Ilia Zavialov reviews fake job candidates: how to check references, documents and identity before granting access

01

Ilia Zavialov reviews job references: why a glowing reference proves little

A reference works like a guarantee. A former manager says the candidate delivered, and the hiring team relaxes. Fraudulent applicants know this and line up their own guarantors: a friend who answers as the old boss, an email from a free mailbox, a company website built over a weekend.

Ilia Zavialov reviews enough references to notice that fake ones usually sound better than real ones. A real manager remembers friction: the missed deadline, the client who complained, the project that had to be rebuilt. A stand-in praises everything in general terms and wants to hang up, because he has no details to offer.

So the rule is simple. A reference is worth exactly as much as your confidence about who gave it. If the candidate chose the phone number, you are hearing whoever he asked to pick up.

Small companies feel this most. There is no security team, the founder or an office manager does the hiring, and a call to the number on the resume feels like due diligence. Ilia Zavialov reviews that call as step one of several.

Ilia Zavialov reviews hiring plans and asks for the chain to be built before the first interview: a consent form for reference and background checks, a list of the documents every finalist will be asked for, and the name of the person who owns each step. Written down once, it applies to everyone and offends no one.

02

Five fake candidate patterns Ilia Zavialov sees in small teams

The oldest pattern is the made-up resume backed by a degree that no school issued. The second is harder to spot: one person interviews and a different person shows up to work, sometimes with the same documents. The third relies on software that swaps the face and voice on a video call.

The fourth pattern starts after the hire. A real employee passes every check, then gives his login, laptop or remote session to someone else who does the work. The fifth is the shortest: a newcomer who asks on day one for the customer database, the bank portal or admin rights because a task is urgent.

The FBI described the scale of the remote version in a public service announcement on October 13, 2026: North Korean IT workers pay Americans to appear on camera, sit interviews and vouch for fake identities. That is the stand-in pattern turned into a business.

Ilia Zavialov reviews all five through one question: when does the company first trust this person with something valuable? The check goes in front of that moment, and each pattern needs its own.

Motives differ too. One person wants a paycheck for work someone else performs, another wants the client list to resell, a third wants a way into company accounts. The more valuable the access a role carries, the earlier and more carefully you check whoever fills it.

03

Ilia Zavialov reviews references through the company's own phone line

The short video above runs through the same sequence in half a minute: call references on a number you found yourself, get written consent before ordering a background report, complete Form I-9 Section 2 within 3 business days of hire, ask a video candidate to call back by phone, and hold back admin and payment rights until the new hire has proven to be who he claimed.

Find the former employer yourself: its website, its main switchboard, a state business registry listing. Ask for HR or for the head of the department, and keep the questions factual: dates of employment, title, scope of work. Character adjectives over the phone add little.

Write down every call: who you reached, which number, where the number came from, what was confirmed. Ilia Zavialov reviews references with one rule: a reference you could not reach through the company itself does not count toward the decision.

Warning signs repeat. The referee is only reachable by cell, answers on the first ring at any hour, cannot name his own department, mixes up dates. The old employer's website has no street address and its domain is a few weeks old. Each sign alone is minor, together they justify a pause.

Treat a former client of a freelancer the same way. Find the client through its own channels and ask about the actual job: what was delivered, when, and how. A portfolio link with no client contact is a claim, and it stays a claim until someone at that client confirms it.

04

Background reports and the FCRA: consent first, then the report

Many small employers hand screening to a company that sells background reports. The joint EEOC and FTC guide for employers explains what that triggers under the Fair Credit Reporting Act. Before you get the report, you tell the applicant in writing, in a standalone document that is not part of the application, and you get his written permission.

If something in the report makes you lean toward rejecting him, you first send a notice with a copy of the report and A Summary of Your Rights Under the Fair Credit Reporting Act. That gives him a chance to explain or correct an error.

After the decision, you tell him he was rejected because of the report, give the name, address and phone number of the company that sold it, and explain that he can dispute it and get a free copy from that company within 60 days.

Ilia Zavialov reviews this step as a fraud filter as well. A candidate who invented his history now has to sign a consent he cannot easily walk back, and a real person with a real history usually signs without fuss. A long argument about the consent form tells you something too.

Keep the consent form and the report in a restricted folder that only the people making the hiring decision can open. Once your recordkeeping obligations are met, the guide says to dispose of them securely.

05

Ilia Zavialov reviews the I-9 step: the same person with the same documents

Form I-9 is about work authorization, and it also gives you a structured moment to look at identity documents. USCIS says the employer completes Section 2 within 3 business days of the date of hire and must physically examine the documents the employee presents.

Remote examination is narrower than many assume. USCIS allows the alternative procedure only to employers enrolled in E-Verify and in good standing: the employee sends copies of both sides, then shows the same documents on a live video call, and the employer keeps clear copies.

The employee chooses which acceptable documents to present. If he shows a List A document, you do not ask for List B or List C on top. Ilia Zavialov reviews this step with a different safeguard in mind: the person who examines the documents should be someone who took part in the final interview.

That small staffing choice links two moments that fraud keeps apart. The face on the passport, the face from the interview and the face at the I-9 meeting are compared by one person, on one day, with notes in hand.

