Signs of a Fake Candidate Identity
A quick field guide for recruiters and HR: the signals worth a second look when screening remote candidates, and how to treat each one as a flag to verify rather than proof.
Most candidates with a VoIP number, a new email domain, or a thin LinkedIn are perfectly real people. But when several of these signals stack up on the same remote applicant, it's worth slowing down and verifying. This guide lists the common signals, explains why each one shows up, and gives you a calm next step for each. None of them is a reason to reject anyone on its own.
Why this matters now
Remote hiring opened the door to candidates anywhere in the world, which is mostly a good thing. It also created room for identity fraud, where someone applies under a fabricated or borrowed identity. The most widely reported example is the North Korea-affiliated IT worker scheme, where operatives apply to Western companies using fake or stolen identities to earn wages that are routed back to the regime. This is publicly documented in US Department of Justice and FBI advisories, so it isn't insider knowledge. The same general playbook (hide your real location, use a borrowed face, keep paper-thin profiles) shows up in ordinary employment fraud too.
The signals below are useful because they are cheap and fast to check before you invest interview time. Treat every one as worth verifying, not as a verdict.
Signals worth a closer look
1. VoIP or freshly ported phone numbers
A non-fixed VoIP number (Google Voice, TextNow, and similar) can be created in minutes from anywhere, so the area code tells you nothing about where the person actually is. A number that was ported very recently can be a similar tell. Plenty of honest freelancers and travelers use VoIP, so this matters most when the candidate claims to live somewhere that mobile carrier numbers are the norm. See our deeper write-up on VoIP numbers in hiring.
2. Disposable or brand-new email domains
A throwaway address from a known disposable provider, or a personal domain registered days before the application, is worth noting. New domains can be checked against registration date, and disposable domains against public block lists. A genuine professional email on a long-lived domain is the calmer signal.
3. Residential-proxy or mismatched IPs
If a candidate connects to a screening call or assessment through a residential proxy or commercial VPN, the IP can be made to look like it sits in a different country than where they really are. An IP geolocation that contradicts the stated home location is a flag to ask about, not proof of anything by itself.
4. Location and timezone that don't line up
Watch for availability that only fits a timezone far from the claimed location, an IP country that differs from the resume, or interview answers about local weather and context that feel rehearsed. Any single mismatch can have an innocent explanation. A pattern of them is worth a direct, friendly question.
5. Reused or stock-photo profile images
A profile photo that turns up elsewhere on the web, looks like stock imagery, or has the smooth, slightly off quality of an AI-generated face is worth checking with a reverse image search. Faces are easy to borrow, so this is a starting point for a conversation, not a conclusion.
6. Thin or very new social profiles
A LinkedIn created last month, a GitHub with a burst of low-substance commits, or professional profiles with no mutual connections and no history can all be benign for early-career or privacy-minded people. They carry more weight when they appear alongside the signals above.
The right next step is a question, not a rejection
When something gives you pause, the move is almost never to silently reject. It's to ask something an honest candidate can answer easily:
- Suggest a short video call with cameras on. Genuine candidates almost always agree.
- Have an unscripted technical chat about something specific on their resume.
- Ask casually about their week, the local weather, or nearby context.
- For sensitive roles, run right-to-work and identity verification through your normal HR channels.
A flag just adjusts how attentive you are during these steps. It does not replace them.
What this approach won't catch
- Operators using a real mobile number and a real identity obtained from someone else.
- Applications routed through a cooperating local person whose details check out.
- Roles where you collect little contact information to verify.
No single check is sufficient. These signals are valuable because they are quick, low-cost, and catch the lowest-effort attempts that would otherwise eat your interview time.
Run a quick check
Look up a candidate's phone line type, email domain risk, or an IP location in under a second. No login, nothing stored.
Start with Phone Lookup →This guide is educational and reflects publicly available information about phone and email services, IP routing, and published government advisories. It is not legal advice or hiring advice, and none of these signals should be used as the sole basis for any hiring decision or to reject any applicant. Any of them can have an innocent explanation. Hiring decisions should follow your organization's policies, your verification procedures, and applicable anti-discrimination and privacy law.