Scope note. This article refers to the ICO’s Recruitment Rewired report, the Data (Use and Access) Act 2025 (Articles 22A–22D) and the EU AI Act. These references are regulatory context for the direction of travel in the UK and EU. Nothing here is legal advice. For your organisation’s specific obligations around hiring, verification, data protection or AI governance, speak to a qualified specialist.
Three weeks after the start date, the senior analyst a UK professional-services firm had just hired could not open the shared drive without IT walking him through it twice. His face in the final video interview had been calm, well-lit and professional. His face in the first Teams stand-up was not quite the same face. The team doubted themselves at first, which is part of how this works.
That specific pattern is one I now hear UK HR directors describe out loud. A real meeting room, a real new hire, a real moment of recognition that something is wrong. Usually quiet, polite and expensive.
The term for what happened is a deepfake candidate. The UK Government, the ICO and major fraud researchers are treating it as a serious hiring threat in 2026. Most of the written guidance is from companies selling detection software. This piece is from a practitioner.
A deepfake candidate is a job applicant whose face, voice or identity is partially or wholly generated or manipulated by AI, usually to pass through remote hiring without the real person ever appearing on screen. That might be a swapped face in a live video call, a cloned voice over the phone, a synthetic CV and work history, or a combination. Sometimes a different person is coached off-camera, with AI only polishing the overlay.
This has moved from fringe cybersecurity concern into a hiring story because remote and hybrid interviewing is default for UK roles, and because the tools to produce a convincing synthetic candidate are now cheap and public. The UK Government estimates that 8 million deepfakes were shared online in 2025, up from around 500,000 in 2023, according to figures released alongside the Home Office’s deepfake detection framework announcement on 5 February 2026. Hiring is one of several surfaces that volume now washes against.
Volume is rising fast but UK-specific data is thin, which is itself part of the risk picture. Here is what will stand up in a boardroom.
Gartner, in an April 2025 report on candidate fraud, projects one in four candidate profiles worldwide will be fake by 2028, drawing on a survey of 3,000 job candidates in which 6% admitted to interview fraud.
Experian’s 2026 Future of Fraud Forecast, published in January 2026, named “deepfakes outsmart HR” as the second of five top fraud threats of the year, warning that generative AI now produces hyper-tailored résumés and candidates capable of passing interviews live on the call.
Checkr’s September 2025 survey of 3,000 American hiring managers found only 19% were extremely confident their process would catch a fraudulent applicant, 59% had suspected a candidate of using AI to misrepresent themselves, and 31% had interviewed someone later revealed to be using a false identity. The data is US-sourced, but the hiring tools, the AI models and the attacker playbook are not confined to one country.
In the UK, Crest Advisory’s nationally representative survey of 1,700 adults in England and Wales, commissioned by the Office of the Police Chief Scientific Adviser, found 67% had seen or think they had seen a deepfake. That is awareness, not workplace exposure, but the read-across is clear: deepfakes are now a background condition of the market your candidates swim in.
UK SMEs are more exposed because the defences enterprise employers rely on, such as identity verification vendors, in-house security teams and multi-stage interviews with multiple interviewers, are mostly absent in a 51 to 200 person company. A small hiring team is usually one hiring manager, one HR partner, maybe a technical interviewer, all on the same video call. There is no second-pass identity check. The background screening provider, if there is one, verifies documents but cannot see the face in the Zoom window.
Checkr’s manager data captures the pressure point: nearly one in four managers estimated their companies had lost more than $50,000 in the past year to fraudulent hires, and one in ten lost more than $100,000. Those losses do not require sophisticated attackers. They require a time-pressured hiring team, a remote-first process, and no step designed to catch impersonation.
The post on AI-generated CVs covers the upstream half: fabricated work histories reaching the shortlist. The deepfake candidate is the same attack, pushed one stage further into the interview.
They do one of three things, usually in combination: a face-swap overlay in a live video call, a different person answering off-camera while AI holds the face steady, or a cloned voice while the camera stays off.
In a face-swap, the overlay runs over a real person’s video feed. The giveaway is edge behaviour: a hand passing across the face, a sharp turn to the side, or a sudden exaggerated expression produces a visible glitch. Mid-interview lighting changes also stress the overlay. Reflections in glasses rarely match the room.
In a proxy interview, the person on camera is a hired front, and the real applicant answers off-camera through an earpiece. Watch the eye-line and the latency. The candidate’s gaze flicks slightly off-centre before answering, and complex questions produce a pause longer than thinking.
In a voice clone, the audio is close to perfect but flattens under emotional pressure. A light joke, an interrupted question, or a request to describe a difficult moment produces audio that does not match the register the clone was trained on.
Veriff’s Deepfakes Report 2026, Kantar fieldwork across 3,000 adults in the US, UK and Brazil, found most people cannot reliably spot a deepfake even in a controlled test. Trusting your gut is not a method.
Design the interview itself to produce signals current deepfake tools cannot keep up with, and build identity verification into steps you already run. This is the layer vendor advice skips, because it does not require a product.
Four moves work in a small-team setting.
First, ask the candidate to turn their head slowly, ninety degrees to each side, during a technical question. Overlays struggle with profile angles and warp or glitch. Frame it as checking their audio holds up at different angles.
