Interviewing someone who doesn’t exist

Two years ago, a US company KnowBe4 hired a senior software engineer. He’d made it through four video interviews, reference checks and a background check. Then, the company sent him a work laptop, and the moment he received it, it started downloading malware. Turns out, the photo on his application was an AI-enhanced stock image, his identity had been stolen from a real American and the person behind the candidate was actually a North Korean operative.

And here’s the kicker: KnowBe4’s business is teaching employees to spot scams.

This story has been a widely-told anecdote for two years now, but the tools that once took a state-backed operation are now available to anyone with an ordinary graphics card. Meanwhile, HR teams are still evaluating candidates using documents that anyone can generate and fabricate these days.

In this article, we’ll look at how AI is changing hiring on both sides and why a CV or an online interview may no longer tell you who a candidate is or what they can actually do. And most importantly: what you can do to verify both identity and skills without turning the hiring process into an interrogation.

CV is no longer a proof of anything

For decades, hiring relied on paperwork: the CV, the cover letter, the portfolio and the references. Recruiters would read them trusting they were providing a faithful image of the person who sent them.

That trust is now a thing of the past. AI can rewrite a CV in a minute, produce a cover letter from a single prompt and turn average experience into a compelling story. And it’s not just a handful of fraudsters now – polishing an application with AI has become the default, because candidates who don’t do it are competing against those who do.

So now, recruiters read texts not written by candidates, using them to assess skills they may not even possess. When the candidate can tweak any document at will, it proves nothing and becomes a marketing flyer instead.

It’s software on both sides now

Candidates, for their part, have stopped applying by hand. Bots can now send out hundreds of applications a day, tailoring each one to the job being advertised, and complete screening questionnaires. Companies respond using their own algorithms to sort and score applications – and in doing so, they often (perhaps unknowingly) end up in a legal grey area.

The EU AI Act puts automated candidate assessment systems into the high-risk category. This year’s amendment pushed the toughest obligations back to December 2027, but that doesn’t change the fact that most candidates never agreed to be scored this way. But under GDPR, a decision about a person made solely by automated means already requires a legal basis today. As a result, the first round of hiring often happens without a single human involved on either side. Instead, machines end up talking to each other, pretending there’s a human behind them.

The same pattern continues after people are hired. Last year, researchers from BetterUp and Stanford coined a new term, workslop: AI-generated work that looks finished and well put together but has no real substance. According to their survey, 40% of employees had received at least one piece of this “workslop” within a single month, and dealing with each case took almost two hours on average.

A manager who can’t spot workslop in their own team won’t spot it in a candidate at an interview either.

Probation is the most expensive way to find out

The North Korean operative is an extreme case, but his everyday version is on the other side of the screen at your afternoon video interview: a candidate running an AI tool on their second screen to get real time clues and hints. They come across as prepared and quick on their feet: their answers are to the point, with barely a second of hesitation when asked about a technical detail. The recruiter’s note: a strong candidate. The hiring manager agrees. Yet neither of them was talking to the person that will actually start in a month.

You could argue that this is exactly why probation exists. A new hire whose only real skill is reading hints off a screen will get busted as soon as they are tasked with real work, and the company will let them go. But probation isn’t free.

Let’s do the math. There’s time a recruiter spent on the job advert and screening, the time a manager sat in on interviews, and possibly an agency fee. Then there’s the salary, the equipment, onboarding, and the time colleagues had to spend training the new hire instead of doing their own work. Then, a fond farewell a month later, and the whole process starts over while the vacant role keeps holding the team back.

But each of these costs shows up in a different place. Adverts and agency fees come out of the HR budget, the manager’s hours aren’t logged anywhere, and the team’s slowdown gets buried in the quarterly results. That’s why no one ever adds them all up. An interview where the company fell for a polished facade then looks like a minor hiccup, but in reality, it’s the most expensive hour of the entire hiring process – and no one seems to care who’s going to pay for it.

Cybersecurity won’t fix this

Companies tackle digital threats by increasing their IT security budgets. But your firewall is designed to detect an attack on a system, not a lie on a CV. A deepfake candidate doesn’t need to break your cyber-defences; they simply walk in through a door the company opened for them.

