AI Interview Scams: How Deepfakes Are Faking Job Interviews

An unprompted, fast-moving recruiter contact

A message arrives via LinkedIn, email, or a job board — often for a role you didn't apply to — with an interview scheduled unusually quickly, leaving little time to research the company.

The interviewer's face is a real-time AI avatar

On the video call, a deepfake face-swap overlays a real employee's likeness onto the scammer's live webcam feed, borrowing the credibility of a legitimate company and a real person's identity.

Interview questions are generic and scripted

The conversation feels oddly shallow because hiring was never the goal — it exists to build just enough trust for the next request.

A "positive" interview leads to a request for money or data

You're asked to buy your own equipment, submit banking details for 'payroll setup,' or pay a training or certification fee before you've received any formal, verifiable offer.

The mirror-image version: a fake candidate

In the reverse scam, the applicant — not the employer — wears the deepfake, using real-time face-swap software to interview as someone else entirely, in order to fraudulently secure a role.

Tied to organized identity-fraud hiring rings

This candidate-side fraud has been linked to organized schemes, including foreign IT workers using stolen American identities to land remote developer jobs at U.S. companies, then diverting salary or exfiltrating company data.

The person who interviewed isn't the person who shows up to work

Once hired, the actual individual performing the job can differ from who appeared on camera — sometimes with a full team-member swap mid-project.

Both directions exploit the same blind spot

A video call is treated as reliable proof of identity by default, and almost nobody — job seeker or employer — actually verifies who is on the other end of it.

Real-time face-swap software

Freely available consumer and open-source tools overlay a different face onto a live webcam feed during the call itself, adjusting in real time as the wearer moves and talks.

A source face built from a handful of public photos

LinkedIn, a company's 'About' page, or a real employee's social media supply the handful of clear headshots that AI face-swap tools need to generate a convincing avatar.

Company branding copied wholesale

A fake job posting or interview invite reuses a scraped logo, real employee names, and a spoofed or lookalike email domain to look identical to the genuine company.

AI voice cloning layered on top

A cloned voice, built from a real employee's public webinar or conference talk, is layered onto the avatar so cadence and tone match what a quick search would confirm.

Fabricated onboarding paperwork

Offer letters, NDAs, and W-9/W-4-style tax forms are generated to visually match a real company's actual onboarding documents.

Stolen identity documents for the candidate-side version

Identity data from prior breaches, or purchased on dark web markets, backs a fraudulent applicant with a 'real' identity to interview and get hired under.

"Laptop farms" that fake a legitimate location

Domestic intermediaries physically host company-issued equipment so shipping addresses and login IP locations appear legitimate, even though the actual worker is somewhere else entirely.

Shared, reused scripts across scam operations

Question banks and follow-up requests are reused across unrelated companies, which is why victims frequently report nearly identical interview experiences.

Visible artifacting around the face

Shimmering or blurring at the hairline, glasses, or jawline, lighting on the face that doesn't match the room, or lips that don't perfectly sync with the audio.

The interviewer resists turning their head

Asking someone to turn to the side or hold a hand in front of their face causes visible glitching in most real-time face-swap tools — and a refusal is often disguised as a technical excuse.

An oddly fixed, centered camera and unnatural blinking

The face stays locked at the same angle for the entire call, with blink timing or micro-expressions that feel slightly too smooth or too sparse.

The process is unusually fast-tracked

One call — sometimes only a chat interview — followed by a formal offer within hours or days, with none of the normal multi-round hiring process.

Onboarding asks you to pay for anything

A request to buy your own company laptop, cover a 'training materials' fee, or pay for a background check — legitimate employers issue and pay for these themselves.

Communication moves off the official platform fast

The conversation shifts quickly to personal email, WhatsApp, or Telegram, and follow-up emails arrive from a domain that's a near-miss misspelling of the real company's.

A vague role with aggressive pay and flexibility claims

The job description is thin on actual responsibilities but specific and generous about salary and remote freedom, designed to attract the widest possible pool of applicants.

Sensitive data requested before any written offer

A Social Security number, bank details, or an ID scan is requested before a formal offer letter or a real background-check process has even started.

Reverse-search the interviewer's photo

Run the interviewer's headshot or LinkedIn photo through a reverse face search — a stolen or AI-generated face frequently surfaces attached to a different, unrelated real profile, or nowhere at all.

Call the company directly, independently

Use a phone number from the company's official website, not one given to you by the recruiter, and confirm both the open role and the interviewer's identity yourself.

Cross-check name and title against the company's own pages

Compare the interviewer's name and title against the official team page, LinkedIn, and any press mentions — a mismatch or a person who doesn't exist there at all is a clear signal.

Ask for something live deepfakes struggle with

Request the interviewer turn their head fully to the side, hold up a handwritten note with today's date, or briefly cover part of their face with a hand.

Check the email domain character by character

Scam domains commonly substitute a letter, add a hyphen, or use a different top-level domain to mimic the real company's address closely enough to pass a quick glance.

Never pay for your own equipment, training, or fees

Legitimate employers cover onboarding costs themselves or deduct them from pay — they never collect an upfront fee from a new hire before their first paycheck.

Withhold sensitive data until there's a verified, signed offer

Refuse to share a Social Security number, bank details, or an ID scan until you have a signed offer letter from a verified company email and have confirmed independently the company is actually hiring.

Ask for a second call on a different day if something feels off

Most scam operations won't invest the extra time to run a second convincing performance — a request for a follow-up call often ends the contact entirely.

Stop all further payments and contact immediately

The moment fraud is suspected, cut off further payments and communication — every additional request afterward is part of the same scheme.

Contact your bank or payment provider right away

Ask about reversing or disputing any payment sent for equipment, training, or fees — the earlier this is reported, the better the odds of recovery.

Freeze your credit if you shared identifying information

A Social Security number, bank details, or an ID scan shared with a fake recruiter warrants an immediate fraud alert or credit freeze with the major bureaus.

Report the fake posting to the platform it appeared on

LinkedIn, Indeed, and other job boards can take down the listing and warn other applicants once a fraudulent posting is reported.

File with the FTC and the FBI's IC3

Report at reportfraud.ftc.gov and ic3.gov — job scams and deepfake-enabled fraud are both actively tracked categories that help link related operations.

Employers: involve HR and legal immediately

If a hired remote worker's video identity doesn't match who's actually performing the work, loop in HR and legal right away and preserve every interview recording and message as evidence.

Revoke access and audit exposure

Immediately revoke system access, credentials, and equipment shipping for the affected hire, then audit exactly what data or systems they had access to.

Report organized identity-fraud hiring schemes to the FBI

The FBI actively investigates organized remote-work identity fraud rings — a company-side report can connect an isolated incident to a broader, known operation.