Ep 825: The Real Risks Of Candidate Fraud

0:00Most conversations about candidate fraud are about using AI to cheat in interviews and fake skills and experience. There's a second kind of candidate fraud, though, that's far more serious, where organised criminal operations are using stolen identities to get inside of organisations. So are your candidates who they say they are? And what are the implications for your business if they aren't? Keep listening to find out. Support for this podcast is provided by Proof, the identity platform built for hiring. You've probably heard that by 2028, one in four job applicants is predicted to be fake. In fact, you've probably already seen that in your recruiting pipeline.

0:46Today, scammers are sending one person to get the offer and a totally different person to start the job. but most identity tools either only screen an application or verify a candidate's ID. Proof does both. Integrated directly with applicant tracking systems like Leather from the first interview through to onboarding. So you have proof that the person you interview is the same real person you hire. You can learn more by going to proof.com. That's P-R-O-O-F dot com.

1:22There's been more of scientific discovery, more of technical advancement and material progress in your lifetime and mine, than in all the ages of history.

1:37Hi there, welcome to episode 825 of Recruiting Future with me, Matt Alder. Remote hiring, widely available deepfake tools, and the harvesting of stolen identities have created an opportunity for organised crime in the hiring process. State-backed operations are also training workers to apply for roles using stolen credentials and proxy interviewers. The aim is to access source code, customer data, and intellectual property once they're inside the organisation. Recruiters are on the front line here, And in many cases, the only tool they have to manage this huge business risk is their own judgment.

2:19So how seriously should employers be treating this? And what does a credible response look like? My guest this week is Lauren Fury, Principal Product Manager at Proof, where she leads product work on candidate fraud and identity verification. In our conversation, Lauren explains how these attacks work, where hiring processes are most exposed and what TA teams can do about it. Hi, Lauren, and welcome to the podcast. Thank you so much for having me, Matt. It's nice to be here. An absolute pleasure to have you on the show. Please, could you just start off by introducing yourself and telling everyone what you do?

2:56Sure. My name is Lauren Fury. Currently, I'm a principal product manager working at a company called Proof, where we are really focused on ensuring that the candidate experience and candidate fraud pervasive problem is mitigated for our clients, and we extend into other identity validation scenarios. My background actually comes from also having built products at Lattice, as well as DocuSign, and a long history of being really customer-centric. So very excited to be here today talking to the people that we really care about. I think it's a really interesting topic because we're talking about candidate fraud.

3:33It's a very big topic in talent acquisition at the moment. But I think there are aspects to this that people just haven't thought of. So really looking forward to hearing your insights on some of these things. So let's just start off and talk a little bit about the landscape. So this is a big issue at the moment. I think there are lots of things that kind of all get rolled into one from candidates sort of using AI to embellish applications to people not being who they say they are, all the way through to sort of serious criminal activity. Tell us a little bit about the part of that that you work in and what's kind of going on at the moment and why it's so important.

4:12I would say the landscape is changing rapidly, and I'm happy to kind of take us through a little bit more on why I think that is. But at the moment, the most pressing issues that we're seeing is clients dealing with different vectors of falsehood in the application process. So how do I sift through applications that are coming through from bots, which are these automated systems generating and submitting job applications at scale? And I'm not talking about an individual applying to 50 jobs. I'm talking about systems firing off hundreds of tailored applications. So that's one kind of vector that folks are dealing with.

4:49There's also this new presence of deepfakes. It's becoming more accessible and available. These video manipulation tools used to be really out of reach of a normal consumer, and they're not anymore. So now we see that showing up in the interview process, and it's a really unique and sometimes off-putting or scary experience for recruiters to deal with. And generally, we're seeing identity harvesting, which essentially means that these stolen identities, we just saw a news story about driver's licenses being made broadly available. That's exactly what these folks are doing. They're taking this real identity, adjusting it slightly and applying to jobs.

5:29So it seems like they are valid, but they're not. And they often use proxy interviewers through that process. So a lot of different ways in which this is manifesting for our recruiters and a lot of different ways in which they can filter through that or think about it or feel exposed right now. What are some of the motivations behind this? because this isn't about people trying to get a job they might not be qualified for. There's a lot more sort of serious things going on, aren't there? Yeah, it's actually quite serious. So to the point where the DOJ has put out notices to be on the lookout for these things, there's a lot of documented cases of foreign workers essentially trying to come through and get these jobs.