In its 2026 Global Human Capital Trends report, based on responses from more than 9,000 leaders in 89 countries, Deloitte describes this shift exactly. According to the report, AI is blurring authorship and undermining trust in information about people and work, which is why companies should broaden their focus from cybersecurity to disinformation security. At the same time, Deloitte notes that few organizations are making significant progress in this area so far.

In HR, disinformation security boils down to one thing: an ability to verify that the person the company is hiring is real, is who they claim to be, and has the skills they claim to have. Identity and background checks are no longer something only banks and nuclear power stations need to bother with. In fact, the new Czech Cybersecurity Act, in effect since November 2025 and implementing the EU’s NIS2 Directive, lists personnel security among the mandatory measures for regulated companies. And screening is the most straightforward way to demonstrate it.

“Last year, our users were mostly interested in whether a candidate had business interests or was facing debt enforcement. This year, demand in the Czech Republic has grown by more than 300% and identity verification has become the most sought-after service. In other words, clients want to know whether a candidate is, in fact, a real person. Identity verification has moved from the last line on the form to the very start of the process, before any access is granted, because everything else can be easily generated online. Screening is no longer something only regulated banks and Fortune 100 companies have to perform. Today, it’s mostly critical infrastructure entities and their suppliers: manufacturers, transport companies, energy providers and IT companies, and not just those hiring fully remotely. This demand has been driven by the EU’s CER Directive and the Czech act on the resilience of critical infrastructure entities, which explicitly requires workforce screening.”
—Petr Moroz, CEO, Scaut.com

On its own, though, verification can quietly turn hiring into an interrogation. That’s why it should come with an agreement I like to call “the digital trust pact” where the company informs the candidates – in advance – about what it will verify, how and why, at the same time letting the candidates understand that an embellished story won’t hold up once it’s checked.

I’ll admit there is a weak spot though: some candidates will read screening as a sign of distrust, and in a market where people get to choose their employer, they can simply choose a company that won’t ask for any of that. It all comes down to how you handle it.

When a company is open from the start about what will be checked, why and for which roles, it comes across as professional. Customers aren’t offended when a bank verifies their identity before sending money, either. Quiet, blanket screening behind candidates’ backs confirms the very distrust they are afraid of, while a transparent process ensures that candidates with nothing to hide actually come out ahead.

How to hire when you can’t trust the paperwork

First, a reality check. Nowadays, many positions are filled entirely online, from posting job adverts to signing the contract, and it’s not going to change. A company that insists on holding three rounds of interviews in a meeting room is shrinking its own talent pool. So you have to set up your defences inside the online process – scraping it won’t help.

The first step is verifying identity and key details for roles with access to money, data or infrastructure. It should be done through an independent source (such as scaut.com) and before the person is given any access. For regulated companies, verification is no longer optional under the new Cybersecurity Act. For everyone else, it’s simple maths: verification costs a fraction of the damage a single fraudster can do with access to payroll, invoices or production systems.

The next step is an interview that produces evidence instead of impressions. Have candidates do a piece of real work live. Ask a salesperson to run a mock call with a client, an accountant to find the errors in a real document and a developer to think out loud while sharing their screen. Ask them why they chose a particular solution and ruled out something else. Because while AI can feed answers to a candidate, it will have a harder time (or at least won’t be as quick) defending a decision it didn’t make itself.

The final step is about AI itself. If the role you need to fill involves using AI ever day, don’t ban it in the interview. Instead, have candidates use AI openly and watch: how they prompt, how they check the output and whether they can spot a mistake before you do. A candidate who can do that is showing you exactly the skill you’ll need from them on the job. The problem starts when a candidate tries to hide their AI use.

And where the role allows it, keep one interview round face to face: it’s still worth it for senior and local roles. And where hiring is fully online, a paid trial assignment or a day working with the team can serve as good alternatives. Because an hour of real-time collaboration is much harder to fake than three rounds of questions.

Verify who your candidates are and what they can really do

Hiring in the age of AI isn’t about more checks on all sides. It’s about less blind faith in documents and more evidence that can support who candidates are, and what are their skills. Identity verification, a hands-on work sample and transparent rules for AI use don’t have to turn hiring into an interrogation. When a company explains what it verifies and why, it lowers its own risks and creates a fairer process for candidates.

That leaves two questions. Of the last ten people you hired, how many did you see actually working before they signed the contract? And if one of them wasn’t who they claimed to be, how long would it take you to find out?