Deepfake interviews: what a camera rule can prove

On 12 October 2026 we published a long explainer on how our camera-off rule works. The sentence in it that matters most for this post is a modest one: the counter moves when the camera control is switched off, and it does not inspect the pixels. I wrote it that way on purpose, because the most common misunderstanding I hear about AI interviews is that a camera being on means someone checked who was in front of it.

It does not, in our product or in most others. A deepfake interview is the clearest case of why that distinction matters. This is the fourth post in our series on AI proctoring for interviews. It covers what a camera-on rule genuinely proves, what it cannot, why we do not do face matching in a screening interview, and where identity checks belong instead.

What is a deepfake interview?

A deepfake interview is a remote job interview in which the candidate’s face, voice or both are altered or generated, so the person on screen appears to be someone they are not. It is usually paired with a stolen or borrowed identity, so the resume, documents and face all seem to agree. The goal is to get hired into a role, often a remote one with system access.

The FBI’s Internet Crime Complaint Center described the pattern in a public service announcement on 28 June 2022, warning of complaints about deepfakes and stolen personal information used to apply for remote work positions, mostly in IT, programming, database and software jobs. It is worth reading the original, because the signs it lists are concrete, and I come back to them below.

What a camera-on rule proves, and what it does not

HireQwik’s browser interviews require the camera. A candidate cannot start the interview with the camera refused, and if they switch it off mid-interview the microphone mutes and the call pauses until they turn it back on. The fourth shutoff ends the call. The details are in what happens when the camera is turned off. Here is what that rule does and does not establish:

The right column is not a list of bugs. A web page sees a video stream, not a person. Any claim that a camera rule alone establishes identity should be treated with suspicion, including from vendors.

Four video interviews, and still fooled

The best documented case I know of is not from screening at all. In July 2024 KnowBe4, a security awareness company, published an account of hiring a software engineer who turned out to be a North Korean IT worker using a stolen US identity. Its HR team had run four video conference based interviews on separate occasions, confirmed the person matched the photo on the application, and run a background check that came back clear, because the identity was real and simply not theirs. The photo itself had been AI-enhanced from stock imagery.

What caught it was not the interviews. It was the company’s security software flagging suspicious activity on the new hire’s laptop soon after it arrived. KnowBe4 says no data was lost, and to its credit it published the story so other teams could learn from it.

The lesson for recruiters is uncomfortable. Four live, camera-on conversations with a human interviewer did not establish identity. A ten-minute automated screen will not either. That is not an argument against camera-on interviews. It is an argument for putting identity checks in the places that can actually do the job.

What the FBI told employers to watch for

The 2022 announcement is short and practical. Its complainants reported that in video interviews, the lip movement and on-screen actions did not completely match the audio, and that coughing, sneezing and similar sounds were not aligned with what was shown on screen. Some also reported voice spoofing.

Those are human-reviewer signs, and they work best in a live conversation where you can prompt them. A few practical requests in a live round:

• Ask for a natural, unscripted moment. A laugh at a small joke, a turn of the head to look at something, picking up a glass of water. Mismatches between sound and picture are easiest to notice in moments the person did not plan.
• Ask them to hold their ID next to their face and read out one detail from it. It is low-tech, and it removes casual cases.
• Ask them to move. Turn to the side, lean in, raise a hand past the face. Then watch the edges of the face, not just the middle.
• Listen across rounds. If the screening interview was recorded, play two minutes of it before the final round. A different voice is usually obvious to a human ear.

None of these is proof. Each is a reason to slow down and check further, never a reason to reject on the spot.

Why we do not do face matching in a screening interview

We are sometimes asked why HireQwik does not compare the candidate’s face to their ID photo, or keep a voiceprint to compare across rounds. The honest answer has three parts.

Biometric data carries heavy legal duties. Face geometry and voiceprints are regulated as biometric identifiers in several places. Illinois’ biometric privacy law, for example, requires written notice and consent before collection and has produced large class actions. We have written about voiceprint laws and AI interviews for teams hiring into the US from India. India’s data protection law adds its own notice and consent duties for personal data, and the DPDP checklist for AI voice screening covers those.

