So you hired a deepfake. Now what?

Sponsored by

AI agents are starting to do more than access systems. They can invoke tools, execute workflows, and take action across business applications. As that autonomy grows, IT needs visibility into what each agent is allowed to do, what it actually did, who owns it, and how to revoke access when needed. Learn how JumpCloud helps govern AI agents alongside human and device identities.

A missing mustache was the tipoff that something was amiss.

A job candidate had sailed through the hiring process at people search engine and data broker Spokeo. They seemed so well-suited to the role that COO Harrison Tang recalls telling his team, “I hope this is not too good to be true.”

Spoiler alert: It was. Even worse, the candidate ended up being what Tang calls a “real fake,” or someone misrepresenting their identity. Hours after the new hire started the job, Spokeo fired them—in part, because it became clear that the person who interviewed for the role wasn’t the one who logged in to work.

“The person who onboarded, who got hired, during the orientation did not have a mustache,” Tang told Morning Brew. “But the person I interviewed looked like Mario.”

Don’t trust, verify

Though Tang was shocked by the incident at the time, fraudulent hires and deepfake applicants who use AI to generate a video or image that makes them seem legit has become an increasingly common phenomenon.

“We’re seeing this world that’s rapidly being created where you cannot trust what you hear or see,” Bobby Ford, a longtime CISO who serves as chief strategy officer at social engineering defense company Doppel, told us.

Among 500 US HR reps that identity verification company Hypr surveyed for its 2026 State of HR Identity Fraud Detection report, 98% said they’d experienced candidate fraud firsthand. Approximately 42% of hiring fraud was discovered after employment started. And in nearly a quarter of instances, it took companies between one and three months to resolve the situation.

The sources we spoke with agreed that responding to this threat requires collaboration between HR and IT—and verifying identities not just during the hiring process, but throughout an employee’s tenure.

“The idea is continual checks,” Tang said.

Spokeo now requires identity verification after the recruiting screening is complete. And Tang sees continuous verification processes as a must.

Identity verification should consist of at least two forms, he said: a knowledge-based component like asking for a password or current address; inherent proof like face ID or biometrics; evidence, like entering a one-time passcode, that the person has possession of a specific device; or proof of location.

GetReal, a deepfake detection enterprise software provider, recommends similar measures, like biometric checks, training recruiters and hiring managers to recognize possible signs of imposter candidates, requiring third-party recruiters to implement identity verification, expanding background checks to validate direct employment history, and coordinating with IT and security teams “to monitor onboarding anomalies post-hire.”

Access denied

GetReal cited CrowdStrike data indicating there’s been a 220% increase in companies that hired IT workers from North Korea over 12 months. And earlier this year, the FBI, State Department, and multiple foreign government agencies released a joint alert warning that the North Korean government was directing IT workers to use false identities to obtain remote jobs to help fund the country’s nuclear weapons program.

KnowBe4, a security awareness training company, found itself the victim of one of these infiltrations when it unknowingly hired a deepfake candidate as a software engineer.

If a deepfake persona does get hired, Tang advises treating the incident as a security threat.

“You have to cut off the access right away, and then you obviously part ways with the deepfake or ‘real fake’ person,” he said. “And then you have to do an audit of…the impact radius of the security incident.”

“If you have good security systems, there should be logs around what this person has access to, as well as their access patterns,” he added. From there, he recommends writing up an incident report on the impact radius, mediation steps, and solutions that make it less likely to happen in the future.

As for who should be involved in responding to a security breach like this, at least for now, Tang believes it should be taken to the very top.

“I do think the C-suite should know that this is a real thing,” he said. “This is not just a news headline. This is actually impacting companies today as we speak.”

The problem has become so pervasive that companies need to treat it as a “when, not if” scenario, Keivan Bahmani, director of machine learning and AI for Mitek Systems, which helps businesses verify identities, told us. Mitek, too, had an incident this year where a deepfake candidate for an AI engineer role made it past the first round of interviews.

“Over this last decade, it went from targeted, special attacks with high financial damage,” Bahmani said, “into a broad, across-the-board application for much smaller financial gain.”

He also recommended establishing continuous verification systems and emphasized the importance of having a playbook ready to go so employees know how to respond in such an instance, and so that everyone—not just IT and HR—understands the reporting responsibilities.

“There needs to be clear policy and guidance through the organization that takes that pressure off individuals, gives them an off-ramp, and says, ‘These are the steps that you need to take in terms of reporting, in terms of your behavior, when you interact with something like this,’” he said.

Closing gaps

Hypr’s report points to a gap in accountability: While responsibility for identity verification sits with HR during the hiring and onboarding process, it then shifts to security and IT.

And while 65% of organizations use identity verification (IDV) tools, according to Hypr’s research, these tools reach just 28% of employees on average. “Rather than providing continuous identity assurance, most enterprise IDV is reserved for specific, high-risk friction points,” per the report, leaving “a blindspot for a fraudulent hire operating undetected outside these narrow windows.”

“The enterprise can no longer rely on three separate handoffs managed by three isolated teams using three separate toolsets,” the report concludes. “The resolution does not lie in purchasing better detection solutions for every single stage, but in establishing a unified, accountable system spanning pre-hire, onboarding, and post-employment identity assurance.”