{ "slug": "bait-switch-hire-deepfake-video-interviews-infiltrating", "topic_id": "TOPIC-083", "cluster": "Remote Workforce & Insider Threat", "tier": "Tier B", "title": "The interview proves someone can interview", "summary": "A video interview establishes that a person appeared and answered questions. Real-time face replacement means it does not establish which person, and nothing connects the interview to the first day of work.", "lede": "Hiring assumes continuity: the candidate who interviewed is the person who accepts, who onboards, who logs in. Every link in that chain is an assumption, and none of them is verified.", "date": "2024-11-23", "category": "Future of Work", "author_id": "constance-ibe-whitmore", "tags": [ "hiring", "deepfake", "video interview", "talent acquisition", "identity", "onboarding" ], "image_title": "The Interview Proves Interviewing", "schema": "Article", "key_takeaways": [ "Real-time face replacement is commodity software, and it operates below what a video platform can observe.", "The chain from interview to first login has no identity continuity — each stage verifies independently or not at all.", "Binding a credential at the interview and requiring it at each subsequent stage makes the chain verifiable without new surveillance." ], "body": [ { "type": "h2", "text": "The unverified chain" }, { "type": "diagram", "kind": "chain", "alt": "The chain nobody checks", "caption": "Four stages, no binding between any of them.", "nodes": [ { "label": "Application", "sub": "self-asserted", "note": "anyone", "bad": true }, { "label": "Interview", "sub": "a face on a screen", "note": "replaceable", "bad": true }, { "label": "Onboarding", "sub": "documents by email", "note": "unlinked", "bad": true }, { "label": "Day one", "sub": "credentials issued", "note": "to whom?", "bad": true } ] }, { "type": "table", "head": [ "Stage", "What is verified", "Link to previous stage" ], "rows": [ [ "Application", "Nothing", "—" ], [ "Screening call", "Nothing", "None" ], [ "Technical interview", "Nothing", "None" ], [ "Panel interview", "Nothing", "None" ], [ "Offer and acceptance", "An email address", "None" ], [ "Background check", "Documents, against a submitted identity", "None to the interviews" ], [ "Onboarding", "Documents, in person or remotely", "None to the interviews" ], [ "First login", "Credentials issued at onboarding", "None to the interviews" ] ] }, { "type": "p", "html": "Read the third column. Every stage stands alone. A different person can appear at any of them, and no control notices because no control is looking for continuity." }, { "type": "h2", "text": "Why the video stage is attackable" }, { "type": "p", "html": "Real-time face replacement runs as a virtual camera. The conferencing platform receives frames through the operating system's media stack, which is how it receives frames from a physical camera." }, { "type": "ul", "items": [ "The software is freely available and does not require unusual hardware", "It handles head movement, speech and lighting acceptably at typical video quality", "Compression and bandwidth variation on a normal call hide artefacts", "Interviewers are evaluating technical answers, not examining the video" ] }, { "type": "p", "html": "The last point matters. An interviewer's attention is on whether the candidate can explain a concurrency problem, not on whether their jawline is consistent." }, { "type": "h2", "text": "The two variants" }, { "type": "p", "html": "They have different motivations and the same structural cause." }, { "type": "table", "head": [ "Variant", "Motivation" ], "rows": [ [ "A skilled proxy interviews; a less skilled person does the job", "Placement fees, or access to a salary" ], [ "The interviewee is real; the work is subcontracted elsewhere", "Arbitrage on wage differences" ], [ "The identity is fabricated entirely", "Sanctions evasion, espionage, or fraud" ] ] }, { "type": "p", "html": "The first two are employment fraud. The third is the one with regulatory and national security consequences, and it uses the same technique." }, { "type": "h2", "text": "Making the chain continuous" }, { "type": "p", "html": "The intervention is not better deepfake detection. It is binding an identity early and requiring it at each subsequent stage." }, { "type": "code", "text": "# At the first substantive interview\n candidate enrols a credential on their own device\n → no identity claim yet, just a credential bound to a device\n\n# At each subsequent stage\n the same credential signs a statement:\n \"I am attending the technical interview for req 4471\"\n \"I accept the offer for the role of ...\"\n \"I am completing onboarding verification\"\n \"I am activating my corporate account\"\n\n# At onboarding\n document verification binds the identity to that credential\n\n# Result: one credential connects interview → offer → onboarding\n# → first login → ongoing employment" }, { "type": "p", "html": "The ordering matters. The credential is enrolled before identity is established, then identity is bound to it at onboarding. That means the person who interviewed is provably the person whose documents were checked." }, { "type": "h2", "text": "What this catches and what it does not" }, { "type": "ul", "items": [ "Catches: a different person appearing at a later stage than the one who interviewed", "Catches: the subcontracting variant, where a later stage is handled by someone else", "Catches: handover after hire, when combined with periodic re-verification", "Does not catch: one person who consistently uses face replacement at every stage and also completes document verification", "Does not catch: a genuine person using a fabricated but well-constructed identity" ] }, { "type": "p", "html": "The fourth bullet is the honest limit. The control establishes continuity, not truth of identity. Identity proofing at onboarding remains the foundation, and this makes that foundation extend forward in time." }, { "type": "h2", "text": "Candidate experience" }, { "type": "p", "html": "A legitimate concern: hiring is competitive and friction costs candidates." }, { "type": "p", "html": "The enrolment is a single interaction on the candidate's own phone, comparable to setting up a passkey for any consumer service. Each subsequent confirmation is a biometric gesture that takes seconds." }, { "type": "p", "html": "Compared