A match is only as good as the document. In the KnowBe4 case the documents were real. A face-to-ID match would have checked the wrong thing well.

It belongs later in the process. Screening narrows a large pool to a short one. Identity matters most just before an offer and on joining, when the number of people is small enough to check properly and the stakes are concrete.

So our interviews record video for a human reviewer, count camera shutoffs, and stop at that. The screen does not score faces, does not track gaze and does not store biometric templates. I would rather customers know that limit precisely than assume a check that is not there.

Voice cloning: the audio half of the problem

Most writing about deepfake interviews is about faces. In a voice-first screening interview, the voice deserves equal attention, and the FBI’s complainants mentioned voice spoofing too.

There are two different threats here, and they need different responses. The first is a pre-recorded or generated voice playing canned answers. That fails quickly in a real conversation, because the questions change and the follow-ups depend on what was just said. The second is live voice conversion: a real person speaking, with software changing how they sound in real time. That person can answer follow-ups, because they are genuinely talking. What the software changes is who they sound like, not what they know.

Live conversion is the harder case, and nothing in a short screening call reliably detects it. What helps is continuity. HireQwik records the candidate’s audio as its own track, separate from the interviewer’s voice, and the video recording sits next to it. If the person who joins the final round sounds and looks different from the one in the screening recording, a human ear notices, and that comparison costs two minutes. We do not turn that audio into a voiceprint, for the legal reasons below. The comparison stays a human judgement.

If you suspect a deepfake partway through a process

Suspicion is not proof, and the cost of wrongly accusing a candidate with an unusual camera or a poor connection is real. A calm sequence works better than a confrontation:

1. Write down what you saw and when, with the timestamp in the recording.
2. Have a second person watch the same two minutes without telling them what you suspect.
3. Invite the candidate to a short live call with a person, framed as a normal next step.
4. In that call, ask for the ID next to the face and one unscripted moment, as described above.
5. If doubt survives, move identity checks earlier: ask for background verification before the offer rather than after.
6. Decide on what you verified, not on what you suspected, and record the reason.

How the camera rule still helps

None of that makes the camera rule pointless. It does four useful things for this problem:

1. It removes the easiest dodge. Without it, a stand-in could simply keep the camera off. With it, they have to show a face for the whole call, which raises the effort and lowers the number of casual attempts.
2. It creates evidence. The recording from the screen can be compared with the person in the final round and on joining day. That continuity check is cheap and catches a lot.
3. It surfaces odd behaviour. Repeated shutoffs are counted on the record, and camera-off events are one of the AI-assist signals a recruiter sees after the call.
4. It sets expectations. Candidates who know the session is recorded on video and that the camera must stay on are less likely to try something they expect to be noticed.

Where identity checks belong in a hiring process

The point of the table is that no single step carries identity alone. The screening interview’s contribution is a recording and a set of flags, which make every later check easier.

A red-flag checklist for recruiters

Watch for these across the process, not in any single moment:

• Lip movement or laughter that does not line up with the sound.
• A face that blurs, flickers or warps at the edges when the person moves.
• Reluctance to turn on the camera in a live round, or a camera that repeatedly fails at key moments.
• A voice in a later round that does not match the screening recording.
• A strong resume with answers that stay generic when you ask about specific projects.
• Pressure to keep every step remote, and to ship equipment to an address that does not match the application.
• Contact details that change between application and offer.

One flag means little. Several, especially across different steps, mean it is time for a slower, live identity check before anything else happens.

What to tell candidates

Honest candidates deserve to know what is and is not collected. A clear line in the invitation works: “This interview is recorded on video and the camera must stay on. We do not use face recognition or voice matching. If you move forward, we will verify your identity in a live conversation and again when you join.” It reassures the honest majority, it deters the casual stand-in, and it is accurate. The last post in this series spells out, for candidates themselves, what an AI interview can and cannot see.

The fake-candidate problem is growing, and Gartner has forecast that by 2028 one in four candidate profiles could be fake. That is a forecast, not a measurement, but it is a good reason to design identity into the process now rather than expect any camera to do it for you. If you want to walk through how the camera rule, the recording and the flags look on a real record, book a short demo and we will show you with sample data.