There is a version of the “fake hire” story that treats candidate fraud as a technology problem: AI got good, bad actors got access to it, and now HR teams need better tools.

That framing is incomplete, and it leads to incomplete responses.

The more accurate version is that generative AI transformed hiring fraud from an individual crime into an industrialized operation, changing the economics so completely that the defenses built for the previous era no longer apply.

What fraud looked like before

Until relatively recently, sophisticated candidate fraud required meaningful investment.

A nation-state operation like the North Korean IT worker scheme that placed fraudulent workers inside more than 300 U.S. companies required coordinated networks of facilitators, stolen identities, shell companies, and physical infrastructure in the form of laptop farms that hosted hundreds of company-issued devices. 

The DOJ documented the level of operational complexity involved:

• Travel to China to coordinate with overseas handlers
• Shell companies with real financial accounts
• KVM switches to enable remote access across time zones

The scheme ran for years before it was disrupted. That level of complexity served as a natural barrier to entry. Creating a fully synthetic persona capable of passing technical interviews and background checks at scale required resources that most people simply did not have.

What GenAI changed

Generative AI dissolved that barrier.

The tools required to produce a convincing fake resume, an AI-generated profile photo, a tailored cover letter, and a real-time interview persona capable of answering technical questions are now accessible, inexpensive, and require minimal technical skill. Deepfake video technology that would have required specialized production capability a few years ago is now available through consumer tools. 

AI systems that can feed responses to interview questions in real time, delivered through an earpiece, are documented and in use. According to Pindrop's 2025 Voice Intelligence and Security Report, deepfake fraud attempts surged 1,300% from 2023 to 2024.

Creating a synthetic candidate now requires nothing more than a subscription and a few hours. When individual attacks become cheap enough to execute, the rational move for a bad actor is to run many of them simultaneously against many targets.

From individual actors to coordinated operations

The FTC reported that losses from job search fraud jumped from $90 million in 2020 to over $501 million in 2024, a 457% increase in four years. Gartner has projected that by 2028, one in four job candidates globally could be fake.

These figures reflect organized operations targeting hiring pipelines at volume, running the same fraud playbook across hundreds of employers simultaneously and improving their methods based on what gets through.

Why the old fraud signals no longer apply

A single bad actor embellishing a resume has behavioral signals: hesitation, inconsistency, a patchwork of details that do not quite cohere.

A synthetically generated candidate produced by an AI system optimized for ATS screening, tailored to the specific job description, with a generated photo and a fabricated work history drawn from real data breach sources, is specifically constructed to avoid those signals. The tools built to catch the first type of fraud are often the wrong tools for the second.

Why point solutions struggle against volume

When fraud operates as a business, it has the properties of a business: optimization, iteration, and scale.

Fraud operations running hundreds of applications against the same employers are learning which approaches clear screening, which personas pass background checks, and which interview tactics avoid detection. They are improving their methods in a way that individual fraudsters never could.

Point solutions that address one stage of the hiring funnel, one type of fraud signal, or one moment in the candidate journey were designed for a world where fraud was episodic and manual. Against industrialized operations, the correct response is a layered defense that makes the cost of mounting a successful attack prohibitively high at every stage.

If your current stack was built to catch the last generation of fraud, it is worth asking whether it is equipped for this one. See how Proof builds a layered defense from first application to Day One.