Candidate fraud: the world is changing.
How fake candidates get hired, why the checks that caught them in 2023 miss them now, and four questions to ask anyone selling fraud checks. Jason Zoltak's RecOps Con 2026 session, written up as a free guide.
What you'll learn.
One impersonated applicant, followed through three waves of fraud detection.
- CH. 01
How a fraud operation works.
Six stages, from fake job posts that harvest real candidates' IDs to the referral that brings in the next hire.
- CH. 04
Why the basics stopped working.
One applicant's record in 2023 and today. VOIP numbers became real phone numbers, new emails became accounts with years of history, and many basic checks now come back green.
- CH. 05
What a shared network sees.
Real names, borrowed or stolen, used again and again across companies.One name: 396,000 applications · 11,000 identities: 2.1M applications · Tofu network data, Oct 2023 to Sep 2026
- CH. 06–08
The signals most vendors can't see.
The device behind the application, and an agent that checks every claim on a resume against public records.
- CH. 10
Four questions to ask a vendor.
Each with the weak answer and the strong one, so you can test any fraud check, ours included.
Who is Jason.
Every vendor says they catch fraud, us included.
Ask every one of them how.
I'm the CEO and co-founder of Tofu. We started out building AI to screen resumes, and that's where we first saw how many of the strongest-looking applicants weren't real. So my co-founder and I turned caller ID off and started calling the people on those resumes. A lot of them didn't sound like the names on the page. That was about a year before most companies cared. Now I talk to recruiting and security leaders about it every day, and in October 2026 I ran the candidate fraud session at RecOps Con in Chicago.
Candidate fraud, answered.
What is candidate fraud?
Candidate fraud is someone applying for a job as a person they are not. Operations steal real candidates' IDs and resumes through fake job posts, rebuild them as new profiles, apply at scale with AI-written resumes, and send a proxy or a deepfake to the interview. Once hired, they refer the next one.
Why don't background checks catch fake candidates?
Background checks confirm information against a database. They don't confirm identity. They run after the offer, on the stolen identity of a real person with a clean record, so the check passes.
How do North Korean IT workers get hired by US companies?
They apply under real names, borrowed or stolen, with real phone numbers and email accounts that have years of history. On October 13, 2026, the US Justice Department announced an indictment describing a scheme that reached more than 70 US companies and earned about $3 million, and FBI searches of more than 40 Texas homes that seized about 187 laptops and devices.
Source: US Department of Justice, October 13, 2026.
What should I ask a candidate fraud detection vendor?
- What signals do you look at?
- You offer device, IP, and VPN data? How do you get it when the ATS doesn't send it?
- How far back does your data go?
- How do you use interview and deepfake data in your fraud detection?
The guide gives the weak answer and the strong answer to each.
What is a proxy interview?
A proxy interview is when someone other than the applicant sits the interview for them. In candidate fraud operations, proxies interview for stolen or borrowed identities, sometimes behind a deepfake face. Some proxies are real people with real work histories who are paid to pass the interview and take the job, then hand the work to someone else. Jason Zoltak calls proxies the hardest type of fraud to catch.
What happens after I enter my email?
We'll email you a copy of the ebook.