How to Spot Fake Job Applicants: 12 Red Flags for Small Businesses

A fake job applicant is someone who applies under a stolen, invented or borrowed identity, or a bot that submits applications automatically. You can catch most of them by checking three things: the resume file itself, how the application was sent, and whether the person on the video call matches the person on paper.

Small businesses are easy targets. Post a remote role and hundreds of applications can arrive in a few days, with nobody whose job is to check them.

Below are 12 red flags grouped by hiring stage, a check you can run for each, and how to weigh them so you don't turn away real people.

How common are fake job applicants?

Common enough that Gartner predicts 1 in 4 candidate profiles worldwide could be fake by 2028. In a separate Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them.

The most organized version is a state operation. The FBI has warned since 2022 that North Korean IT workers use stolen and borrowed identities to get hired into remote jobs at US companies. Its May 2024 alert describes US-based helpers who receive the company laptops on the workers' behalf.

Most fake applications are smaller operations: bots applying to every job that matches a keyword, resume farms sending the same file under different names, and real people trying to game AI screeners with hidden text. Remote roles are the most common target, especially in IT and software, where a new hire gets access to company systems.

The 12 red flags at a glance

Red flags in the resume

1. Hidden white text

Some applicants paste the job description, or a block of keywords, into their resume in white text on a white background. You can't see it, but keyword filters and AI screeners read it like any other text. Some applicants also hide instructions for AI screeners, such as telling the AI to rate them 10 out of 10.

How to check: Open the PDF or Word file and press Ctrl+A (Cmd+A on a Mac) to select all the text. Highlighted lines in areas that looked blank are hidden text. You can also copy everything into a plain-text editor, where white text shows up like the rest.

Hidden text doesn't always mean the person is fake. It does mean they tried to game your screening, which is worth knowing before you spend an hour interviewing them.

2. The resume copies your job post

A resume that repeats your job post's phrases word for word, including the unusual ones, was probably generated from it. Keyword stuffing is the cruder version: the same skill listed eight times, or a skills section that names every tool in your post and nothing else.

How to check: Pick two unusual phrases from your job description and search the resume for them.

Plenty of real candidates tailor their resume to the job, and 4 in 10 say they use AI during the application process, according to Gartner. Tailoring is normal, so look for a resume that reads like your job post with the sentences shuffled.

3. The same resume under different names

Resume farms send one resume file many times, changing the name and email address on each copy. If you've hired for a similar role before, you may already have the same file under another name.

How to check: Search your inbox or applicant list for the phone number, a distinctive project name or the original file name.

4. Work history you can't verify

Watch for employers you can't find online, job titles that don't fit the company's size, overlapping dates at full-time jobs, and achievements with no numbers, clients or products attached.

How to check: Look up two past employers. Confirm they exist, and that the applicant's LinkedIn profile tells the same story as the resume.

5. Contact details with no history

A brand-new email address, a phone number from an internet calling service and a LinkedIn profile created last month are each common on their own. Together, on someone claiming ten years of experience, they're worth a closer look.

How to check: Call the number. On LinkedIn, open "About this profile" to see when the account was created, and look at who the applicant is connected to.

Red flags in how the application was sent

6. Bot-speed submissions

A person takes several minutes to fill in an application form. A bot takes seconds, and often sends dozens of applications in one burst.

How to check: If your application form or ATS records timestamps, look for applications completed in under a minute, or a batch of applications that arrived seconds apart.

7. Sent from a hosting server

Real applicants apply from home, the office or their phone. Applications sent from a cloud or hosting server, the kind of computer that runs websites, usually come from automated tools or from someone hiding where they are.

How to check: You need a form or ATS that records each applicant's IP address. An IP lookup tool will then tell you whether the address belongs to a hosting provider.

A VPN is a different case. Lots of people use one for privacy or for work, so treat a VPN on its own as low risk.

Red flags in the interview

8. Camera off, or video that looks wrong

A 2023 advisory from the US and South Korean governments lists being unwilling or unable to appear on camera as a warning sign for North Korean IT workers, along with inconsistencies in time, location or appearance when they do.

Some fake candidates use face-swap software on live video. Asking them to turn sideways or pass a hand across their face can make older tools glitch, but newer ones often hold up, so treat it as one check among several.

How to check: Make live video a requirement for at least one interview, with the camera on for the whole call. If something looks off, ask the candidate to turn their head to the side, watch whether their lips stay in sync with their voice, and ask unscripted questions about the role.

9. They can't talk through their own resume

Someone working from a borrowed or invented history can recite the resume but struggles with follow-up questions. The FBI's alert specifically flags candidates who can't answer basic questions about their past or where they're located.