6:13And I think that can feel really far away and potentially like it would never happen to us, right? It feels like something that is so grandiose, it's like a fairy tale. But really what's occurring here is that these foreign governments, and we do primarily see this coming through from North Korea, but also others, they're running these organized, funded programs where workers are specially trained to apply for these remote jobs at Western companies. They use stolen credentials. They essentially are coming through under false identities. They can use AI-generated documents, or sometimes this is a great example of the utilization of deepfake technology.

6:54And why they want to do this is, it sounds so obvious when we start to say it, right? But it's, first of all, to collect the paycheck, which more often than not is going directly back into that government, which often can also be funding weapons programs. They've traced it back to that. So that's quite scary. But then also it's to gain access to your data and your systems, your source code, your customer data, your intellectual property. So there's a lot of like heavy motivation from these operatives to get in there and get into these really, you know, high touch jobs like the engineering side, like customer support side, like the IT side.

7:34And often these are also the roles that happen to be remote. So it feels like a nice intersection for them to sit at and just exploit from the inside of the business. It really puts talent acquisition on the front line here, doesn't it? Doing something that they've not really done before, you know, validating who people are in quite a different way. Why is it falling to talent acquisition and what do they need to be aware of in terms of the bigger picture, who they should be liaising with, those kind of things? Yeah, it's something that we talk about a lot, even internally within our own business, right?

8:09Because we can even just go as far as our own doorstep to say, like, how are we experiencing this as a business? And how are our recruiters feeling when they go through these processes? And I do think it is presenting a really novel problem to the recruiting teams, to the talent acquisition teams, because, you know, up until really recently, there was this reliance and belief that the background check was sufficient. And it is still a necessary part of this flow. So I never want to say that it's not. It's absolutely still a foundational part of this. However, we also tend to over assume like how good we are at reading these deep fakes or assuming that we will be able, our intuition will tell us enough that we can kind of filter through people.

8:56But this problem is quite sophisticated. So this new sophistication is coming through at the front door of the business. And then, you know, getting into the business can really exploit a company. It can be a very massive scale of a problem. So what that puts is a really specific kind of pressure onto the folks who are going through the applications, who are talking to the individuals up front. And this does extend into the interviewer and the interview staff, but they're not the ones I think that would have to kind of sit with that responsibility at the end. So it's a very unique pressure that's being applied into the talent acquisition teams.

9:36And one that I think, and we can talk about this a little more, will need to eventually and should eventually grow into this responsibility that is shared across the organization. So we'll see some more sophisticated teams where their InfoSec team or their security team or their IT team is working much more closely with HR to say, we realize we have a weak point that is potentially going to get exploited. How do we partner to make sure that we don't? That is a great, that is a great scenario. We don't, we still aren't seeing that broadly across organizations. And HR is still trying to figure out how they sift through those different kind of attack factors.

10:18That's a really interesting point. And I think that in a lot of companies, it feels like the recruiters are kind of out on their own, sort of trying to spot this. And the bigger implications of it aren't really being realized and they're not getting that kind of support. Where are the kind of the gaps in this sort of typical processes at the moment? Because you sort of mentioned background checks, which are something different. People are doing video interviews, those kind of things. Where's the risk? Where are the gaps at the moment? I think it varies. The shorter answer of this is that it can vary by organization.

10:48And it also varies by the type of fraud or attack that you might be dealing with. So as maybe to back up just a moment and give a little bit of additional context, the reason why we're here is that in March of 2020, we took these processes that were really a lot of in-person processes, a lot of in-person interviewing and handoffs, and you'd come and sit on site for a day. And that all went remote. So as soon as COVID happens, right, everything goes remote. So this was a process that was immediately pushed into a new kind of setting. And we are still catching up with how do we make sure that this feels as thorough and complete as possible.

11:28And I think this has been a really wonderful forcing function for that. Now in 20, so that was 2020, roughly in 2022, we saw these consumer grade deepfakes start to really accelerate so that we started to see them become more pervasive and available and they started to become largely free. And now with less technical acumen needed to operate them, we're starting to see more people apply them. Roughly similar timing in 2022, generative AI starts to come through. That's a kind of different, it can present different types of fraud. So now normal consumers could start to make up things about themselves in a way that is maybe more sophisticated than they previously could, more elaborate than they previously could.

12:09And then we start to see these things really converge in this kind of fourth moment that we're in right now, where it's, hey, now we have remote hiring. We also are using these deep fakes that are exceptionally good at scale. We're seeing generative AI come into play. And now, we're probably on the cusp of seeing agentic AI really push into this space as well. So I think there's just this really interesting intersection that we're sitting at, and companies are feeling that exploitation across the funnel. So what that can look like is upon application, am I seeing a client that feels genuine, or am I seeing somebody who does match their LinkedIn, who seemingly matches a LinkedIn, but there's maybe some bits of that LinkedIn that don't feel completely correct?

