A verification stack is the ordered set of checks that establishes a candidate is a real person, is the person they claim to be, and is the person who did the work on the CV. Most recruitment processes verify the first, assume the second and never test the third. Synthetic applicants exploit exactly that gap, and the tooling to create them is now cheap enough that the gap is being exploited at scale.
Experian named deepfake job candidates a top-tier threat in its 2026 fraud forecast. Gartner projects that by 2028 one in four candidate profiles globally could be fake. Neither figure requires you to believe the worst case to justify changing your process.
What the Attack Actually Looks Like
The cinematic version, a real-time face swap on a video call, is the least common and the most discussed. The ordinary version is duller and more effective.
The Composite Candidate
A CV assembled from a real person's genuine career, submitted by somebody else. The employment history checks out because it happened. It simply did not happen to the applicant.
The Proxy Arrangement
One person interviews, another does the job. Common in remote technical hiring, and frequently organised rather than opportunistic.
The Synthetic Identity
A consistent but invented person: generated headshot, fabricated history, a professional profile built up over months, sometimes references answering from controlled phone numbers and domains.
The Assisted Interview
A real candidate with real identity, receiving live answers from a model during assessment. One analysis of roughly 19,000 AI-conducted interviews between mid-2025 and early 2026 flagged a substantial minority of candidates for behaviour consistent with this, with rates markedly higher in technical roles.
Why Identity Checks Alone Do Not Hold
Identity verification answers whether a document is genuine and whether the person presenting it matches it. That is necessary and insufficient. A synthetic identity with a genuine document defeats it. A composite candidate passes it trivially, because their identity is real.
Gartner has also warned that a significant share of enterprises will find standard identity verification tooling can no longer reliably distinguish a real face from a deepfake. Treating the identity check as the whole defence puts the entire process on one control that is degrading.
The Four Layers That Do Hold
Layer One: Identity
Verify the document and match it to the person, using a certified identity service provider where eligible, or a properly conducted manual check. Do not accept a photograph of a document. Do not verify over video where the rules require presence.
Layer Two: Eligibility
Establish the right to work through the prescribed route. From 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 brings workers on a worker's contract and individual sub-contractors inside the scheme, so this layer applies to far more engagements than it used to.
Layer Three: Evidence of Capability
This is the layer almost nobody builds, and the one fraud is least able to survive. Rather than asking whether a CV claims a skill, establish whether it evidences one: a named context, a scope, a duration, a decision the candidate made, an outcome they can describe. A fabricated history describes responsibilities. A real one describes specifics.
Layer Four: Corroboration
Verify externally where a register exists. Professional registration, statutory qualification, chartered status. A register check is worth more than three references because it cannot be socially engineered.
Practical Detection at Sift Stage
Most of the useful signals are visible before anyone speaks to the candidate.
- Specificity collapse. Fluent, confident prose that never names a system, a scale, a constraint or a number. Fabrication is articulate and vague; real work is clumsy and specific.
- Seniority without a trail. A claimed leadership scope with no corresponding earlier roles that would produce it.
- Timeline arithmetic. Overlapping full-time roles, or a tenure too short to have delivered what is claimed within it.
- Contact patterns. Referee email domains that do not belong to the employer named. Phone numbers shared across supposedly unrelated referees.
- Template echo. Several applications for the same role sharing structure and phrasing while differing in name and history.
- Geographic inconsistency. A stated location that does not reconcile with the work history, the contact details or the availability offered.
None is conclusive alone. Two or more together justify a closer look before you invest interview time.
Controls at Interview and Onboarding
Ask for depth rather than breadth. A candidate who genuinely ran a project can be taken three questions deeper into a single decision. Someone reciting a history cannot, because the detail was never there to recall.
Ask about failure. Fabricated narratives are uniformly successful. Real work contains a compromise, an overrun or a thing that did not work.
For remote hires, verify identity again at onboarding rather than assuming continuity from the interview. The proxy arrangement depends on nobody checking whether the person who starts is the person who was assessed.
Where equipment is posted, the delivery address is a data point. Where a start date is repeatedly deferred, so is that.
Doing This Without Discriminating
An anti-fraud process applied selectively becomes a discrimination problem. Do not escalate verification because of a name, an accent, a place of birth or an assumed nationality. The Home Office has published a draft code of practice on avoiding unlawful discrimination while preventing illegal working, and its logic applies here directly.
Write the stack down, apply every layer to every candidate at the same depth, and record that you did. Uniformity is what makes the process both effective and defensible under the Equality Act 2010. A candidate rejected on a documented evidence assessment is a defensible decision. A candidate rejected because something felt off is not.
Frequently Asked Questions
Should We Use Deepfake Detection Software?
It can form part of a stack but should not be the centre of one. Detection accuracy is contested, degrades as generation improves, and produces false positives that carry their own fairness risk. Evidence verification does not degrade in the same way.
Do AI Writing Detectors Help?
Not reliably. They are prone to false positives, disadvantage non-native English writers, and answer the wrong question. Whether text was drafted with assistance says nothing about whether the underlying experience is real. Assess the evidence, not the prose.
Is Requiring Cameras On Lawful?
Generally yes for an interview, provided it is consistent and you accommodate reasonable adjustments. Be prepared to offer an alternative where a candidate has a disability-related reason, and document the adjustment.
How Much Does This Slow Hiring Down?
Layers one, two and four are largely mechanical. Layer three is where time goes, and it is time that would otherwise be spent interviewing unsuitable candidates. Filtering on evidence earlier generally shortens the process overall.
What If We Discover Fraud After Hiring?
Take advice immediately. There may be grounds relating to misrepresentation, and where identity or right to work was falsified there are separate statutory consequences. Preserve the application record, because the evidence of what was claimed becomes central.
The Underlying Shift
Recruitment has historically trusted claims and verified only identity and eligibility. Generative tools have made claims free to produce and impossible to distinguish by reading quality. What remains costly to fake is specific, corroborable evidence of work actually done.
That is the layer worth building. It defends against synthetic applicants, and it happens to be the same discipline that produces better hires from honest candidates.
This article is general information, not legal advice. Take specialist advice on identity, immigration and employment consequences in your own processes.
Sources
The Stationery Office. Border Security, Asylum and Immigration Act 2025, Section 48.
https://www.legislation.gov.uk/ukpga/2025/31/section/48
Home Office. Draft Employer's Guide to Right to Work Checks: 16 July 2026.
https://www.gov.uk/government/publications/right-to-work-checks-employers-guide/draft-employers-guide-to-right-to-work-checks-16-july-2026-accessible
Home Office. Draft Code of Practice for Employers: Avoiding Unlawful Discrimination While Preventing Illegal Working.
https://www.gov.uk/government/consultations/right-to-work-draft-code-of-practice-for-employers-avoiding-unlawful-discrimination/draft-code-of-practice-for-employers-avoiding-unlawful-discrimination-while-preventing-illegal-working
The Stationery Office. Equality Act 2010.
https://www.legislation.gov.uk/ukpga/2010/15/contents
Nursing and Midwifery Council. Check the Register.
https://www.nmc.org.uk/registration/search-the-register/
Health and Care Professions Council. Check the Register.
https://www.hcpc-uk.org/check-the-register/
Information Commissioner's Office. Employment Practices: Recruitment and Selection.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/
InsightCircle
