Who are fake candidates in IT recruitment and how can you avoid being deceived by them?

The phenomenon of fake candidates in recruitment processes, which until recently seemed like just a curiosity discussed on LinkedIn, has now become a real problem. IT recruitment agencies and IT staffing companies around the world – including in Poland – are increasingly struggling with this issue. According to forecasts by Gartner, within the next three years as many as 25% of all candidates may turn out to be fake. This means that every fourth candidate in a recruitment process could attempt to deceive an IT recruiter by pretending to be someone they are not.

Article outline

1. Who are fake candidates in IT recruitment?

2. The scale of the fake application problem in Poland and worldwide

3. Two types of fake candidates in IT recruitment processes

4. Warning signs that should halt the IT recruitment process

5. OSINT and sourcing in detecting fake candidates

6. Automation is not enough – why must humans still be part of the recruitment process?

7. A systemic approach to the fake candidate problem – the TalentShield process

8. Candidate experience and process security

Who are fake candidates in IT recruitment?

Fake candidates in IT recruitment are applicants who impersonate highly sought-after specialists on the market or artificially inflate their competencies – often with the help of AI. The most common warning signs include: a new or empty LinkedIn profile, an AI-generated photo, unverifiable certificates, issues during video interviews, and vague or overly rehearsed technical answers.

Although some of these warning signs may seem obvious, in practice many of them only become apparent at later stages of the process. In the following part of the article, we show how to distinguish real risk from a false alarm and how to design a verification process that does not prolong recruitment, but genuinely protects it.

The scale of the problem – it’s no longer just the United States

The U.S. Department of Justice recently announced the arrest of a group of individuals who impersonated IT specialists to gain access to corporate systems and financial resources. Media outlets such as Fortune report that the number of such cases has increased by more than 220% year over year.

In Poland, this phenomenon is also gaining momentum. IT recruitment companies and IT staffing agencies are increasingly encountering applications from candidates who:

•       provide a false identity and fictitious work experience

•       claim to be employees of non-existent companies

•       use altered voices or someone else’s face during video interviews

•      claim false citizenship

Two types of fake candidates

This issue particularly affects fully remote job offers published on job boards, where candidate verification is more challenging. In recent years, the scale of the phenomenon has evolved into a systemic threat – not only to individual companies, but also to national security.

IT recruiters increasingly have to verify not only candidates’ competencies, but also their actual identity. Recruitment security experts distinguish two distinct types of fake candidates, which differ both in their methods of operation and in the level of risk they pose to an organization:

Type 1: Completely false identity

Candidates of this type impersonate people they are not – using fabricated identities, fictitious work experience, and non-existent companies on their CVs. They claim false citizenship, often to bypass legal restrictions or to gain greater trust from the recruiter. This is the most serious and dangerous category, as the real objective of such candidates is usually to gain access to a company’s internal systems, databases, or financial resources – not to perform the job itself.

A particularly alarming aspect of this practice is the use of voice and image manipulation technologies during recruitment interviews. In the case of voice, fraudsters use real-time voice-changing software – tools such as ElevenLabs, Voicemod, and dozens of lesser-known applications allow users to modify their voice, accent, and even perceived gender on the fly. As a result, the recruiter may be hearing someone entirely different from the person actually sitting behind the microphone. In video interviews, deepfake technology is used – an AI-generated overlay that replaces the fraudster’s face and facial expressions in real time with those of another person. The effect is becoming increasingly difficult to detect with the naked eye, especially in low-resolution calls or poor lighting conditions. There have been cases where the same individual applied simultaneously for dozens of positions, each time assuming a different visual and vocal identity.

Type 2: Real person, artificial competencies

The second type of fake candidates consists of real individuals – they use their own name, their own face, and their authentic voice. The problem lies elsewhere: their professional profile has been deliberately and systematically inflated with the help of AI tools.

The pattern is repeatable. The candidate pastes the job description into ChatGPT or a dedicated CV generator and receives a ready-made document in which their modest or outdated experience is rewritten in the language of an expert – complete with relevant keywords, impressive project names, and a carefully tailored technology stack. Some tools automatically tailor a CV to dozens of job postings at once, optimizing it for ATS systems that companies use for initial application screening. As a result, a candidate who has never worked commercially with a given technology may reach a technical interview as a supposed expert with several years of experience.

On paper (or on screen) such a profile looks convincing. The truth only comes out when the candidate faces a real problem: during a technical interview, a recruitment task, or the first weeks on the job. Their knowledge turns out to be superficial, selective, or nonexistent. The candidate knows the terminology but does not understand the underlying concepts. They can describe a technology they have never actually used in practice. This phenomenon becomes particularly costly in recruitment processes for senior and lead positions, where verifying competencies is more complex and the consequences of a bad hire are far more serious.

