Short answer

Hiring fraud now runs in both directions. The FBI warned in 2022 that applicants were using deepfakes and stolen personal information to win remote jobs, and in October 2026 that North Korean IT workers use facilitators to appear on camera and take interviews. Fake employers also use job offers to steal money and identities. Verify identity live and never pay to get a job.

Key takeaways

  • The FBI's IC3 warned in June 2022 of complaints about deepfakes and stolen personal information used to apply for remote jobs, mainly in IT, programming, databases and software.
  • Signs listed by the FBI include lip movements that do not match the audio and coughs or sneezes that do not line up with what is on screen.
  • In an October 2026 alert the FBI said no single indicator reliably identifies a North Korean IT worker and urged layered identity checks across the employment lifecycle.
  • Job seekers are targeted too: the FTC says legitimate employers do not charge you to get a job.
  • Check deposits followed by a request to send money back are a classic fake-job trick.

Two directions of hiring fraud

Hiring scams are no longer only about fake jobs that rob applicants. Remote work has also made it easier for someone to pretend to be an applicant. Employers and job seekers now face different versions of the same problem: you cannot trust a screen on its own.

When the candidate is fake

In June 2022 the FBI’s Internet Crime Complaint Center warned of an increase in complaints about people using deepfakes and stolen personal information to apply for remote and work-from-home jobs. The roles were mostly in IT, programming, databases and software, and some gave access to customer data, financial data, corporate IT systems or proprietary information.

The FBI listed signs to watch for in online interviews: voice spoofing, lip movements that do not fully match the audio, and coughs, sneezes or other sounds that do not line up with what is on screen. It also noted that background checks sometimes showed the applicant’s personal information belonged to someone else.

In October 2026 the FBI issued a further alert on North Korean IT workers. It said these workers pay facilitators to appear on camera and take part in interviews or meetings, and pay freelancers to conduct interviews on their behalf. It said no single indicator reliably identifies them, and recommended an “identity in depth” approach: layered controls across the whole employment lifecycle, attention to remote-access tools on work devices, and extra verification steps such as multiple IDs or live verification. It cautioned that such steps can also affect legitimate applicants and that name filters can harm identity-theft victims, so controls should be tuned to limit false positives.

That alert does not say AI face-swapping was involved, so we do not claim it. The takeaway is that the person on the call may not be the person who will do the job, with or without a deepfake.

What employers can do

  • Verify identity with more than one method, including a live document check.
  • Ask specific questions about the stated school, city and past employers.
  • Watch for mismatched audio and video, and for post-hire changes of bank accounts or addresses.
  • Involve HR, IT and security together, as the FBI recommends.
  • Report suspected cases to your local FBI field office and ic3.gov.

The same discipline applies to payments: see deepfake video call fraud for the callback and two-approver rules.

When the employer is fake

Applicants face the older scam. The FTC says easy money for little work is a warning sign, and that legitimate employers do not charge for starter kits, training, certification or job guarantees. Another classic: you are told to deposit a check, keep part and send the rest on. The check is fake and will bounce, and you owe the bank the full amount.

AI makes the pitch more polished, as discussed in AI-generated phishing and scam scripts, and recruiters can be cloned too. Check a recruiter through the company’s own website and switchboard, not through contact details in the message. Our job scams guide covers the full list of patterns.

If something goes wrong

Applicants who paid should contact the payment provider immediately and report to ReportFraud.ftc.gov. If you handed over ID documents, see data breach: what to do for freezing credit and monitoring accounts.

What you can do

  1. 01Employers: verify identity in more than one way, including a live check against government ID and a follow-up on education or location details.
  2. 02Employers: watch for audio and video that do not sync, candidates who refuse to turn a camera on or off, and sudden changes of bank details or addresses after hiring.
  3. 03Employers: report suspected cases to your local FBI field office and to ic3.gov with names, emails, phone numbers and IP addresses.
  4. 04Applicants: research the employer and the recruiter independently, using contact details from the company's own website.
  5. 05Applicants: never pay for training, equipment, certification or a guaranteed job, and never deposit a check and send money back.
  6. 06Applicants: do not send ID documents or bank details until you have verified the employer and signed a contract.

Related reading: AI voice clone scams and the data breach tracker.

Frequently asked questions

How can I tell if a job candidate is using a deepfake?

The FBI lists voice spoofing, lip movements that do not fully match the audio, and coughs or sneezes that do not line up with the image. Do not rely on spotting flaws. Add live ID checks and ask specific questions about the candidate's stated education and location.

Do the FBI warnings only concern North Korea?

No. The 2022 alert described applicants in general using deepfakes and stolen personal information. The October 2026 alert concerns North Korean IT workers specifically and does not mention AI or deepfakes, but says they pay facilitators to appear on camera and take part in interviews.

What are the signs of a fake job offer?

The FTC lists easy money for little work, requests for payment for kits or training, check deposits where you send part back, and reshipping roles. See our job scams guide for more.

What should I do if I paid a fake employer?

Contact the company you used to send the money right away and ask for a reversal, then report at ReportFraud.ftc.gov. If you shared ID details, go to IdentityTheft.gov for a recovery plan.

Sources

  1. Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions (I-062822-PSA), FBI Internet Crime Complaint Center, 2022-06-28
  2. North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (I-101326-PSA), FBI Internet Crime Complaint Center, 2026-10-13
  3. Job scams, Federal Trade Commission, 2023-03-01

This article reflects public information as of 2026-11-06. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.