with the alternatives being deployed — proctored assessments, identity verification vendors at multiple stages, recorded interview review — it is substantially lighter. It is worth positioning it that way internally, because talent teams will reasonably resist anything that looks like suspicion of candidates." }, { "type": "h2", "text": "A worked example: the two variants" }, { "type": "table", "caption": "Same gap, two exploitations", "head": [ "Variant", "What happens", "What breaks it" ], "rows": [ [ "Full impersonation", "One person interviews, another works", "A credential enrolled at interview, required on day one" ], [ "Proxy interview", "A strong candidate interviews for a weak one", "The same binding — the signer must reappear" ], [ "Both", "Rely on the stages being unlinked", "Any binding at all" ] ] }, { "type": "p", "html": "Notice that the fix is the same for both, and that it does not require detecting anything. The candidate enrols a credential during the interview and signs with it on day one; if a different person shows up, they cannot produce the signature." }, { "type": "h2", "text": "Objections and honest limits" }, { "type": "p", "html": "“So we need liveness detection.” Liveness detection is an arms race against synthesis, which is improving faster than detection. Binding is not a race — the attacker has to hold the same hardware credential at two separate times." }, { "type": "p", "html": "“This is hostile to candidates.” It replaces an identity-document upload with a device prompt that takes seconds and collects no biometric data. For most candidates it is less intrusive than what they do today." } ], "faq": [ { "q": "Why can't the video platform detect face replacement?", "a": "It runs as a virtual camera below the platform's visibility, and the platform receives frames the same way it receives them from a physical camera." }, { "q": "Where is the chain broken?", "a": "Everywhere. Interview, offer, background check, onboarding and first login each verify independently or not at all, with no link between stages." }, { "q": "Why enrol the credential before identity is established?", "a": "So that when documents are verified at onboarding, the identity binds to the credential that attended the interviews — proving the same person throughout." }, { "q": "What does this not catch?", "a": "One person who uses face replacement consistently at every stage and also completes document verification, or a real person with a well-constructed fabricated identity." }, { "q": "Does liveness detection solve this?", "a": "It is an arms race against synthesis. Binding is not a race, because the attacker must hold the same credential at two separate times." }, { "q": "What about candidates without a suitable device?", "a": "Provide a security key at the employer's cost, or the process screens for hardware rather than skill." }, { "q": "Does this catch a fully committed operative?", "a": "One person who interviews and then works is not caught by this. It closes the switch, not the infiltration." } ], "sources": [ { "t": "NIST FRVT / FATE presentation attack detection evaluations", "u": "https://pages.nist.gov/frvt/html/frvt_pad.html" }, { "t": "FCC — protecting consumers from SIM swap and port-out fraud", "u": "https://www.fcc.gov/sim-swap-port-out-fraud" }, { "t": "NIST SP 800-63A — Enrollment and identity proofing", "u": "https://pages.nist.gov/800-63-4/sp800-63a.html" }, { "t": "W3C Web Authentication: An API for accessing Public Key Credentials Level 3", "u": "https://www.w3.org/TR/webauthn-3/" } ], "related": [ { "slug": "dprk-it-worker-laptop-farm-prevention-guide", "title": "Hiring one person and employing another", "category": "Future of Work" }, { "slug": "client-side-face-liveness-fails-fatal-flaws", "title": "Why browser-based face liveness cannot be trusted", "category": "Developer" }, { "slug": "zero-biometric-workforce-assurance-model-verifying-identity", "title": "Workforce assurance without biometric collection", "category": "Future of Work" }, { "slug": "synthetic-resume-storm-ai-generated-portfolios-overwhelm", "title": "When every credential a candidate presents can be manufactured", "category": "Future of Work" } ], "image": "https://cdn.twc.sh/images/igcache/The%20Interview%20Proves%20Interviewing/1200_630/blog.jpg", "wordcount": 995, "url": "/blog/bait-switch-hire-deepfake-video-interviews-infiltrating.html", "reading_time": "4 min read", "meta_description": "A video interview proves a person appeared and answered. Face replacement means it does not prove which person, and the chain breaks after.", "hub": { "slug": "topics/remote-workforce-identity", "title": "Remote workforce identity" }, "answer": "That someone appeared and answered questions well. Not which person, because real-time face replacement runs through the same media stack a real camera uses, and not who turns up on day one, because nothing cryptographically connects the interview to the first login.", "answer_q": "What does a video interview actually establish?", "glossary": [ { "term": "Bait-and-switch hire", "def": "One person passes the interview; a different person performs the work." }, { "term": "Injection attack", "def": "Feeding synthetic video into the capture path so the platform treats it as a live camera." }, { "term": "Continuity binding", "def": "Requiring the same credential across stages so they refer to one person." } ], "checklist": { "title": "Binding interview to hire", "id": "binding", "desc": "Five steps.", "steps": [ { "name": "Enrol a credential at the first live interview.", "text": "Platform authenticator or security key." }, { "name": "Require the same credential at each later stage.", "text": "Continuity, not repetition of checks." }, { "name": "Require it again at first login.", "text": "The point where the switch happens." }, { "name": "Bind the offer and contract to the same key.", "text": "So signature and starter are the same person." }, { "name": "Fund a security key for candidates without a device.", "text": "Otherwise the process screens for hardware." } ] }, "cta": { "title": "Where this fits in Manav", "html": "Manav enrols a candidate credential at interview and requires the same key at offer and first login, so the person who was hired is the person who starts.", "href": "../docs.html", "label": "See continuity binding" } }