A real story: Who is Maciej?

One of the first widely discussed fake candidate cases on Polish LinkedIn was described by Sylwia Jarząb, Senior Talent Acquisition Specialist at Transition Technologies PSC.

The candidate (introducing himself as “Maciej”) applied for the position of Senior Golang Developer. Today, his case is cited in the recruitment industry as a textbook example of how to identify a fake candidate before any damage is done.

The first warning signs

As early as the application review stage, several signals emerged that should raise concerns for any experienced recruiter. None of them alone proved fraud – but together, they formed a clear pattern of irregularities:

• Phone number – a Warsaw landline number instead of a mobile one, which is uncommon today and may indicate the use of a virtual VoIP number assigned to a specific location.
• CV – lengthy, saturated with buzzwords characteristic of AI-generated text, featuring flashy graphics and colors that deviate from typical European recruitment standards.
• Experience – an impressive but difficult-to-verify list of employers, including brands such as Google and Visa.
• Language of the conversation – an immediate request to switch to English during the very first phone call, despite having a Polish first and last name on the application.

During the conversation, it became clear that the request to speak in English was merely a rehearsed phrase. The longer the call lasted, the more evident it became that the candidate had a poor command of English. Sylwia decided to conduct an “online investigation,” which revealed even more troubling facts.

What did the research reveal?

Sylwia decided to verify the candidate beyond the interview by independently checking every element of his professional profile. The results were clear:

• LinkedIn profile – recently created, with no activity, connection history, or recommendations; profile photo generated by AI.
• Companies listed on the CV – either did not exist or had never employed a person with the provided details.
• University – the listed institution did not have a computer science department.
• IT certifications – falsified; the identification numbers did not appear in any official verification database.

This case demonstrated how crucial thorough candidate verification is, especially in IT recruitment, where access to company systems and data can be critical to an organization’s security.

Red flags – warning signs that should raise concerns

Identifying a fake candidate rarely comes down to a single obvious signal. Much more often, it involves several seemingly minor irregularities that only together create a concerning picture. Experienced IT recruiters and IT staffing agencies emphasize that the key is attentiveness at every stage of the process – from reviewing application documents and verifying contact details to conducting the interview itself. Below, we have compiled the most important red flags that should prompt a deeper verification of a candidate.

1. Technical issues during a video interview

Technical difficulties during a video interview are one of the most common signals that a candidate may be hiding their true identity or using tools to manipulate audio and video:

• Lack of synchronization between audio and video – a characteristic symptom of real-time deepfake overlay usage.
• Unnatural lip movements while speaking – imperfect alignment between facial animation and the spoken words.
• Repeated camera issues or requests to turn off the video – a classic way to avoid visual verification.
• Artificial background – may conceal the use of face-swapping software or suggest a non-standard working environment.

2. Inconsistencies between the CV and online profiles

Application documents submitted by fake candidates usually contain elements that do not stand up to verification. It is worth cross-checking all available sources of information about the candidate:

• AI-generated CV – filled with generic statements and industry buzzwords, overly long, with flashy design elements that deviate from typical European standards.
• Lack of consistency between the CV and the LinkedIn profile – different dates, job titles, or employer names.
• New LinkedIn profile with no activity – no connection history, no recommendations, and an AI-generated profile photo.
• Different contact details across sources – discrepancies between the CV, LinkedIn profile, and the application form.

3. Suspicious contact details

Contact details are one of the easiest elements to falsify — and at the same time, one of the first things worth verifying:

• Landline numbers instead of mobile numbers – may indicate the use of a virtual VoIP number assigned to a specific location.
• International dialing codes inconsistent with the declared location – for example, an East Asian phone number paired with a Polish residential address.
• Email addresses from free providers with unusual names – especially suspicious when combined with other warning signs.
• Inability to verify the phone number via SMS – the number does not accept calls or the verification code never arrives.

4. Irregularities during the interview

The interview itself (whether by phone or video) often provides the most valuable signals. It is important to pay attention not only to the content of the answers, but also to the way the candidate behaves:

• Delays in responses – characteristic pauses suggesting that someone may be prompting the candidate in real time or that they are using AI to generate answers.
• Rehearsed phrases without deeper understanding – the candidate uses terminology fluently but cannot explain core concepts or relate them to practical examples.
• Inconsistency between the declared and actual language proficiency – fluent communication at the beginning of the interview that clearly deteriorates as the conversation progresses.
• Avoiding specific technical questions – redirecting the conversation to generalities or asking to change the subject.

It is worth remembering that none of the above signals alone constitutes proof of fraud – sometimes an honest candidate simply has a poor internet connection or is genuinely nervous during the interview. However, the more red flags appear simultaneously, the higher the likelihood that you are dealing with a fake candidate. In such situations, standard verification is not enough – enhanced identity verification is necessary, preferably using dedicated tools or verification procedures applied by specialized IT recruitment agencies.

