How Identity Verification Can Mitigate Recruiting Fraud Risk
Recruiting teams are facing a new kind of fraud. For years, most hiring risk was framed around resume exaggeration, fake credentials, or candidates misrepresenting their experience. Those issues still exist. But the threat has evolved. Generative AI, remote work, synthetic identities, and inexpensive digital tools have made it easier for bad actors to create convincing candidate personas at scale.
Gartner has already warned that by 2028, one in four candidate profiles worldwide may be fake. Gartner also found that 39% of candidates used AI during the application process and that 6% admitted to interview fraud (i.e., posing as someone else, or having someone else pose as them in an interview). Gartner’s Jamie Kohn summarized the risk by stating “Candidate fraud can create cybersecurity risks far more serious than making a bad hire.”
The rise of synthetic candidates and AI-assisted impersonation in hiring is no longer just a recruiting operations problem. It is an identity, fraud, and security problem.
The risk is especially clear in remote and hybrid hiring. In June 2025, The Department of Justice announced coordinated actions across 16 states targeting North Korean remote IT worker schemes. According to court documents, operatives used stolen and fake identities to obtain employment in more than 100 U.S. companies (including Fortune 500 firms) generating over $5M in illicit revenue. Once inside, they gained access to sensitive systems and, in some cases, stole export-controlled U.S. military technology and cryptocurrency. The FBI has issued repeated warnings about fraudulent remote IT workers and cases where individuals used false identities to obtain remote roles and abuse company access. A recent report from cybersecurity firm Huntress revealed that when utilizing advanced risk screening tools on remote tech applications, a staggering 23.2% of applicants were flagged as a fraud risk.
The Limitations of Traditional Candidate Screening
Most recruiting teams already perform some level of validation. They may review a candidate’s resume, LinkedIn profile, work history, education, references, interview performance, location, and background check results.
Those checks are still important. Recruiters should continue to look for:
- Inconsistent work history across a candidate’s resume, LinkedIn, and application.
- Gaps, unusually generic descriptions, or profiles that appear recently created.
- AI-generated resume language that feels polished but lacks specificity.
- Candidates who avoid video, resist interview format changes, or behave unusually when asked to verify details.
- Inconsistencies between claimed location, availability, and compensation expectations.
- References or prior employers that are difficult to validate.
- Unusual urgency to accept an offer or start immediately.
These checks are no longer enough by themselves.
Deepfakes and synthetic identities are making it harder to trust what you see in a resume or video interview. A skilled fraudster can create a realistic resume, a plausible LinkedIn profile, a professional headshot, a portfolio, and interview responses using widely available AI tools. Companies have faced data breaches, IP theft, and (in cases involving sanctioned nations) potential exposure to sanctions law.
Most traditional recruiting checks evaluate the surface of the candidate, but modern recruiting fraud lives in whether the underlying identity signals are actually verifiable. Individually, every signal can seem legitimate:
- A phone number can be valid.
- An email address can receive messages.
- An address can be real.
- An IP address can appear normal.
- A resume can look polished.
But fraud often appears when these signals are viewed together. For example:
- A candidate may claim to live in one location, but the IP signal may suggest a very different geography or the use of proxy infrastructure.
- A phone number may be active, but it may not be associated with the applicant’s name.
- An email may be newly created, disposable, or disconnected from the rest of the identity.
- An address may be deliverable, but may not align with the phone, IP, or other identity signals.
- Multiple applications may use different names but share overlapping contact, location, or behavioral patterns.
This is why recruiting teams need to move beyond isolated checks. The question is not only, “Is this phone number valid?” or “Is this email deliverable?” The better question is: Do the phone, email, IP, name, and address signals point to the same real person, or does this look like a stitched-together identity?
Where Lightweight Identity and Behavioral Checks Help
Companies don’t need to turn every application into a heavy, invasive verification process. In fact, adding too much friction can hurt the candidate experience and discourage legitimate applicants. A better approach is to add lightweight identity and behavioral checks early in the funnel. These checks can help recruiting, staffing, marketplace, and HR technology platforms identify risk before an illegitimate candidate wastes recruiter time, reaches sensitive interview stages, or enters onboarding. Useful checks include:
Phone Intelligence
Does the phone number appear active and reachable? What line type is it? Is it mobile, fixed VoIP, non-fixed VoIP, prepaid, or disconnected? Does the phone have a strong association with the applicant’s name?
Email Intelligence
Is the email deliverable? Does the domain look trustworthy? Was the email recently created? Does it align with the rest of the applicant’s identity?
Address Intelligence
Is the address valid and deliverable? Does it appear residential, commercial, or inconsistent with the applicant’s stated profile?
IP Intelligence
Where is the application coming from? Is the IP associated with proxies, VPNs, data centers, or other risk patterns? Does the IP location align with the claimed address or expected geography?
Cross-Signal Checks
Does the IP align with the address/location provided? Do the email, phone, and address appear connected to the same person, or do they look artificially assembled?
Behavioral Patterns
Are multiple applications being submitted with overlapping contact details, repeated addresses, similar IP patterns, or unusual application velocity? Do identity or location signals change materially between application and interview?
These checks don’t need to automatically reject candidates. They can be used to route applications into different review paths: low-risk candidates move forward smoothly, while higher-risk applications receive additional review. The goal is to reduce fraud without punishing legitimate candidates.
How Trestle Helps
Trestle provides identity data solutions that help companies verify and connect core applicant signals across phone, email, IP, and address. These are lightweight, but very effective checks that help companies better understand whether the applicant’s identity data is consistent, contactable, and aligned. The checks include:
- Phone Activity Score and contactability.
- Phone-to-name match confidence.
- Line type, carrier, and prepaid indicators.
- Email deliverability and risk signals.
- Address validity and match signals.
- IP risk indicators.
- IP-to-address distance.
- Phone-to-address distance.
- Cross-checks across phone, email, IP, name, and address.
We’re already partnering with multiple enterprise customers in the talent acquisition, HR tech, and staffing spaces, who are using these signals to help identify potentially fraudulent or fake applicants earlier in the process. Our customers have successfully flagged and intercepted coordinated fraud rings submitting hundreds of automated, synthetic applications per week. This has protected their corporate networks from insider threats and saved their HR teams thousands of wasted hours and hundreds of thousands of dollars in bad-hire costs.
In a remote-first, AI-driven world, trust can no longer be assumed based on a polished screen or a perfect resume.
Want to see how Trestle can protect your hiring pipeline from synthetic fraud? Contact our team today to explore our identity verification solutions.
