation and assessment malpractice, and said it was introducing additional verification controls. — People Matters, 9 June 2026
Industry
A cybersecurity company hired one, after four video interviews
KnowBe4 published its own incident report: the candidate passed four video interviews plus background and reference checks, using a stolen identity and an AI-enhanced photograph. Malware was on the company laptop within minutes of delivery. — KnowBe4 incident report, 2024
03 — Why detection is losing

Detectors are tested in a lab.
Attacks happen elsewhere.

Peer-reviewed
Detector accuracy roughly halves on real-world deepfakes
Researchers from TrueMedia.org, the University of Washington, the Allen Institute for AI, Georgetown and others tested leading open detectors against deepfakes that actually circulated — 45 hours of video, 88 websites, 52 languages. Video performance fell from 0.96 to 0.63. Audio fell from 1.00 to 0.43, worse than a coin toss. — Deepfake-Eval-2024, CVPR 2026 workshop
Peer-reviewed
Humans detect deepfakes at 55.5% — statistically indistinguishable from guessing
A meta-analysis of 56 studies covering 86,155 participants. For video specifically, 57.3%. Whatever the control is, it cannot be the interviewer's eyes. — Computers in Human Behavior Reports, 2024
Industry
“30% of enterprises will no longer consider identity verification and authentication solutions to be reliable in isolation.”
Gartner's prediction for 2026, published in 2024. The operative phrase is “in isolation”. The answer to a failing detector is not a better detector; it is a second, independent channel. — Gartner, 1 February 2024
Standard
The liveness certification everyone cites does not cover injected video
ISO/IEC 30107-3 is the standard behind most “liveness tested” claims. Its own scope clause reads: “The attacks considered in this document take place at the biometric capture device during presentation. Any other attacks are considered outside the scope of this document.” An attacker who feeds video straight into the stream never goes near the camera — so the test says nothing about them. — ISO/IEC 30107-3:2023
04 — What it costs an attacker

Seventy minutes, and a
gaming graphics card.

Industry
A working synthetic interview identity, built in about 70 minutes
Palo Alto Networks' Unit 42 built one with no prior experience on a consumer gaming graphics card. Their recommended countermeasure is worth reading: ask the candidate for profile turns, hand gestures near the face and rapid head movements — because that is where real-time deepfakes visibly break. — Unit 42, 21 April 2025
Journalism
Virtual-camera injection tools sold openly, from around $30
A two-month investigation found 22 public Telegram channels selling bypass kits and stolen biometric data, with demonstration videos of successful attacks against named financial institutions. — MIT Technology Review, 15 April 2026
Journalism
One deepfaked video call cost an engineering firm $25 million
A finance employee in Hong Kong joined a video call on which the chief financial officer and every other participant were synthetic, and authorised the transfers. The company later confirmed it was the victim. — CNN, 16 May 2024
05 — Where the rules are going

One country has already
put a date on it.

Government
“maintain proportionate systems and processes to ensure that the individual carrying out the work or services is the same individual on whom a right to work check has been conducted.”
From 1 October 2026, a UK statutory code extends right-to-work duties to worker's contracts, sub-contractors and online matching services. The acceptable means it names include facial verification technology, and re-verification “no less than once in any 24-hour period of activity”. Meeting it is a condition of the statutory excuse against a penalty of £60,000 per worker. Both the code and its accompanying guidance are still in draft at the time of writing, and they word the interval slightly differently. — Draft Code of Practice on preventing illegal working
Government
£74.6 million of penalties in six months
The Home Office issued 1,238 civil penalties for illegal working in the first half of 2026, averaging close to the maximum. The rule above is not arriving into a vacuum. — Home Office, published 19 August 2026
Government
Inferring emotion or intent from a face in recruitment is prohibited in the EU
Article 5(1)(f) of the EU AI Act has banned inferring emotions from people in the workplace since 2 February 2025, and the European Commission's guidance states that the prohibition covers intentions as well as emotions, and reaches candidates during selection and hiring. The ceiling is €35 million or 7% of worldwide turnover. This is a prohibition, not a high-risk classification — there is no compliance path through it. — EU AI Act, Article 5
Government
Pure identity verification sits outside the high-risk tier
Annex III excludes, in its own words, “AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be”. Separately, Regulation (EU) 2026/1744 — in force 27 July 2026 — moved the remaining high-risk obligations, employment included, to 2 December 2027. The prohibitions above were not moved. — EU AI Act, Annex III · Regulation (EU) 2026/1744
06 — Is remote hiring going away?

Return-to-office is real.
So far it has moved one employer.

Government
22.2% of US workers teleworked in July 2026, and the figure has barely moved in two years
The US Bureau of Labor Statistics measures this every month. 11.0% worked entirely from home, and teleworked hours were 15.5% of all hours worked in the economy. In the BLS's own words, the rate “has ranged from 21.5 percent to 23.0 percent over the last year”. — BLS Current Population Survey — telework
Government
62.5% of computer and mathematical roles are still worked remotely
The occupation group with the highest telework rate in the BLS data is the same group targeted by the schemes in section 01. The roles most exposed to this fraud are the ones least likely to return to an office. — BLS Table A-42, July 2026
Government
The one place remote work genuinely collapsed was the federal government
Federal telework fell from 31.3% to 18.2% in twelve months following a presidential mandate. Private-sector telework over the same period was essentially unchanged. — BLS, The Economics Daily, 23 May 2025
07 — What we left out

Numbers we could not trace.

These figures circulate widely in this market — including, previously, in our own material. We went looking for the original source of each and could not find one, so they do not appear above. If you meet one of them in a vendor deck, ask where it came from.

Unsourced
“100,000 North Korean IT workers across 40 countries”
This appears to conflate IT workers with all North Korean overseas labour. The joint State Department, Treasury and FBI advisory says “thousands”. We use that instead.
Unsourced
“72.4% of recruiting leaders now conduct in-person interviews to combat fraud”
Attributed to a named analyst firm across many vendor pages. No public release from that firm contains it.
Unsourced
“In-person interview requests rose 500%, from 5% of roles to 30%”
Appears only in marketing content citing other marketing content. We could locate no primary source at all.
Unsourced
A detection-accuracy collapse figure we nearly used ourselves
A widely-repeated claim that one vendor's laboratory accuracy fell to a specific lower range under independent testing. The independent test happened and was unflattering — but the specific number has no traceable source. The peer-reviewed research in section 03 makes the same point properly, so we use that.
Corrections welcome. If you can source one of the above, or think we have mis-stated something, write to hello@verlinko.com and we will correct the page and say that we did. A page that only ever grows is not being maintained.
In closing

The question this evidence
points at.

Read together, these documents describe one problem: nobody checks that the person who passed the interview is the person who does the job. The FBI recommends capturing an image for comparison with future meetings. The UK is about to require that the person working is the person who was checked. That is what Verlinko is built to do.

How it works →   ·   What we hold, and what we refuse to build →