Fake job candidates
Ilia Zavialov reviews fake job applicants: how UK employers check references, identity and access
Ilia Zavialov reviews fake job applicants with UK employers in mind, where remote hiring has made it easier than ever to borrow someone else's name, CV and face. The digital security consultant covers five routes in: an invented career with a bogus degree, a different person sitting the interview, a deepfake on a video call, a hire who lets someone else use his login, and a new starter chasing admin rights on his first morning. Below are reference checks in line with ICO guidance, right to work checks as an identity step, basic DBS checks, the joiners process and where to report it.
English version for the United Kingdom.
01
Ilia Zavialov reviews UK references: what a glowing reference is really worth
British hiring leans heavily on references, and fraudsters lean on that habit. The referee turns out to be a mate with a mobile number, the reference arrives from a webmail address, and the previous employer's website went live last month.
Ilia Zavialov reviews references often enough to know that a staged one tends to sound warmer than a genuine one. A genuine line manager recalls specifics, including awkward ones: a slipped deadline, a difficult client. A stand-in referee speaks in superlatives and wants the call over quickly.
Plenty of UK firms now confirm only dates and job title as a matter of policy. That is useful in its own way: the switchboard either confirms the person worked there in those years or it does not, and a short factual answer from HR beats a long glowing one from a mobile.
For a small business with no HR department, the founder often makes the call. Ilia Zavialov reviews that call as one link in a longer chain.
Ilia Zavialov reviews the process up front and recommends agreeing the whole chain before the first interview: a consent form for references, the documents every finalist will be asked for, and who owns each step. Applied to every candidate, it singles nobody out.
02
Five ways a fake applicant gets in, according to Ilia Zavialov
Each route shows itself at a different moment. A made-up CV and degree surface before the interview, provided someone checks them. A substitute interviewee shows up on the first day. A face-swapping tool gives itself away only in a live conversation with unexpected questions.
The last two routes concern people already on the payroll. A starter who lends his login or laptop to someone else looks normal from the outside, only the sign-in logs change. A newcomer who demands admin rights or access to payments in week one is testing whether your own rules hold.
The incentives vary: a salary for work done by somebody else, a customer list to sell on, a route into the firm's bank account. The more a role can unlock, the earlier its applicants are checked.
Ilia Zavialov reviews it as a timeline. References before the offer, documents before the contract, identity on day one, logs in the first weeks. The order matters more than the strictness, because a rigorous check after access has been granted protects nothing.
A clear timeline helps the honest applicant as well, who knows from the outset which documents he will be asked for and at what stage.
03
Ilia Zavialov reviews references by ringing the employer's switchboard
The video above sums up the UK order in half a minute: references through the employer's switchboard, a right to work check before the job starts, a basic DBS check that costs £20, a member of the interview panel meeting the starter on day one, and access widened only once the starter has shown he is the person you interviewed.
Look up the previous employer yourself: its website, Companies House, the main switchboard. Ask for HR or the line manager and keep to facts. The ICO's draft guidance on verifying candidates says you should ask a referee only what your recruitment policy needs, for example confirmation of dates of employment.
The same draft says original documents can be shown in person or sent securely, for example by tracked delivery. Ilia Zavialov reviews references with one extra habit: write a short note after each reference call, with the number, where you found it, the name of the person you spoke to and what was confirmed.
Red flags tend to cluster. The referee is only on a mobile, picks up instantly at any hour, cannot name his own team and muddles the dates. The previous employer has no registered address and a brand new domain. Any one of these is minor, several together justify a pause.
Freelancers bring former clients instead of managers. Reach the client through its own website and ask about the actual job, the deadline and the deliverable. A portfolio with no client contact is a claim until someone at the client confirms it.
04
Pre-employment vetting under ICO guidance: proportionate and in the open
The ICO's draft guidance on pre-employment vetting warns against vetting every applicant as routine. It reserves vetting for cases with a legal duty or significant and particular risks, and says candidates must be told if you intend to vet them.
That notice should explain what information you need, why, who will see it and how long you will keep it. Ilia Zavialov reviews vetting as a one-page statement handed to every shortlisted applicant, so the check never looks personal.
Social media checks need extra care. The draft says the people researching profiles should not be the ones making the hiring decision. Look only at public profiles and only for the risk you identified, and give the candidate a chance to comment on anything you find.
A clear statement helps with fraud as well. An honest applicant sees fair rules. Someone with a borrowed identity learns at the outset that the checks will be real, and some withdraw at that point.
