Real deepfake job candidates and what caught them

Four companies have described their own fake candidates in detail: KnowBe4, Vidoc Security Lab, Pindrop, and Kraken. Two of the five candidates wore a face swap on a live video call. In four of the five, a person on the hiring side noticed something off before any tool did. The fifth got all the way to a company laptop.

People ask us for a real example of a deepfake job candidate pretty often. They want a company that interviewed one, in that company's own words. So I went looking for every case a company has written up in public.

Every company on that list is a security vendor or a crypto exchange. The federal cases involve far more employers, and they name none of them. So the public record is mostly teams that hire security people for a living, caught a fake, and chose to talk about it (fair, I wouldn't volunteer it either).

What are real examples of deepfake job candidates?

KnowBe4, July 2024: four video interviews and a doctored photo

KnowBe4, a security awareness training company, hired a software engineer for an internal AI team. HR held four video interviews and confirmed the person matched the photo on the application. The background check and references came back clean, because the identity was valid. It had been stolen from a real US person. The photo had started as a stock image and been "enhanced" with AI.

What caught it was the laptop. When the new hire's Mac arrived, the company's endpoint security software flagged malware loading on it. The security operations team contained the device about 25 minutes after the activity started. KnowBe4's founder published the full timeline on the company blog and says no data was lost.

KnowBe4 describes an AI-altered photo and says nothing about a face swap on the calls. I included it because it's the case most people mean when they say a company hired a deepfake.

Vidoc Security Lab, early 2025: two candidates, one avatar

Vidoc is a small security company that was hiring backend engineers, and its March 2025 write-up covers two fake candidates. The first passed the screening call and two coding interviews. On the final call his camera was blurry and his voice ran ahead of the video. His accent didn't fit where he said he grew up, either. The interviewer asked about his home country and his school. Then came questions on what time zone his last team worked in, and about the culture he said he was raised in. His camera froze, it wouldn't come back on, and the interviewer ended the call.

The second had a decent CV, a LinkedIn profile with some shared connections, and a normal-sounding HR screen. In the technical interview with co-founder Dawid Moczadło, the face on camera didn't match his LinkedIn photo and looked almost artificial. Moczadło asked him to put a hand in front of his face. He refused, and Moczadło ended the call, which he had been recording the whole time.

Pindrop, 2025: the same candidate with a different face

Pindrop sells deepfake detection (as we do, for what it's worth). In April 2025 its chief people officer described a candidate the company calls "Ivan X", who applied for a senior backend engineering role. On video, his expressions lagged his words and his audio dropped out or drifted from his lips. He also paused oddly before an unexpected technical question, and Pindrop's own detection product confirmed a deepfake.

Eight days later he applied again through a different recruiter. The person who joined looked different but used the same identity and credentials. He dropped off the call, rejoined, and showed the same lag, with a slightly better deepfake.

Read this one knowing it's a vendor describing its own product catching a fake. The return visit is still the most useful detail on this list, and I'll come back to it.

Kraken, May 2025: the restaurant question

Kraken, the crypto exchange, described a candidate for an engineering role in a May 2025 post on its blog. The candidate joined the first recruiter call under a different name from the one on their resume. They sometimes switched voices mid-call, which Kraken read as someone being coached. Their email also matched a list of addresses that industry partners had tied to North Korean hackers.

Kraken didn't reject them. Bold move. The security team kept the candidate in the process to learn how the scheme worked. The final round was billed as a casual chemistry interview with the chief security officer. In it, the team asked the candidate to verify their location and hold up a government ID. They also asked for a few restaurant recommendations in the city the candidate claimed to live in, and the candidate couldn't answer any of it convincingly.

The federal cases: no names, and a stand-in on camera

The Justice Department's October 2026 action against North Korean IT worker schemes alleges one scheme reached more than 70 US employers. It names none of them, and the charges are allegations until proven in court.

The same day, the FBI said in a public service announcement that these workers now pay Americans to appear on camera and sit interviews, and pay freelancers to interview on their behalf. When a real person sits the interview, there's no deepfake on the call to catch. It worries me more than any face swap on this list.

What caught them?

Across the four companies there were five fake candidates, and something different exposed each one:

• Vidoc's first candidate: questions about home that he couldn't answer.
• Vidoc's second: a face that didn't match his profile photo, and a refused hand test.
• Pindrop's Ivan X: a recruiter noticed the lag, and detection software confirmed it.
• Kraken's candidate: a tip-off list, then location and ID checks in the final round.
• KnowBe4's hire: nobody on the hiring side, until security software flagged the laptop after it shipped.

The one that sailed through had a valid stolen identity and a clean background check behind it.

Reading them back, they all sound easy to catch. They are, after the fact. They're also the cases caught by teams whose whole business is spotting fraud. The hand-in-front-of-the-face test has an expiry date (I wrote about that in what to do when you suspect a deepfake mid-interview). And the FBI's newest notice says the schemes are moving toward real people on camera, which a hand test won't catch at all.

Do deepfake candidates come back after they're rejected?

The Pindrop case says yes. Ivan X reapplied eight days later through a different recruiter, with the same identity and a different face. If each round of your process is run by a different person, nobody may be placed to notice that the face changed.

Seat swapping is the same problem, where one person interviews and another shows up later. I covered the signs in what candidate seat swapping is and how to detect it. The fix is boring: compare each call against the first one, and against the profile photo, every time.

What can a hiring team copy from these cases?

Four things, all taken straight from the write-ups above.

1. Ask one off-script local question per final round. Restaurants, the commute, the nearest grocery store, the weather last week. Kraken's advice is to avoid predictable patterns, so rotate them. A genuine candidate answers without thinking.
2. Compare faces across rounds. Today's call against the first call and the LinkedIn photo. Vidoc's second candidate didn't even match his own LinkedIn photo.
3. Check location before the final round, not after the offer. Kraken's candidate struggled with where they lived, and KnowBe4 lists a laptop shipping address that differs from the employee's home as a red flag. Here's how to tell if a candidate is faking their location.
4. Treat the first week on the laptop as part of hiring. KnowBe4's fake passed every check HR had. Their security team caught it 25 minutes after it started.

Step two is the one we built a product around. Tofu's deepfake detection runs in the background on Zoom, Google Meet, and Teams, and tells you when the candidate on this call isn't the one from the last call. Ivan X's second application, eight days later with a new face and the same identity, is that case.