How to verify suspicious profiles? Sourcing tricks and OSINT

The ability to recognize red flags is only the first step – equally important is knowing what to do when the first doubts arise. Verifying a suspicious candidate requires both familiarity with OSINT tools and specific sourcing techniques that allow you to confront declarations with reality. Agnieszka Rachwalak shared her proven tips with us. She is a recruiter at Sonalake and a trainer at Super Source Me, and she works daily with cases where standard verification methods prove insufficient.

1. Profile photo verification

A profile photo is one of the easiest elements to fake, and one of the first things worth checking. Freely available online tools allow you to verify within minutes whether you are dealing with a real person:

• Reverse image search in Google – allows you to check whether the photo comes from a stock image library or is being used by multiple different individuals at the same time.
• AI-generated face detection tools – such as Hive and Is It AI – help identify images created by artificial intelligence.
• Visual detail analysis – pay attention to strange or blurred backgrounds, unnatural-looking eyes, facial asymmetry, and inconsistencies in lighting, which are characteristic of AI-generated images.

2. Employment history verification

Fictitious companies listed on a CV are one of the most common elements of a fake professional profile. Employment verification does not have to be time-consuming – a few checks in publicly available sources are often enough:

• Company existence verification – check the employer’s name in Google, on LinkedIn, and in national business registers (in Poland: KRS and CEIDG).
• Company industry profile – make sure the company actually operates in the IT sector and that its scope of activity is consistent with the position declared by the candidate.
• Company activity on LinkedIn – does the company profile exist, does it list employees, and is it regularly updated?
• Contacting former employers – if possible, reach out directly to confirm the candidate’s employment history.

3. Education and certification verification

Falsified certifications and fictitious universities are red flags that can be relatively easy to expose – most reputable educational and certification institutions provide online verification tools:

• University verification – check whether the listed institution actually has the faculty or program indicated by the candidate.
• Official certification platforms – certifications from Amazon Web Services, Microsoft, Google, and other providers can be verified directly on the issuing organizations’ websites.
• Certification ID numbers – every legitimate certificate has a unique identification number that should be verifiable in the issuer’s database; a missing record or an invalid number is a clear red flag.

4. Analysis of the LinkedIn profile

LinkedIn is often treated as a reliable source of information about a candidate, but fake profiles are just as common there as in CVs. Several elements allow you to quickly assess the authenticity of an account:

• Profile creation date – accounts created just a few weeks or months before the application are significantly more suspicious than profiles with a multi-year history.
• Profile activity – the absence of posts, comments, and reactions suggests that the account may have been created solely for recruitment purposes rather than genuine professional presence.
• Number of connections – a very small network or a complete lack of connections is a clear warning sign, especially for a candidate claiming many years of experience.
• Recommendations and endorsements – check whether they come from real, active profiles and whether they are consistent with the candidate’s declared career path.

Candidate verification does not have to be complicated or time-consuming – most of the methods described above can be carried out within minutes using free online tools. The key is consistency: applying the same verification steps to every candidate, not only to those who immediately raise concerns. A fake candidate rarely makes one major mistake – much more often, they leave behind multiple small traces that together form a coherent picture of fraud.

Automation is not enough – why must humans still be part of the recruitment process?

The tools and ATS plug-ins available on the market can automatically detect suspicious profiles and flag potential fake candidates already at the initial screening stage. However, experts agree: automation is support, not a substitute. The “human in the loop” principle – meaning the active involvement of a human in the verification process – remains essential.

When can automation help?

Tools work best where recruitment volume is high and the time available for individual verification is limited:

• In high-volume recruitment, where an IT staffing agency receives thousands of applications within a short period of time.
• When the candidate pool is large enough to tolerate a certain percentage of false positives without risking the loss of all valuable profiles.
• For the initial flagging of suspicious applications, which are then passed on for human verification.

Why does the IT recruiter remain indispensable?

The more niche the recruitment, the greater the responsibility falls on the human. An algorithm doesn’t know the context – a recruiter does. Here’s why you shouldn’t blindly trust tools in difficult recruitments, and why every automatically rejected profile deserves a moment of attention.

• In niche recruitments, there may be literally only a handful of candidates in the entire country – which means every wrongful rejection comes at a high cost
• There’s always a risk of a false positive – a genuine candidate might, for example, mistype their phone number and get flagged as suspicious
• Fake candidates constantly evolve their tactics – a tool that works today may be useless in a few months
• No algorithm can replace a recruiter when it comes to reading context, nuance, and the behavior of the person across the table

The best results come from a hybrid model: automation handles the analytical heavy lifting and filters out the most obvious cases, while an experienced IT recruiter makes the final call and catches what the tool misses.