Keep vetting results in a restricted folder used only for the hiring decision, and delete what you no longer need once the post is filled.
05
Ilia Zavialov reviews right to work checks as an identity check
GOV.UK requires you to check a candidate's right to work before employment starts: online with a share code, by examining original documents in the candidate's presence, or through an identity service provider using IDVT. British and Irish citizens cannot get a share code.
For a manual check, the guidance asks you to make sure the documents are genuine and belong to the person, that photos match each other and the applicant, and that dates of birth are consistent. You make copies that cannot be altered, record the date, and keep them for the employment plus two years.
The penalties are serious. Employing someone without the right to work, without a correct check, can bring a civil penalty of up to £60,000 per worker. Ilia Zavialov reviews it as a chance to let a member of the final interview panel carry out the check, so the face on the passport and the face from the interview are compared by the same person.
That small staffing choice closes the gap a substitute relies on. The interviewer, the document check and the first day are joined by one pair of eyes and one set of notes.
Follow-up checks matter as well. Where a right to work is time-limited, GOV.UK requires you to check again when it runs out, and if the person cannot show documents, you ask the Home Office to check his status.
| Check | What the guidance says | Practical tip |
|---|---|---|
| Reference | Ask only what the policy needs | Confirm dates through HR |
| Vetting | Tell candidates in advance | One-page vetting statement |
| Right to work | Before employment starts | Done by an interview panel member |
| Penalty | Up to £60,000 per illegal worker | Keep copies for employment plus two years |
| Basic DBS | Unspent convictions, £20 | Applicant applies via One Login |
06
Basic DBS checks and qualification claims
For roles in England and Wales, the applicant can request a basic DBS check. GOV.UK says it shows unspent convictions, costs £20, usually takes up to 3 days to process, and the applicant proves his identity through GOV.UK One Login.
Because the applicant applies himself, the identity step is done by the government service. A certificate in the right name, presented at a meeting, is one more link between the paper identity and the person in front of you.
Degrees are verified with the university, using contact details from its official website, and only the facts you need: was this qualification awarded to this person, and when. A university you cannot find on any official list, or one that sells degrees for life experience, ends the conversation.
Professional certificates usually have a public verification page by certificate number. If not, ask the applicant to open the certificate in his account on the platform during a video call, and keep a dated screenshot on file.
Ilia Zavialov reviews degrees and references side by side, because a bogus degree often comes with a staged reference from the same imaginary firm. If one check fails, repeat the other using contact details you found yourself.
07
A different person on day one: holding the thread from interview to start
Substitution works when nobody sees the new starter twice. The director interviews, an outsourced bookkeeper sorts the paperwork, someone in the office posts the laptop.
Give each candidate a single owner from first call to the end of week one. That person listens for the same voice, the same manner, the same answers about past projects. If the starter seems different, access is put on hold until the question is resolved.
Keep brief interview notes as anchors: the examples he chose, how he described his role, what he asked you. A week later a substitute will struggle with those details. The genuine starter will not notice anything unusual.
Post kit only to the address on his documents, signed for on delivery, and record the serial number. A request to send the laptop to a friend or to a parcel locker in another name stops the shipment.
Payroll is the last gate. Salary goes only to an account in the starter's own name, and a request to pay a partner's account while his card is replaced holds up onboarding until it is explained.
08
Ilia Zavialov reviews video interviews: breaking a deepfake's script
Face-swapping tools cope well with a steady gaze and predictable questions. They cope badly with a change of conditions: a different angle, a different channel, a question that was not rehearsed.
Ilia Zavialov reviews video interviews by asking the candidate, halfway through, to ring you on the mobile number from his application and carry on by voice. Back on video, ask about something small from his last job: the ticketing tool his team used, who signed off his work, why the project ended.
Bring a second person from your side to the final interview. One asks the questions, the other watches only the picture and sound for lips out of step, a frozen background or odd reflections.
Record an interview only if the candidate is told and agrees, and delete the recording once the process is over. If the applicant needs a pause before every unexpected question and keeps steering towards text chat, move to a face-to-face meeting.
None of these signs proves a deepfake on its own. Several together, plus a refusal of any live check, are enough to halt the process and ask for an in-person meeting before any offer is made.
09
Access on day one: run it through the joiners process
A fraudulent starter is in a hurry. On his first morning he needs admin rights to set up his machine, an export of all clients to get up to speed, and the online banking login to help accounts.
