The interview proves someone can interview

Hiring assumes continuity: the candidate who interviewed is the person who accepts, who onboards, who logs in. Every link in that chain is an assumption, and none of them is verified.

Part of Remote workforce identity

The unverified chain

Read the third column. Every stage stands alone. A different person can appear at any of them, and no control notices because no control is looking for continuity.

Why the video stage is attackable

Real-time face replacement runs as a virtual camera. The conferencing platform receives frames through the operating system's media stack, which is how it receives frames from a physical camera.

• The software is freely available and does not require unusual hardware
• It handles head movement, speech and lighting acceptably at typical video quality
• Compression and bandwidth variation on a normal call hide artefacts
• Interviewers are evaluating technical answers, not examining the video

The last point matters. An interviewer's attention is on whether the candidate can explain a concurrency problem, not on whether their jawline is consistent.

The two variants

They have different motivations and the same structural cause.

The first two are employment fraud. The third is the one with regulatory and national security consequences, and it uses the same technique.

Making the chain continuous

The intervention is not better deepfake detection. It is binding an identity early and requiring it at each subsequent stage.

# At the first substantive interview
  candidate enrols a credential on their own device
  → no identity claim yet, just a credential bound to a device

# At each subsequent stage
  the same credential signs a statement:
    "I am attending the technical interview for req 4471"
    "I accept the offer for the role of ..."
    "I am completing onboarding verification"
    "I am activating my corporate account"

# At onboarding
  document verification binds the identity to that credential

# Result: one credential connects interview → offer → onboarding
#         → first login → ongoing employment

The ordering matters. The credential is enrolled before identity is established, then identity is bound to it at onboarding. That means the person who interviewed is provably the person whose documents were checked.

What this catches and what it does not

• Catches: a different person appearing at a later stage than the one who interviewed
• Catches: the subcontracting variant, where a later stage is handled by someone else
• Catches: handover after hire, when combined with periodic re-verification
• Does not catch: one person who consistently uses face replacement at every stage and also completes document verification
• Does not catch: a genuine person using a fabricated but well-constructed identity

The fourth bullet is the honest limit. The control establishes continuity, not truth of identity. Identity proofing at onboarding remains the foundation, and this makes that foundation extend forward in time.

Candidate experience

A legitimate concern: hiring is competitive and friction costs candidates.

The enrolment is a single interaction on the candidate's own phone, comparable to setting up a passkey for any consumer service. Each subsequent confirmation is a biometric gesture that takes seconds.

Compared with the alternatives being deployed — proctored assessments, identity verification vendors at multiple stages, recorded interview review — it is substantially lighter. It is worth positioning it that way internally, because talent teams will reasonably resist anything that looks like suspicion of candidates.

A worked example: the two variants

Notice that the fix is the same for both, and that it does not require detecting anything. The candidate enrols a credential during the interview and signs with it on day one; if a different person shows up, they cannot produce the signature.

Objections and honest limits

“So we need liveness detection.” Liveness detection is an arms race against synthesis, which is improving faster than detection. Binding is not a race — the attacker has to hold the same hardware credential at two separate times.

“This is hostile to candidates.” It replaces an identity-document upload with a device prompt that takes seconds and collects no biometric data. For most candidates it is less intrusive than what they do today.

Binding interview to hire

1. Enrol a credential at the first live interview. Platform authenticator or security key.
2. Require the same credential at each later stage. Continuity, not repetition of checks.
3. Require it again at first login. The point where the switch happens.
4. Bind the offer and contract to the same key. So signature and starter are the same person.
5. Fund a security key for candidates without a device. Otherwise the process screens for hardware.

Terms used here

Bait-and-switch hire

One person passes the interview; a different person performs the work.

Injection attack

Feeding synthetic video into the capture path so the platform treats it as a live camera.

Continuity binding

Requiring the same credential across stages so they refer to one person.

Frequently asked questions

Why can't the video platform detect face replacement? It runs as a virtual camera below the platform's visibility, and the platform receives frames the same way it receives them from a physical camera.

Where is the chain broken? Everywhere. Interview, offer, background check, onboarding and first login each verify independently or not at all, with no link between stages.

Why enrol the credential before identity is established? So that when documents are verified at onboarding, the identity binds to the credential that attended the interviews — proving the same person throughout.

What does this not catch? One person who uses face replacement consistently at every stage and also completes document verification, or a real person with a well-constructed fabricated identity.

Does liveness detection solve this? It is an arms race against synthesis. Binding is not a race, because the attacker must hold the same credential at two separate times.

What about candidates without a suitable device? Provide a security key at the employer's cost, or the process screens for hardware rather than skill.

Does this catch a fully committed operative? One person who interviews and then works is not caught by this. It closes the switch, not the infiltration.

Sources and further reading

• NIST FRVT / FATE presentation attack detection evaluations
• FCC — protecting consumers from SIM swap and port-out fraud
• NIST SP 800-63A — Enrollment and identity proofing
• W3C Web Authentication: An API for accessing Public Key Credentials Level 3