Second, ask them to pass a hand or an object across their face mid-sentence. Overlays blur or stutter at the point of occlusion.
Third, change the lighting during the call. Ask the candidate to open a blind, turn on an overhead lamp, or switch on their phone torch. Overlays trained in soft studio light tend to come apart under a cooler or warmer hue.
Fourth, require a short piece of unscripted reasoning on camera: a whiteboard sketch, a walkthrough of how they solved a specific problem, a reaction to a one-sentence case study they have not seen. Deepfake candidates and off-camera coaches struggle with latency on unscripted content.
None of these is accusatory. All read as sensible interview design. All are free.
A workable SME protocol has four layers, all of which an existing hiring process already touches, and none of which need specialist software: document verification, live-interview behaviour design, pre-start identity reconfirmation forty-eight hours before day one, and a 30-60-90 day behaviour check once the hire has started.
At document verification, the UK Right to Work check already requires sight of either an identity document or the government’s online Right to Work service. Treat this as a biometric moment, not an admin one, and run it on video with the candidate’s live face next to their document on camera. For remote hires, use a short second video call for this alone, recorded with consent.
At live-interview design, apply the four moves above as default practice for every final-round interview, not just the ones that feel suspicious. Suspicion-based checks are themselves a bias risk.
At pre-start reconfirmation, a brief logistics call forty-eight hours before day one is a free identity re-anchor. The person on this call should match the final interviewee, voice and face.
At the 30-60-90 day behaviour check, run a documented review comparing interview performance to actual output. A sharp capability gap between what was demonstrated and what the hire can deliver is the strongest post-hire signal of fraud.
The ICO’s Recruitment Rewired report, published on 31 March 2026, signals a clear direction of travel: meaningful human involvement in automated recruitment decisions is not optional, and many employers currently rely on solely automated decisions without realising it. The report draws on voluntary engagement with over thirty employers between March 2025 and January 2026.
The practical implication for an SME introducing any AI tool into interview or screening is twofold. The tool must have a human genuinely in the loop, not a rubber-stamp reviewer. And candidates must be told clearly that automated decision-making is being used, and how.
The Data (Use and Access) Act 2025, in force from 5 February 2026, reshaped the UK framework through Articles 22A to 22D, moving solely automated decisions from a general prohibition to a right of challenge with safeguards. The ICO’s final guidance is expected in winter 2026. The direction of travel is visible: more flexibility on automated tools, with stronger expectations on transparency, bias monitoring and human review.
The read-across for the deepfake problem is useful. A hiring process built around meaningful human involvement at every decision point also happens to be the process that catches synthetic candidates earliest. A qualified specialist can advise on how your set-up should be structured. The post on a fair AI interview process covers the interview design side in more depth.
Three decisions, all free, all in the hiring manager’s control. First, add the four live-interview checks above as default practice in every final-round video interview, and brief the panel on what to look for. Second, make Right to Work verification a live-video step rather than a document upload, with the candidate’s face and ID on camera together. Third, build a 30-60-90 day documented behaviour check into every new hire’s onboarding, framed as a performance review rather than a fraud check.
If you have budget beyond that, the next useful investment is not detection software. It is interview training for the people already running your hiring process. The Veriff Kantar research shows most people cannot reliably spot a deepfake. The people doing your final-round interviews are the detection system. Train them accordingly.
Employers can set reasonable interview conditions, including asking candidates not to use external tools during a live assessment, provided those conditions are made clear in advance and applied consistently across candidates. Framing this as part of the published interview process, rather than a surprise request mid-interview, is the direction most UK employment specialists are signalling.
Not directly. The DUAA 2025 reshaped how solely automated decisions in the UK are regulated, through Articles 22A to 22D in force from 5 February 2026. The link to deepfake candidates is indirect: a hiring process that meets the ICO’s expectation of meaningful human involvement is also the process most likely to catch synthetic candidates early. A qualified specialist can advise on how both apply to your set-up.
Enterprise-grade deepfake detection platforms typically start at several thousand pounds a year and scale up quickly with volume. For most UK SMEs under 200 employees, the better investment is interview training and process redesign, which can be implemented in a week and costs nothing beyond time.
Rejection decisions should be based on documented, consistent criteria applied to all candidates, not on a hunch. If an interview panel genuinely cannot verify the candidate’s identity, the appropriate step is a second verification stage before any hiring decision is made, with clear documentation of why. A qualified employment specialist can advise on how to word that in your process.
On its own, no. The Right to Work check verifies that a person has the legal right to work in the UK, not that the person on the video call is the same person as the one in the document. Running the check as a live-video step, with the candidate’s face and ID on camera together, closes most of that gap at no additional cost.
Treat it as a security incident, not only an HR issue. Revoke system access immediately, preserve the interview recordings and onboarding records, speak to a qualified employment specialist about the termination process, and report to Action Fraud if there is evidence of criminal intent. Reviewing the hiring process that let the candidate through is a step for the following week, not the first hour.
Sabiha is a UK talent acquisition director with 16 years of hiring experience across the UK, Dubai, South Africa and Malaysia. She helps UK SMEs design hiring and retention systems that use AI responsibly. Her first book, on using AI to win and keep talent in UK workplaces, is published Autumn 2026 with Trotman.
Global Talent. Ethical AI. Strategic Hiring. Sustainable Retention.
