Fake candidate detection and real-time social engineering defense for hiring
Diopter helps your recruiters confirm that the person in the interview is the person who applied, and that the face and voice on screen are real. We test your hiring team with simulated fake candidates, then assist them during interviews with real-time alerts before a second round or an offer goes out.
A free simulated attack on a team you choose, with an NDA first if you want one.
What can Diopter help your hiring team do in interviews?
Diopter covers each stage of remote hiring, from the first screen through the offer and onboarding.
Confirm the person on screen is the person who applied. A lifted résumé and an AI-generated photo can get a fake candidate booked for a screen.
Run remote technical rounds you can trust. A face swap covers a stand-in, or a helper on a second screen might be feeding the "candidate" answers.
Send laptops and access to the right person. After the offer, the "new hire" might ask to ship the laptop to another address or to be paid through a third party.
Check contract and agency placements. The agency never met the candidate on camera either, so your interview was the first real test.
Prove your controls to clients and auditors. If they ask how you verify who you hire into roles with system access, simulation results and the evidence trail from interviews can help you answer.
How does Diopter help stop fake candidates in a live interview?
Diopter checks four things for every interview, both before and during the call.
Identity
Whether the application matches public profiles and past work. LinkedIn might say one thing, GitHub another, and the application a third. A history that only goes back a month can be a signal on its own.
Voice and video
Cloned or text-to-speech voices, plus face-swap, reenactment, and lip-sync artifacts on video. Diopter scores the candidate for the whole interview, so a swap that only lasts 5 minutes still gets caught.
Conversation
A camera that "stops working" when you ask the candidate to turn, a rush to get an offer, or a push to move the conversation to chat.
Policy
Requests checked against your hiring process, such as asking to send a laptop to a different address, be paid through a third party, or skip an identity step.
Your recruiter sees the alert, the reason, and a suggested next step, such as asking the candidate to verify their identity. A person decides with the evidence in front of them, and Diopter never rejects anyone on its own. The result and the transcript go to your applicant tracking system (ATS) and to security. For live interviews on Zoom, Teams, or Meet, see live interview detection.
Which fake candidate attacks have already hit employers?
North Korean IT workers using stolen identities have been hired into US companies, including the security firm KnowBe4, and the FBI now sees AI used on interview calls themselves.
In July 2024, KnowBe4 said it had hired a North Korean worker posing as a US-based software engineer. Using a stolen US identity and an AI-enhanced stock photo, he passed background checks, reference checks, and four video interviews. As soon as the company laptop arrived, he started loading malware onto it, and KnowBe4's security team caught him.1
In October 2026, the US Department of Justice announced the indictment of 14 people for placing North Korean IT workers inside more than 70 US companies. The workers used stolen or made-up identities, and "laptop farms" at facilitators' homes kept company laptops online for them. The scheme brought in about US$3 million.2
The FBI logged 691 complaints in 2025 where AI was used in employment scams. It flagged voice spoofing, and possibly voice deepfakes, during online interviews, with lip movements and coughs that didn’t line up with the audio.3
These attacks follow the same pattern:
- 01
A strong profile appears, with a résumé that's a near copy of a real engineer's under a new name.
- 02
The interviews go well enough. The video is slightly laggy, there's a pause before each answer, and the candidate might ask to reschedule once.
- 03
After the offer, the new hire asks you to ship the laptop to a different address or pay them through a payroll service you've never heard of.
- 04
A month in, the work is thin, and the access has been in use the whole time.
Why do fake candidates get through remote hiring?
Remote hiring runs on video calls, but most checks look at documents. ID verification confirms that a passport scan matches a selfie and stops there, and background checks run on whatever name you were given. Interviewers are trying to hire, so they rarely test whether the face on screen is real. Talent teams want to know whether this is the person who applied, whether they're where they say they are, and whether they can do the job, in that order. Diopter checks the same things in the same order and also watches the interview itself.
| Capability | ID verification | Background check | Interviewer training | Diopter |
|---|---|---|---|---|
| Checks identity before the call | Yes | Yes | No | Yes |
| Works live in the interview | No | No | Yes | Yes |
| Detects a swapped face or cloned voice | Partly | No | No | Yes |
| Flags a candidate avoiding identity checks | No | No | Relies on the person | Yes |
| Sends the result to the ATS | No | Yes | No | Yes |
Checks identity before the call
- ID verification
- Yes
- Background check
- Yes
- Interviewer training
- No
- Diopter
- Yes
Works live in the interview
- ID verification
- No
- Background check
- No
- Interviewer training
- Yes
- Diopter
- Yes
Detects a swapped face or cloned voice
- ID verification
- Partly
- Background check
- No
- Interviewer training
- No
- Diopter
- Yes
Flags a candidate avoiding identity checks
- ID verification
- No
- Background check
- No
- Interviewer training
- Relies on the person
- Diopter
- Yes
Sends the result to the ATS
- ID verification
- No
- Background check
- Yes
- Interviewer training
- No
- Diopter
- Yes
How do Diopter's social engineering simulations test your hiring team?
