Aipedia: Recruitment agencies

Deepfake candidates and AI interview fraud

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

An agency must still confirm a candidate's identity when the person on a video call could be an AI-generated fake. Remote hiring makes identity fraud easier, and a fraudulent placement can expose the hirer's systems and money.

Part of: AI in recruitment agencies

In short

Fraudsters can now use AI to build convincing CVs and online profiles, and some may use real-time face or voice alteration in remote interviews. A different person may sit the interview and start the job, or a fake identity may be used to gain access to a client's systems. Conduct Regulations reg 19 requires the agency to confirm the work-seeker's identity and keep evidence. If a fraudulent placement causes the hirer a loss, the hirer may claim the agency was negligent. PI may respond to that claim, while the agency's own fraud losses usually need crime cover.

How AI is used to deceive agencies

Generative tools make it cheap to create a polished CV, a matching online profile, cover letters and even references. In remote processes, a candidate can use a real-time filter to alter their face or voice, or someone else can attend the interview for them. The aim varies: to win a well-paid remote role, to place an unqualified person, or to get inside a client's network. Agencies are attractive targets because clients rely on them to have screened the candidate.

The agency's verification duty

Under reg 19 of the Conduct Regulations 2003, the agency must confirm the work-seeker's identity, experience, training, qualifications and authorisations, including right to work, and keep evidence. Reg 21 requires that information to go to the hirer in writing within 3 business days. Reg 20 requires all reasonably practicable steps so the placement is not detrimental to the hirer. The Fair Work Agency has enforced these rules since 7 April 2026. None of this changes because an interview was held by video.

Identity checks have a data protection side too. Biometric data such as face matching is special category data, which stays restricted under UK GDPR, so any tool used to detect fakes needs a lawful basis and a DPIA, as the DSIT guide recommends for recruitment AI.

What can go wrong

Illustrative: an agency places a remote software developer after two video interviews and a document check by upload. The person who starts work is not the person interviewed, and the identity documents belong to someone else. Within weeks the worker has copied client data and disappeared. The client claims its investigation and remediation costs from the agency, arguing that the reg 21 confirmation said identity had been checked. The agency has also paid the worker's first invoices.

How PI and crime cover respond

The hirer's claim that the agency negligently failed to verify identity may fall within a recruiter's PI, subject to the wording. Some policies may exclude claims arising from dishonesty of third parties or from cyber events, so check carefully.
The agency's own losses, such as wages or fees paid to a fraudster, are first-party losses that PI does not usually cover. Commercial crime insurance may respond, depending on how the policy defines fraud and whether it extends to third-party deception. See social engineering and fund transfer fraud.
Data taken from the client may lead to cyber or data claims; see cyber insurance and AI risks.

Documenting checks and telling clients

When a fraud comes to light, the first question from the client, and later from any insurer, will be what the agency actually did. A written record of each identity step, who did it, what was seen and how the person who started work was matched to the person interviewed is the best defence. Where a client asks for a fully remote process, explain the limits of remote verification in writing and agree any extra checks. Clear reg 21 confirmations that describe the checks, rather than simply saying the candidate is verified, reduce the risk of a misrepresentation argument.

Practical controls

See original identity documents or use a method that checks the document chip or an official service, not uploads alone.
Hold at least one live interview with camera on and ask unscripted questions.
Check that the person who starts is the person interviewed, on day one.
Verify referees by phone using independently sourced numbers.
Pay workers only to accounts that match verified identity.
Tell clients what checks you did and did not do.

How Apex helps

Apex arranges PI for recruitment agencies, and a broker can review how PI, crime and cyber policies fit together for fraudulent placements. See the AI in recruitment agencies hub, AI in right to work checks and AI checks and reg 19.

Sources

Frequently asked

Does reg 19 apply to remote and video interviews?

Yes. Reg 19 requires the agency to confirm the work-seeker's identity and keep evidence however the candidate was interviewed. A video call alone is weak evidence of identity when faces and voices can be altered in real time.

Will PI cover a placement of a fake candidate?

A hirer's claim that the agency negligently failed to verify identity may be covered, subject to the wording. Watch for exclusions about third-party dishonesty or cyber events, and for conditions requiring specific verification steps.

Does PI cover money the agency paid to a fraudster?

Usually not, because PI covers liability to others rather than the agency's own losses. Commercial crime insurance may respond, depending on how it defines fraud and whether it covers deception by people outside the business.

Can we use AI to detect deepfakes?

You can, but detection tools that analyse faces process biometric data, which is special category data under UK GDPR. Complete a DPIA, tell candidates and keep a human decision in the loop.

What should we do if we suspect a deepfake candidate?

Pause the process, ask for an in-person or live verified identity check, and do not submit the candidate until identity is confirmed. If a placement has already started, tell the client promptly and notify your insurers under the policy conditions.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.