12:55then we'll start to see throughout the process that there could be proxy interviewers. So I'm interviewing for this role in this moment. When we get to the skills assessment, I'm going to tag somebody else in. There's no through line for who were you expecting to meet with. It's a new interviewer, new individual on my side. It kind of works out. Every break or every introduction of a new interviewer allows for those tools in this toolkit to come through and be utilized by these bad actors. So the way that we kind of think of it is however your funnel, however your hiring funnel is structured, anytime you're introducing someone new from your side into that mix, which is right to do, we want to vet them culturally, we want to look at the candidate from all different facets of their skill set and aptitude, this is the right thing to do.

13:44But when you bring someone new in, there's not that connective tissue of who is it I'm supposed to be talking to. So that was kind of that analog process had solved for it when we were in person, you just walk them to the next conference room. We're not doing that anymore. So something we've really looked at is how do you start to build continuity before we get to background check, so that once we're at background check, we know that this thing we're vetting is the individual we've seen throughout. So we need to start building that kind of forward funnel assurance, so that by the time we get closer to background check, I9, and onboarding, we have something that can also follow them through those processes.

14:27And then we've got confidence of we know who we're dealing with here. And tell us a little bit more about how that's done, because I know that at the moment there are lots of TA people who are, the only tools they have at their disposal are their kind of insight and judgment and some really unsophisticated things that probably don't even work anymore, like asking people to put their hands in front of their face and those kind of things. What is it that's kind of available to kind of help with this problem? I guess I want to say too that we had mentioned previously, like, man, this falls to our TA staff and our recruiters, and they're sitting in this really kind of tough intersection.

15:03I think something that's important to talk about here too is those folks, although it feels like you're dealing with this novel problem, and perhaps you don't want to do it alone, these folks are actually made for this as well. Like, Like going back to that intuition, this group of people that excel in this career path do have great intuition. They do know how to like really engage with humans. They know how to, you know, bring somebody into the fold and ask the right questions. So as much as it can feel like tense or like uncomfortable to sit here in this space at this moment, we also know these folks are made for it, which is great.

15:42Because then when we start to talk about how do we actually start to resolve these issues, especially at scale, they're the right people for the job, which is perfect. So what we've started to see is there's levels of sophistication that you can start to do here, right? The highest level of sophistication is to build that through line, is to say, how do I start to put candidates through identity verification early and then have them have a point of reference from that identity verification? So as an example, and this also, by the way, I'm going to caveat that some of these will depend on how you feel with your legal team, your compliance team, how you feel as a business for hiring.

16:22But what we have seen is folks taking an image from that identity verification and saving it to the ATS so that every time somebody comes back through and is doing that interview and they're meeting that person remotely, there's a point of reference. Who is supposed to be here? That can grow in sophistication to saying, we're actually going to gate your access to these interviews and to these conference calls or to these skills assessments by a selfie through biometric. Now, you can also do this in a much more available or accessible way. And that is just through simple identity verification. These are easy tools to access.

16:59They are becoming increasingly familiar on the candidate side. and essentially all they do is to say, can you let me scan your driver's license or another kind of documented credential? And sometimes it'll also include that biometric. Can I scan your face to kind of match it to that documented credential? What this does is it does say up front, how am I pairing the applicant with that resume, with that, say, LinkedIn or other additional research, and then how are we following that person through the process? So as much as you want to kind of like automate that or make it systematic, or if you want to just kind of do it in touch points, both of those are available to teams.

17:43I think the important part is don't feel so overwhelmed to do nothing. Start somewhere. Start somewhere and see how things adjust. And how does that fit with the candidate experience? So those candidates who are not trying to commit a crime or fraudulently get the job, how does that sort of affect their experience of the process? This is such a great question because we've had clients actually articulate to us, you know, and I love this quote, but they said the passive candidates are the best candidates. The ones that you really want to attract are often the ones that are not actively seeking.

18:15So you want to give them low friction, high, like white glove, high touch, high availability kinds of interview processes. And this can feel like friction that you may not necessarily want to introduce for them. Now, something proof is doing that I think is really critical is understanding the candidate experience. What is the willingness of candidates to engage in these types of identity verifications? Does it change? Does that willingness change based on where you put it? So for example, if your identity verification is occurring right at application, does that drive your funnel and conversion down a lot, like to a point where you're actually losing a lot of great candidates?

