In July 2024, KnowBe4, a cybersecurity company, discovered that a new hire had cleared their entire recruitment process using a fabricated identity. The candidate had passed background checks using a stolen Social Security number paired with an AI-generated headshot. During the video interview, a deepfake face appeared on camera. The offer was extended. The individual was onboarded. The deception was uncovered before significant damage occurred, but only because a security alert flagged unusual activity after the hire had already joined.
The incident was not the first of its kind. It confirmed what the FBI had been warning about for two years: state-sponsored operators are actively placing synthetic candidates on US payrolls, and the hiring funnel is how they get in.
Why Hiring Is Now Part of the Attack Surface
Remote hiring created an opportunity that did not exist before. When interviews moved to video, the physical check that exposed fake identities disappeared. A recruiter and a candidate are never in the same room. There is no moment where a passport is held up alongside a face that can be compared in person.
The platforms that replaced in-person interviews introduced liveness detection: a check that confirms a real human is present at the camera. What liveness detection does not check is whether the face on screen is real or AI-generated. Those are different controls, and conflating them is the error that synthetic candidates are specifically built to exploit.
Access follows the hire. A candidate placed in a software engineering, finance operations, IT support, or data role gains system access on their first day, often before their background check has fully cleared. The FBI has attributed a significant portion of this activity to North Korean state-sponsored operations targeting roles that provide access to source code, financial systems, and sensitive customer data.
The scale is operational. Deepfake video fraud in hiring rose 220% year over year in 2024. These are not isolated experiments. They are coordinated campaigns running dozens of synthetic candidates simultaneously across multiple organizations, adjusting the persona for each job description.
What the Attack Looks Like in Practice
The synthetic candidate passes through each stage of the hiring funnel using tools that have become inexpensive and accessible.
The profile photo is an AI-generated headshot that passes reverse image searches because it has never appeared anywhere before. The professional history is assembled from real LinkedIn data, adjusted for the target role. The identity documents are real documents obtained through previous data breaches, paired with an AI-generated face that matches.
During phone screens, real-time voice alteration software modifies the attacker’s voice to match the persona’s demographics. During video interviews, a deepfake face is rendered live over the attacker’s real face using a virtual camera. The face is consistent, responds to lighting changes at a basic level, and holds up long enough to get through a standard interview.
The personas are built to pass the checks that most hiring teams run: background verification against stolen documents clears, the video call shows a face, and the professional history is coherent. The gap is that no one checks whether the face on the video call is the same as the face on the identity document, or whether either of them is real.
The Roles at Highest Risk
Not every role carries the same level of risk. Synthetic hiring fraud is concentrated in positions that provide immediate access to things an attacker wants: system credentials, financial authorization, customer data, or source code.
IT support and help desk roles are a common target because they require access to the same systems that social engineering attacks exploit later. A synthetic hire in an IT support role can reset credentials, approve access requests, and create backdoors that outlast the employment itself.
Finance operations roles offer access to payment systems, vendor management, and banking credentials. A synthetic hire in accounts payable has a direct path to the same wire transfer fraud that targeted Arup.
Remote software engineering roles provide access to repositories, deployment pipelines, and customer data. The KnowBe4 incident involved exactly this profile: a technical role with broad internal access.
What HR and Talent Teams Can Do
The checks that catch synthetic candidates are not technically complex. They are deliberate steps that most current processes skip because they were designed before the threat existed.
The first check is visual: ask the candidate to hold their identity document up to the camera during the video interview, then compare the face on the document to the face on screen. This is a low-tech step that catches lower-quality attacks and adds friction that more sophisticated ones have to work around.
The second check is behavioral: ask questions that require spontaneous responses rather than scripted answers. Deepfake systems struggle with sudden topic changes, requests to write something on screen, or unexpected variations in lighting. These are deliberate disruptions, not tests of knowledge.
The third check is technical: for roles with system access, treat the interview recording as a document to be verified before the offer is extended. Running the recording through a deepfake detector takes under a minute. Diopter’s deepfake detector checks audio and video files against the generation signatures of the tools most commonly deployed in fraud campaigns, including HeyGen, ElevenLabs, and Stable Diffusion, and returns a confidence-scored verdict with a breakdown of the signals driving it. The check happens before access is granted, not after the hire has already joined.
The fourth step is process: establish a secondary verification requirement for any role with financial authority, system administration access, or access to sensitive customer data. A brief in-person or live video step with an IT or HR representative present, a request for physical ID verification, or a delayed access provisioning window each add meaningful friction without significantly extending the hiring timeline.
Treating the Hiring Funnel as a Security Control
The organizations ahead of this threat have accepted a straightforward reality: the hiring funnel is part of the attack surface. Every role that provides access to financial systems, source code, or sensitive data is a potential entry point for a well-resourced attacker.
That framing does not mean treating every candidate with suspicion. It means applying the same deliberate verification steps to hiring that have become standard practice in financial approvals, vendor onboarding, and identity verification. The technology to run those checks exists and is accessible. The harder part is building the policy and process that make the check automatic rather than optional.
The KnowBe4 incident ended without lasting damage because the detection happened early. Most organizations will not be that fortunate unless the hiring process is designed to catch it.