Sometimes the pressure arrives sideways: a message to IT from a lookalike account of the director, asking for full access because it is all approved. Confirm such requests by phone, on the director's number from the internal list, before anything is opened.
NCSC's 10 Steps to Cyber Security recommend a joiners, movers and leavers policy, removing access when it is no longer needed, multi-factor authentication for every account and separate admin accounts. For a small firm that means one short request per extra right, with a reason, an end date and an approver.
Approving payments, changing supplier bank details and exporting the whole database stay out of a new starter's hands until probation ends, however strong the references. An honest newcomer waits a day for approval without fuss.
Review the starter's rights at the end of his first month. Anything granted for a single evening is closed, and he keeps only what his tasks need.
10
Ilia Zavialov reviews staff who let someone else use their login
The toughest case starts after every check was passed honestly. The employee is real, the documents are his, and yet somebody else is doing the work through his login, his laptop or a remote session.
Logs tell the story: sign-ins from two countries in a day, activity while he sat in a camera meeting, remote control software on the work laptop, a sudden change in writing style. On calls, the voice does not match the one from the interview.
NCSC advises covering every user with the access policy, contractors included, and having agreements and the ability to revoke access whenever third parties are involved. Ilia Zavialov reviews starters against a signed rule: the account is personal, and sharing the password or the device ends his access.
When the signals line up, suspend access and preserve the logs first, then speak to the employee. Rights come back only after a fresh identity check and a look at the laptop.
Spell the rule out in the contract and the staff handbook, and repeat it when the laptop is handed over. A starter who has signed it cannot later claim that nobody told him.
| Signal | What it may mean | Response |
|---|---|---|
| Sign-ins from two countries | More than one user | Compare with his working pattern |
| Remote control software | Laptop run from elsewhere | Remove it, find who installed it |
| Unfamiliar voice on calls | Someone else is working | Camera meeting with interview questions |
| Kit sent to a new address | Device held by a middleman | Suspend access pending review |
11
Where Ilia Zavialov says to report a fake applicant in the UK
Report Fraud is the national centre for reports of fraud and cybercrime. It takes calls on 0300 123 2040 and asks organisations under cyber attack to ring straight away. Keep the CV, reference notes, copies of documents and sign-in logs ready before you call.
Lying on an application to get a job can be a criminal matter. Under sections 1 and 2 of the Fraud Act 2006, fraud by false representation carries up to 10 years in prison or a fine on conviction on indictment.
Inside the firm, revoke every account, change shared passwords the person could see and check what was exported. Then review the hiring steps and find the one that was skipped, usually a reference taken on trust or access granted before the documents were checked.
Ilia Zavialov reviews every case through a written timeline, drafted while it is fresh: each interview date, who met the applicant, which documents were seen and how, where the kit was posted. Report Fraud, the police and your solicitor will all want that sequence.
If a real person's identity was used, he is a victim as well. When you can reach him, tell him what happened, so that he can check his own records and report it.
| Route in | Warning sign | UK check |
|---|---|---|
| Staged reference | Referee only on a mobile | Ring the employer's switchboard |
| Invented career | Employer cannot confirm dates | Dates and title from HR |
| Bogus degree | University has no record | University verification |
| Substitute interviewee | Different voice on day one | Panel member does the RTW check |
| Deepfake on video | Pause before every question | Call back on his mobile |
| Shared login | Sign-ins from two countries | Logs, then suspend access |
Questions and answers
Ilia Zavialov reviews: how should a UK employer check a reference?
Find the previous employer's switchboard yourself, ask for HR or the line manager, and confirm dates and job title. ICO draft guidance says to ask referees only what your recruitment policy needs.
Do I have to tell applicants that I will vet them?
Yes. The ICO draft guidance on pre-employment vetting says candidates must be told, with an explanation of what information you need, why, who sees it and how long it is kept.
Ilia Zavialov reviews right to work checks: can they help spot a substitute?
Yes, if a member of the interview panel carries it out. GOV.UK asks you to make sure documents are genuine, belong to the person and that photos match the applicant.
How much does a basic DBS check cost?
GOV.UK says £20, and processing usually takes up to 3 days. The applicant applies himself and proves his identity through GOV.UK One Login.
Is lying on a job application a crime in the UK?
It can be fraud by false representation under the Fraud Act 2006, which carries up to 10 years in prison on conviction on indictment.
Where do I report a fake applicant?
To Report Fraud, the national centre for fraud and cybercrime reports, on 0300 123 2040.