18:58Does it raise great signal? The people who are willing to complete the identity verification are the folks that are really interested in your company and they really want this job. So that kind of trade-off is up to the client to make, I'd say. But full transparency, candidates are still getting used to this new space. I will say this is becoming increasingly normal. I think we're going to see a really big tick in 2027 of identity verification and identity continuity being an organic part of the application and interview process. And I think that kind of takes my mind to the next question, which is what does the future of this look like?

19:37So you mentioned earlier as this gets agentic and happens at scale, how do you think it's going to pan out over the next few years? This is really fun to always theorize on this. So not only do I think we will have to start, we're already seeing this trend occur in the market. We're going to have to see identity validation done earlier in the process that will become normal. What I think will be an optimistic future is that we then build these continuity pieces that can allow us to say, and I don't know that I've done a great job of explaining what I mean by identity continuity, so let me do it here, but essentially saying, where do we put this in the process to, to your point, not lose a ton of great candidates, right?

20:23There's a funnel optimization that we get to play with. Great. And in the course of that, how do we take attributes of that identity or give that individual a digital certificate or a verifiable credential such that at any recurring touchpoint, they just use a biometric, they get access to that next stage, it is a comparison to the previous biometric or a comparison to their identity credential image, and we say, this is enough. allow them through. Now, I think there's also a benefit that we are going to realize in the coming years that is actually on the consumer side, is on the candidate side, which is to say, if all these driver's licenses are actually made available at scale, if we all kind of know that our socials are out there, at one point, it's going to have to be how am I being protected, almost like your credit score.

21:15Who is applying to jobs right now is Lauren Fury with my background, with a manipulated LinkedIn that looks just like me, and they're using the data and attributes off of my license with just an edited image. How do I start to feel protected? So there is a value prop that I think the businesses will start to get to articulate back into applicants and into, you know, the audience at large to say, we're protecting you. We're not hiring people that are not real. This is a very intentional step in making sure our business has high integrity and wants to take care of its individuals. So I think we'll start to see that narrative and that motivation shift.

21:57And we'll start to see that it's expected not only from my side to have a verifiable credential where I can then apply to different jobs, use that thing, it feels more seamless and they get to know who I am with assurance without a reveal of any sensitive data, without any kind of bias being introduced into the process. I think there's ways that we're going to see sophistication rise. I'm really excited. I'm very optimistic about the future. That is because, by the way, and I didn't necessarily articulate this, but those systems and that kind of the development of these really interesting tools is not going to slow down and the bad actors are not going to slow down.

22:39So we'll continue to see that occur. So I think we just have to realize the value for both the candidates as well as the businesses. Finally, give us a kind of really practical tip. So lots of people listening will be worried about this. They're worried that they're exposed to it. What can people sort of do tomorrow, first steps, to help safeguard their employer? Yeah, I think the best thing that you can do is to build, start to consider your defense in three layers. And I do think some of that is going and talking, like initially going and talking internally to your IT teams, to your legal teams, to a finance team, your CHRO.

23:15I think starting that conversation right away is point one. Hey, we are feeling this point of exposure. We want to make sure that we are protecting the business. we have an idea for how we can begin this. Can we start and test, right? None of this has to be a full baked commit. Let's start to test. Then what that test might look like is, so that's probably step one, right? Step two is to test it. Work with a identity verification vendor who can help to do standard IDV early in your funnel. Put it in front of, I would not say put it at the outset of application, put it before either the hiring manager interview or a phone screen such that the candidate feels like an interest.

23:57There's a motivation for them to complete it. Make sure you're articulating that to your candidate and then see how we do. See how that conversion rate affects y 'all. See if you can play with the language. Start to truly use this as an experimentation in your funnel, but allowing it to also source for you, hey, we're seeing a lot of bad actors come through and like, let's feel them get filtered out. Now, during that process, I'd say what you need to talk through, this is probably part three, is how are we looking at the data such that we can then make a decision of what next, what has to come next?

24:30Do we need to kind of have this persist in another way down funnel? Do we have another point of exposure that feels really obvious to us at point of onboarding and making sure that we are still tying back to that first person we met? How do we close that kind of trust gap? So maybe it's go talk internally, map out your experience, map out your process, start to test upstream, and then make a plan for how is this going to get implemented at scale. Lauren, thank you very much for talking to me. Oh my gosh, thank you so much for having me, Matt. This was really enjoyable. My thanks to Lauren. You can follow this podcast on Apple Podcasts, on Spotify, or wherever you listen to your podcasts.

25:11You can search all the past episodes at recruitingfuture.com. On that site, you can also subscribe to our weekly newsletter, Recruiting Future Feast, and get the inside track on everything that's coming up on the show. Thanks very much for listening. I'll be back next time, and I hope you'll join me.

25:41Thank you.