Candidate impersonation is no longer a curiosity. Hiring agencies that supply a "ringer" — a professional interview-taker who assumes the candidate's identity on camera — and proxy work-for-hire networks that let one person interview and another do the job are now a documented fraud market, concentrated in remote technical and licensed roles. The schemes vary; the tells cluster in predictable places. This is the playbook for catching them.
The three schemes you're actually up against
1. The one-time ringer. Someone else takes the interview for the applicant. The documents presented may be real (belonging to the named applicant), the face on camera belongs to an accomplice. If hired under this scheme, the "candidate" never appears again — or vanishes after the first evaluation round.
2. The interview proxy, real worker. The applicant genuinely does the job but outsources only the interview to a better-presentation actor. Detection here is consistency: the on-camera persona and the working persona differ.
3. The work proxy, fake interview. The opposite: a competent interviewer, and an AI tool or subcontractor producing the work after hire. Same detection logic inverted — does submitted output match what this person can demonstrate live?
Interview-side tells
None of these alone means anything. Stacked, they're loud:
- Eye movement and audio cues. Gaze consistently at a fixed off-camera point rather than at questions; faint answer latency — a beat of silence then fluent delivery, repeating per question. Earbuds produce the classic half-second lag while answers are relayed.
- Vocabulary discontinuity. The candidate's written history is casual, their interview answer is consultant-polished — or the reverse: flawless on camera, unrecognizably different in a chat thread a day later.
- Depth collapse on follow-ups. An actor can recite a STAR story; they cannot survive "why did you choose that over the alternative?" "walk me through the version you rejected." Ask for the messy middle of a project — the part only the person who lived it has.
- Camera negotiations. Bandwidth excuses to go camera-off at exactly the live-skill portion; lighting that makes the face ambiguous; framed shots that shift between calls as if the setup moved.
- Identity drift across rounds. Different-looking person on the panel call versus the screening; "that was my manager on my account."
Process rules that prevent most of it
Verify identity once, hard, before offers. Government-ID document validation plus a liveness check (face matched to the ID against a random challenge, vendor-verified) kills scheme #1 entirely. The single most important property: the check happens before credentials, payroll, and system access exist, not during week one.
Anchor the interview in live, un-rehearsable work. A short practical session — debug this together, design this on a whiteboard, talk through your submitted code screen-share — costs fifteen minutes and is where rings and proxies fail. Recorded take-homes test whoever did them; live collaboration tests who's talking.
Proctor high-stakes assessments for roles where fraud economics are strong (licensed, security-cleared, high-rate contract). Screen capture, behavioral flags, session consistency — the same mechanisms described in detail across our proctoring guides; on the hiring side, they're cheap insurance against a wave of fabricated passes.
Watch post-hire continuity. The impersonation that slips the net announces itself in week one: work style unlike the interview, unexplained delegation, requests to shift to async-only. Treat the onboarding period as a verification window, not a victory lap.
Where this belongs in the pipeline
Impersonation detection is a screening problem wearing a security costume. Every check above — ID validation, liveness, practicals, assessment integrity — produces a signal that should land in one per-candidate evaluation record with a consistent decision standard, not in four tools and a recruiter's memory. Teams running remote-volume hiring build that layer deliberately: AI candidate evaluation is the sequencing, scoring, and consistency piece. And run everything uniformly with disclosed checks — selective verification is both a legal exposure and an easy ring bypass.
Bottom line
Detect candidate impersonation by combining a hard pre-offer identity check (ID document + liveness) with interview techniques rings can't survive: unscripted follow-ups into the messy middle, live practicals, vocabulary and depth consistency, and attention to camera negotiations. The schemes differ — fake face, real face fake worker, real face outsourced work — but all of them fail the same test: whether the person on camera and the person doing the job are demonstrably the same.