How to check: Pick one project from the resume and ask three follow-ups: who they worked with, what went wrong, and what they'd do differently. Ask where they're based and what time it is there.

10. Someone else is feeding answers

Long pauses before every answer, eyes that move as if reading, and answers that sound recited can mean someone off-camera is coaching, or an AI tool is listening and writing replies. The FBI also flags background noise that sounds like other people doing similar work nearby.

How to check: Mix in questions that need a quick, personal answer, and ask the candidate to share their screen during any technical exercise.

Red flags after the offer

11. They ask to ship the laptop to a different address

The FBI advises employers to watch for address changes after someone is hired, because fake remote workers rely on helpers in the US to receive company equipment.

How to check: Ship equipment only to the address on the new hire's verified ID. If they ask for a different address before their first day, ask why.

12. ID that doesn't match

The name on the ID, the face on the video call and the name on the payroll bank account should all belong to the same person.

How to check: Verify identity before giving anyone system access. For US hires, you already complete Form I-9. The FBI also recommends running remote workers through E-Verify, and asking for in-person verification if E-Verify returns errors.

How to weigh the red flags

One flag is rarely proof. Real people change email addresses, use VPNs, take career breaks and write cover letters with ChatGPT. If you reject everyone who trips a single check, you'll lose good candidates and catch few fakes.

Look for independent signals that agree. A hosting-server connection, a duplicate resume and hidden text on the same application is a pattern. A VPN on its own is a VPN.

Two more rules keep this fair:

• Ask before you decide. A flag is a reason for a question, such as "We noticed hidden text in your resume. Can you tell us about it?"
• Run the same checks on everyone. Checking only some candidates, based on their name, accent or where they say they're from, invites discrimination claims and misses the fakes who don't fit your guess.

What to do when an application looks fake

1. Archive the obvious bots. A batch of identical applications sent seconds apart doesn't need a reply.
2. Ask a verifying question for anything less clear, by email or on a short call.
3. Require live video for the next interview.
4. Verify identity before you send equipment or give system access.
5. Report suspected fake IT workers to the FBI's Internet Crime Complaint Center at ic3.gov, as its alert asks.

How to catch fake applications automatically

Five of these checks (1, 2, 3, 6 and 7) are hard to run by hand once you have more than a few dozen applicants, and two of them need data your inbox doesn't record. An applicant tracking system with fraud detection runs them on every application as it arrives.

Applisights checks each application for five kinds of signals:

• Behavior: bot-speed submissions
• Network: applications sent from cloud or hosting servers
• Identity: the same resume file sent under different emails
• Document: white-on-white text hidden to game AI screeners
• Content: keyword stuffing

Each flag says what happened in plain English, with a risk rating. A VPN alone stays low risk, and risk only climbs when independent checks agree. Flags never reject anyone. You decide, after talking to the candidate.

Fraud detection is included on Starter ($39 a month) and up, with 200 AI resume analyses a month and unlimited team members. The free plan includes AI resume screening and access to 25,000+ job sites. See how fraud detection works or start free.

Still choosing a tool? Our comparison of AI candidate screening software covers seven options, including which ones screen applicants on a free plan.

Frequently asked questions

What is a fake job applicant?

A fake job applicant is someone who applies under a stolen, invented or borrowed identity, or a bot that submits applications automatically. Some are resume farms sending one resume under many names. Others work for fraud schemes that want a paycheck or access to a company's systems.

How common are fake job applications?

Gartner predicts that 1 in 4 candidate profiles worldwide could be fake by 2028. In a Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, either posing as someone else or having someone else pose as them.

How do I check a resume for hidden text?

Open the file and press Ctrl+A, or Cmd+A on a Mac, to select all the text. Highlighted lines in areas that looked blank are hidden text. You can also paste all the text into a plain-text editor, where white text shows up like any other text.

Is it fraud if a candidate used AI to write their resume?

No. 4 in 10 candidates say they use AI during the application process, according to Gartner. Treat hidden text, invented jobs or someone else attending the interview as red flags, whether or not AI was involved.

Should I reject applicants who use a VPN?

No. Many people use a VPN for privacy or for work. Treat a VPN as low risk on its own, and look closer only when other checks also flag the application.

Can an applicant tracking system detect fake applications?

Some can. Applisights checks every application for bot-speed submissions, connections from hosting servers, duplicate resumes, hidden white text and keyword stuffing. It explains each flag in plain English and never rejects anyone automatically. Fraud detection is included on the Starter plan at $39 a month and above.