A systemic approach to the fake candidates problem – the TalentShield process

Individual verification techniques and a recruiter’s intuition are invaluable, but across an entire organization, something more is needed – a consistent, repeatable process that works regardless of which team member is handling a given recruitment process. The answer to this challenge is a systemic approach to candidate verification, one that eliminates randomness and builds the first line of defense already at the application stage.

An example of such a solution is the TalentShield process, developed and implemented at Team Up Recruitment by Anna Szymczyk – an IT recruiter and recruitment team leader who encountered the fake candidates problem in practice and decided to address it in a comprehensive way. TalentShield is a multi-stage verification protocol covering every key moment of the recruitment process – from the analysis of application documents, through in-depth research, to the video interview itself.

Elements of the TalentShield process

TalentShield is not a single, uniform verification process – rather, it is a set of four complementary elements that together create a coherent system for responding to suspicious profiles. Importantly, not every candidate goes through all of them: it is the recruiter who assesses which elements to activate and how deeply to apply them, depending on the number and significance of the signals that emerge.

1. Catalogue of warning signals

At the core of the process is a shared, team-wide catalogue of yellow and red flags – signals that should raise a recruiter’s alertness at the CV review stage or during the screening call. It serves as a starting point for further action, not a verdict. Anna emphasizes that the appearance of a signal does not mean an automatic rejection of the candidate – it means that the profile requires deeper verification.

2. Possible verification actions

For each warning signal, the team has clearly defined verification steps that a recruiter can take – from manual OSINT research, through contact data verification, to direct communication with the candidate. The actions are selected based on the specific situation, rather than applied mechanically to every case.

3. Conversation and communication scenarios

This is an element that Anna explicitly identifies as a response to the complexity of the situation – a recruiter who suspects fraud must know how to speak with a candidate without damaging the experience of someone who may, in fact, be honest. Prepared conversation scenarios help conduct such discussions professionally and without unnecessary stress.

4. Client communication

Since Team Up Recruitment is a recruitment agency, every recommended candidate receives a clear indication of the level of verification that has been applied. Clients are fully informed about what TalentShield is and how it works, and, if needed, they can request a deeper level of verification.

Since its implementation, no fake candidate has made it through the company’s recruitment process – at least to Anna’s knowledge. However, she stresses that this is not a reason to become complacent: fake candidates constantly change their tactics, and recruiters can always find themselves one step behind. That’s why TalentShield must live and evolve alongside the threat, and that is exactly how it is treated: as a continuously developing process, constantly updated with observations and ideas from the entire recruitment team.

Candidate experience – how to verify without losing strong candidates?

Introducing additional verification steps raises a legitimate question: will tightening procedures discourage valuable candidates? This is one of the biggest challenges IT recruitment companies face today. The answer is: it doesn’t have to – provided that verification is carried out thoughtfully and with the right balance.

Principles of effective verification

Additional verification steps don’t have to be burdensome or off-putting. The way a recruiter communicates and conducts the verification matters just as much as the verification itself. That’s why it’s worth following a few key principles:

• Transparency – inform the candidate openly that identity and experience verification is a standard part of the company’s recruitment process, stemming from security requirements; most candidates understand this and appreciate the honesty.
• Efficiency – verification procedures should be streamlined and well-planned so as not to unnecessarily prolong the overall process or generate frustration on the candidate’s side.
• Professionalism – verification should be conducted with care for the candidate’s experience, not from a position of suspicion; the tone of the conversation and the way questions are asked are crucial here.
• GDPR compliance – any requests for documents confirming identity or employment must comply with personal data protection regulations; the candidate should know what data is being collected, for what purpose, and how long it will be stored.

It is worth remembering that genuine candidates – especially those with experience in the IT industry, where awareness of security risks is high – usually understand the need for verification and do not perceive it as an obstacle. Those who react to standard verification questions with excessive nervousness or avoidance often end up providing yet another warning signal themselves.

Summary – how to protect recruitment processes?

The phenomenon of fake candidates in IT recruitment will not disappear – it will evolve just as quickly as the AI tools used by fraudsters continue to develop. For IT recruitment agencies and IT recruiters, this means one thing: preparedness cannot be a one-time project, but must become a permanent element of the recruitment team’s working culture.

Companies that fail to implement appropriate verification procedures expose themselves to real consequences – from hiring individuals without the declared competencies, through loss of client trust, to serious data security risks. Investing in a verification process is an investment in the quality and security of recruitment, and the lack of it is a risk whose cost may be significantly higher than the cost of implementation itself.

Fake candidates are not science fiction. They are a reality that Polish IT recruiters are already facing today, and will be facing on an even larger scale tomorrow. The key lies in awareness, consistency, and a willingness to continuously learn: just as fake candidates change their tactics, verification processes must keep pace with them.