What to do the moment you suspect a deepfake in an interview

Picture this moment: you're 20 minutes into a technical interview, the candidate's face goes soft at the edges every time they look down, and you have no idea whether you're watching a face-swap or a bad webcam.

The test that would tell you is asking a stranger to wave their hand in front of their face. Awkward.

I look at the questions people type before they land on our site. "How to catch deepfake interview fraud" showed up plenty over the last six months, and most of what's written about it covers spotting the fake and skips the half hour after, when someone has to decide what happens next. This is a problem that, unfortunately, will only become more common.

How common are deepfake and stand-in interviews?

Common enough that most hiring teams will meet one. In a Gartner survey of 3,000 job candidates in the second quarter of 2025, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them. People admitted it on a survey, so the real number is probably higher. Gartner also predicts that by 2028, one in four candidate profiles worldwide will be fake (a projection, not a measurement).

The tools are cheap. A Unit 42 researcher at Palo Alto Networks built a real-time deepfake for job interviews in about 70 minutes, with no prior experience and a computer that was five years old. And the FBI warned in January 2025 that North Korean IT workers have been seen using AI and face-swapping technology to hide who they are.

What are the signs a candidate is using a deepfake?

The clearest signs show up when the face moves or something covers it. Unit 42's own test found four weak spots in a real-time face-swap:

• Fast head movement. Quick turns make the face tracking lose its place, and visible glitches show up.
• Something in front of the face. A hand passing over the face is the most reliable way to break it; the software can't rebuild the half that's hidden.
• Lighting changes. A sudden change in light exposes the rendering, especially at the edges of the face.
• Lips out of sync. A small delay between the mouth and the voice, if you're watching closely.

Some signs aren't about the video at all. A candidate who keeps the camera off with a different excuse each round. Answers that sound read rather than remembered. A voice or face that doesn't match the person from the first call, which is what seat swapping looks like from the interviewer's chair.

None of these proves anything on its own. Bad bandwidth smears faces too, and plenty of real people have ring lights that do strange things, so treat a sign as a reason to check and nothing more.

What should the interviewer do during the call?

Stay in the interview. Ending it early tells a fraudster what gave them away, and if you're wrong, you've just been rude to a real candidate with a bad connection.

Then run a check that feels like part of the conversation:

1. Ask for a movement, if you can make it natural. "Can you turn to the side for a second? Your audio is cutting out." Or ask them to hold something up to the camera, like a notebook or a coffee mug. A full profile turn and a hand near the face are the two things Unit 42 found real-time face-swaps handle worst.
2. Ask a soft location question. The FBI suggests asking about specific details of where someone says they live. "Oh, you're in Austin? What part?" A real local answers without thinking.
3. Note the time. Write down the minute the odd thing happened and what you asked. "14:32, asked for profile turn, face blurred on the left side." Ten seconds now saves a fuzzy argument later.
4. Finish the interview normally. Same questions, same close, same "we'll be in touch."

Step one is the awkward one. You're asking someone who is probably a real engineer, in the middle of a system design question, to turn their head or put a hand in front of their face for no reason they can see. If they're real, they'll feel accused, and the glitch you saw was most likely their webcam. Plenty of interviewers skip it for that reason, and I'd rather nobody had to ask.

What not to do: don't announce that you think they're fake, don't ask them to prove they're human, and don't screen-record without consent. Unit 42 recommends recording interviews for forensic review, but with proper consent, and that's a policy your team sets ahead of time, not a decision an interviewer makes mid-call.

What happens after the call?

After the call is where most teams lose the thread. The interviewer mentions it on Slack, someone replies with an eyes emoji, and the candidate moves to the next round anyway.

Write it down the same day. Timestamps, what you asked, what happened, and anything from earlier rounds that now looks different. Keep it to facts you saw ("face blurred during the profile turn") rather than conclusions ("he's using a deepfake"), so someone else can check them.

Send it to a named owner. Pick one person in recruiting operations or security who gets these reports, before you need them. If the answer to "who do I tell?" is a shrug, write that down too, then fix it.

Verify identity before the next round. Compare the candidate against the earlier interviews: same face, same voice, same story? Then ask for an identity check, on camera, with an ID. The FBI recommends doing as much of hiring and onboarding in person as you can, and Gartner suggests in-person interviews as an anti-cheating step (62% of candidates in its survey said in-person interviews made them more likely to apply).

Can we reject a candidate because we suspect a deepfake?

Every TA leader asks this next, and fairly. A suspicion on its own isn't a reason anyone wants to defend later, and your legal team decides what is.

What the steps above give you is facts to work with. A candidate who passes the identity check moves on, and you've lost 15 minutes. A candidate who suddenly can't make the next call, or who shows up as a different person, has given your team something much firmer than "the video looked weird."

Who should own deepfake response on a hiring team?

One person, with a one-page runbook written before the first incident that covers:

• Who interviewers send reports to, and how fast that person replies.
• What the verification step is (ID check, live call with camera, in-person meeting).
• What the candidate is told, by whom, and in what words.
• When security gets pulled in, for example when the same face or details turn up under a second name.

If you hire engineers remotely, your security team probably cares about this. North Korean IT worker schemes are a security problem first, and the security team is often a target of fake applicants themselves.

Do you have to ask candidates to prove they're real?

Not if software does the checking. For me, that's the strongest case for deepfake detection: peace of mind without the weird moment. Interviewers also miss things. They're busy evaluating the answers, and a better face-swap than the one Unit 42 built in an hour may not glitch on a head turn at all.

Tofu's deepfake detection runs in the background of interviews on Zoom, Google Meet, Teams, and AI note-takers like BrightHire. It looks at lip syncing, eye movement, facial construction, voice patterns, and hints of AI overlay, and it checks that the candidate on this call is the same person from the last one. Nobody asks the candidate to do anything, so a real one never gets the awkward request. When something's off, the interviewer gets an alert, which turns "I had a weird feeling" into something the hiring fraud owner can act on. (The longer case for checking several signals at once is in why deepfake detection needs multiple signals.)

It also takes the interviewer's eye out of the false-flag business. A blurry face on a bad connection is a reason to wonder, and judging it by eye is how real candidates end up under suspicion. You still want the notes and the named owner, since someone has to act on the alert.

What I can't tell you yet is how long the hand-over-the-face test keeps working.