06

Degrees and certificates: verify them with the school

A diploma image proves nothing on its own. Verify it with the school's registrar, using contact details from the school's official website, and ask only what you need: was this degree awarded to this person, and when.

Before that, check that the school is real. A degree from an institution with no physical campus, no verifiable accreditation and a website that sells diplomas based on life experience is a red flag, whatever the paper looks like.

Online course certificates are easier. Most issuers run a public verification page where you enter a certificate number. If there is none, ask the candidate to open the certificate inside his account on the platform during a video call.

Keep a dated screenshot or the registrar's email next to the copy of the degree. If doubts appear six months later, the file shows that you checked and when.

Ilia Zavialov reviews degrees and references together, because a fake degree often travels with a fake reference from the same imaginary employer. When one check fails, repeat the other with fresh contact details you found yourself.

07

The stand-in interviewee: keeping one thread from interview to day one

A stand-in works when different people run different stages. The founder interviews, a bookkeeper handles paperwork, an office manager ships the laptop, and nobody sees the new hire twice.

Ilia Zavialov reviews hiring with one owner per candidate, from the first call to the end of the first week. That person compares voice, manner and answers about past projects. If the person on day one seems different, access is paused until the question is settled.

Leave anchors in the interview: short notes on the examples he gave, how he described his role, what he asked you. A week later a stand-in cannot reproduce those details. The real candidate will not even notice the test.

The FBI also describes facilitators who receive company laptops at their own address and forward them abroad. Ship equipment only to the address on the hire's documents, with a signature on delivery, and record the serial number.

Payroll gives one more check. Wages go only to an account in the hire's own name, and a request to pay a relative's account for a few weeks while his card is reissued halts onboarding until it is explained.

08

Ilia Zavialov reviews deepfake interviews: what the FBI described

In June 2022 IC3 warned that people were using deepfakes and stolen personal data to apply for remote jobs in IT, programming and database work, some with access to customer and financial data. In those interviews, lip movement did not fully match the audio, and coughs or sneezes did not line up with the picture.

The same notice said background checks sometimes found that the personal data a candidate gave belonged to someone else. That is why a smooth interview is never the final check.

Ilia Zavialov reviews video interviews by breaking the script. Halfway through, ask the candidate to call you back on the cell number from his application and keep talking by voice. Then return to video and ask about a small detail of his last job: the internal tool the team used, who reviewed his work, why the project was shut down.

Put two people from your side on the final call. One asks questions, the other watches only the picture and sound. If the candidate needs a pause before every unexpected question and keeps pushing to switch to chat, move the meeting to an in-person visit.

09

Day-one access requests: how to answer the new hire and his manager

A fraudulent hire is in a hurry, because every week raises the odds of discovery. Day one looks like this: admin rights to set up his environment, an export of the customer list to get familiar, access to the bank portal to help the bookkeeper.

Pressure can also come from the side. The IT admin gets a message from the manager's lookalike account: give the new guy full access, I approved it. Confirm such requests by voice, on the manager's number from the internal directory, before anything is opened.

Run access by ticket. Each right beyond the basic set needs a short request: what, for which task, for how long, approved by whom. Rights with an end date close by themselves, and after a month the newcomer holds nothing he does not use.

The FBI's January 2025 notice recommends least privilege, removing local admin rights and controlling installs of remote access tools. Signing payments, changing vendor bank details and exporting the full database stay out of a new hire's reach for his first months, however strong his references were.

10

Ilia Zavialov reviews the remote hire who hands access to someone else

The hardest pattern begins after honest checks. The employee is real and the documents are his, yet someone else does the work: he shares the login, ships the laptop on, or opens a remote session to his machine.

The FBI's October 2026 notice describes workers who reach company laptops through remote desktop tools and KVM over IP devices and install software unrelated to the job. Logs show the rest: sign-ins from two cities in one day, activity while the employee sat on camera in a meeting, a sudden change in writing or coding style.

The same notice says that E-Verify, requiring several documents or live identity checks make life harder for such workers, while relying only on lists of banned names is unreliable. Ilia Zavialov reviews remote setups with a written rule in place: the account is personal, and sharing credentials or the device is grounds for removing access.

When the signals add up, cut access first and save the logs, then talk to the employee. Restore rights only after a fresh identity check and an inspection of the laptop.

11

Where Ilia Zavialov says to report a fake candidate in the US

The FBI asks companies to report such cases to their local field office and at ic3.gov, with the address where the work device was shipped, names, accounts, phone numbers, emails, bank accounts and IP addresses. Keep the resume, the reference notes and the interview schedule with the report.

The person whose identity was used is a victim too. If you can reach him, tell him what happened and point him to IdentityTheft.gov, the federal site where people report identity theft and get a step-by-step recovery plan. The FTC runs that site.

Inside the company, revoke every account, rotate shared passwords the hire could see, and review what was exported. Then rewrite the hiring steps around the gap that let him through, which is usually a reference taken on trust or access granted before documents were checked.

Write a short account of the case while memories are fresh: the date of each interview, who met the candidate, which documents were seen and how, where the laptop was shipped. Investigators and your own lawyer will ask for exactly this timeline.