How to verify a remote engineer is who they say they are, without insulting the good ones
Juan Molina ยท
Deepfake applicants are a documented risk in remote tech hiring. Six respectful checks that protect your company and treat genuine candidates fairly.
Earlier this year, a Japanese IT company interviewed a candidate online who said he'd been raised in the United States and asked for a fully remote role. When the company said in-person attendance was required, he ended the interview after about two minutes (UPI, March 20, 2026). Analysis of the footage by Okta and a deepfake detection startup found a high likelihood it was AI-generated. The profile matched the career details of a real Tokyo tech CEO, whose public images appear to have been used.
Okta said more than 6,500 similar cases have been identified globally in recent years, involving people believed to be North Korean IT workers using fake identities to get remote jobs at foreign companies.
How hard is it to build a fake candidate? Palo Alto Networks' Unit 42 tested it. A researcher with no image-manipulation experience created a synthetic interview identity in about 70 minutes, using free tools and a consumer graphics card from 2020 (Unit 42).
This is a real risk for any company hiring remote engineers. But most candidates are exactly who they say they are. The goal is a process that stops impostors while treating genuine candidates with respect.
6 respectful checks
1. Cameras on, for everyone, from the first screen. Make it a standard part of the process and say so in advance. When it applies to everyone, nobody feels singled out. Unit 42 recommends cameras on for all interviews, including early screens (Unit 42).
2. A simple, friendly movement check. Unit 42 found that passing a hand in front of the face was the most effective way to disrupt real-time deepfakes, because it breaks the facial tracking. Quick head turns and changes in lighting also expose glitches. Asked lightly ("could you wave at the camera for a second?"), it takes five seconds and offends no one.
3. Verify identity once, properly, before the offer. Rather than suspicion at every step, use one clear identity check: an ID document check with liveness detection that confirms the person matches the document (Unit 42). Tell candidates it's a standard step for every hire.
4. Ask about real work, in depth. A live conversation about a project the candidate actually did, with follow-up questions about decisions, trade-offs and mistakes, is hard to fake and is also the best way to judge a genuine engineer. Good interviewing and good verification are the same thing here.
5. Offer one in-person or live-video step where possible. In the Japanese case, the request to attend in person ended the interview in two minutes (UPI). If an in-person meeting isn't practical for a remote role, a final live session with the hiring manager serves a similar purpose.
6. Bring security in after the hire. Unit 42 recommends limiting new hires' access until verification milestones are met, requiring multi-factor authentication tied to a physical device, and watching for unusual activity in the first weeks (Unit 42). This protects the company without adding friction to the interview.
Keep the candidate experience in mind
Every one of these checks can be done in a way that feels professional rather than suspicious:
- Explain them up front.
- Apply them to everyone.
- Tell candidates why: you protect their identity as much as your company's.
Genuine engineers, whose own identities can be stolen and used in these schemes, usually appreciate it.
Remote hiring opened up a global talent pool. A few clear, respectful checks keep it open safely.
If you're hiring remote engineers and want to talk through a hiring process that is both safe and candidate-friendly, you can book a 15-minute call.
Not ready for a call yet? You can post your open role for free.