Diopter runs simulated fake candidates against your recruiters and hiring managers, with a cloned voice or a face swap if you want it. You see who spotted the fake and at which stage, so you can harden both your hiring process and your interviewers. Do the dry runs with us through social engineering red teaming, so our agents hit you before a real attacker does.
- We’ll run simulated screens and technical rounds built from real fake candidate cases
- You’ll receive results by team and by step, so you know which teams to fix first
- The same scenarios then become the checks Diopter runs on live interviews
How does Diopter roll out for a security team?
Diopter rolls out in two steps. Pilot with one hiring team in days, then go wider through MDM once it's working.
OpenTelemetry native: logs flow into your SIEM, and EDR and MDR connect via API
Sends the result and the transcript to your ATS
Runs on Zoom, Microsoft Teams, and Google Meet, since candidates pick the platform about as often as you do
Captures calls with or without a bot, with nothing to install on the candidate's side
Rolls out through MDM (Intune, Jamf)
Offers configurable data retention, including zero retention, and on-prem or hybrid deployments
Two ways to start
Your first agentic attack is on us. Fill out a form and we'll chat about how to run a simulated fake candidate against one of your hiring teams. Want to talk about live interview defense instead? Book a walkthrough, and we'll replay a real fake candidate interview and show you what Diopter caught and when.
Common questions for hiring and security teams
Can Diopter test our hiring team with a simulated fake candidate first?
Yes. We'll send simulated fake candidates into your screens and technical rounds, using a cloned voice or a face swap if you'd like, and show you where each team caught them. Most teams start there, then turn on the same scenarios for live interviews.
Can I tell if a candidate is using a deepfake on a video interview?
Yes. Diopter scores the video for face-swap and lip-sync artifacts across the whole call, which is hard to do by eye. Interviewers can also ask the candidate to turn sideways or hold a hand in front of their face, watch the edges of the hair, and look for lip movements that trail the words. A fake candidate's camera often "dies" right when you ask.
How do I spot North Korean IT workers applying for remote jobs?
Diopter looks for the signs that keep coming up in Justice Department case files, like a résumé lifted from a real engineer, a profile that's only a few weeks old, a demand for a fully remote role with no exceptions, and a laptop shipping address that isn't the candidate's. We check for those before the call and score the call itself. A person reads the result, so nothing gets rejected automatically.
Does fake candidate detection cover interview fraud too?
Yes. Diopter treats candidate fraud and interview fraud as two halves of one problem. Candidate fraud is the identity side, such as a lifted résumé, a generated photo, or a profile with no history. Interview fraud is the live side, like a proxy answering off camera, a face swap, or a cloned voice. That's why we check identity before the call and score the media during it.
Does candidate fraud detection change the candidate's experience?
No. Diopter needs nothing installed on the candidate's side. In bot-free mode it runs on your interviewer's device, and the call looks the same as usual. In bot mode it joins under a name everyone can see.
How does Diopter avoid false alarms in interviews?
Diopter won't flag a nervous candidate or a bad connection. It looks for signs of AI-generated video or audio and for an identity mismatch, and it never scores accents, appearance, or where someone lives. Before it alerts, it needs to see the whole pattern, and a person reviews the result.
What should you look for in a fake candidate detection tool?
Start with your own hiring process. A verified-identity step before the final round, a live check that the person on camera matches the ID, and a laptop shipped only to a verified address can stop many fake candidates without any tool. When you compare fake candidate detection tools, run each one on your own interviews during a pilot and measure how often it flags a real candidate, how fast the result reaches the interviewer, and what it does with recordings and candidate data. Check that it covers the interview platforms your team uses and fits your applicant tracking system and security tools. Every hiring decision should stay with a person. Your own pilot will tell you more than any vendor's benchmark, ours included.
Research behind fake candidate detection
- CyberScoop, Jul 2024, on KnowBe4 hiring a North Korean fake IT worker.
- US Department of Justice, Northern District of Ohio, Oct 13, 2026: 14 indicted in North Korean remote IT worker conspiracy affecting more than 70 US companies.
- FBI IC3 2025 Internet Crime Report: 691 AI-referenced employment complaints, and voice spoofing or potential voice deepfakes during online interviews.