What to do if a candidate used a proxy in an interview: a response playbook

If you think a candidate used a proxy in an interview, meaning someone else answered for them on camera or fed them answers, do not confront them. Instead: write down what you observed while it is fresh, pause the next step (offer, equipment, system access), tell your recruiter or HR, and run the identity check your company uses for every candidate at that stage. Decide on the result of that check, not on the suspicion. Close with a neutral message, tell the client if you are an agency, and report organized schemes to the FBI at ic3.gov.

This page is the response playbook for after the interview. Spotting the signs in the first place is covered in how to spot candidate identity fraud, and the different kinds of interview fraud are defined in what is interview fraud. Everything below is current as of October 2026 and written for US employers; it is general guidance, not legal advice.

What counts as a proxy, and how sure do you need to be?

"Proxy" covers several situations, and they need different responses:

• Proxy interviewer. A different person sits the interview under the candidate's name, usually a more skilled one.
• Bait and switch. The real applicant interviews, someone else turns up to do the job, or the reverse.
• Hidden helper. The candidate is who they say they are, but another person off camera, or on a remote connection, supplies answers.
• Proxy for an assessment. Someone else completes a coding test or take-home task. See how to verify take-home assignment authorship.

The first two are identity fraud. The last two are misrepresentation of ability, which you handle under your rules for outside help (candidates using AI in interviews: a fair policy). What you can do depends on how much you actually know:

What should you do in the first 24 hours?

1. Finish the call normally. An accusation on the call cannot be taken back, and you may be wrong: a different voice can be a bad headset, and a camera that fails can be a camera that fails.
2. Write down what you saw, with times. "At 14:05 lip movement did not match the audio. Candidate declined to turn off background blur. Could not name the database used in the project described at the screen." Save any recording or transcript you made with the candidate's consent. Keep notes factual; a later reader, possibly the candidate, should see observations, not adjectives.
3. Freeze the next step. No offer, no equipment shipment, no accounts. The FBI's July 2025 guidance says do not grant access to any systems until the background check is completed, and to ship equipment only to the address on the person's identification.
4. Tell the right people. Your recruiter or talent lead first. Add security if any account, laptop or data access already exists, and HR or legal if an offer has gone out.
5. Check your own systems. Search your ATS for the same phone number, email, resume text or portfolio link under other names. The FBI's January 2025 warning recommends cross-checking applicants' resume content and contact information against existing HR records.
6. Pull the other interviewers' notes. Before anyone discusses it, collect each interviewer's notes as written. Contradictions between rounds are the strongest evidence you will have.

How do you verify identity without accusing the candidate?

Use a step that every candidate at that stage would get, and describe it that way. The checks published by government agencies are a good menu: hold photo ID up to the camera during a live video call (in the FBI and South Korean October 2023 guidance), keep the background unobscured and wave a hand in front of the face (FBI, July 2025), require notarized proof of identity (October 2023), or meet in person where that is practical. For how to choose and stage these checks, see the candidate identity verification checklist.

Subject: Next step: a short verification call

Hi [name], thanks again for your time on [day]. Before final
interviews, we do a 10-minute identity verification with every
finalist: camera on, background effects off, and a photo ID held to
the camera. We only check that it matches; we [don't keep a copy].
Could you do [two time options]?
If you need an adjustment to how this works, tell me and we'll
arrange an alternative.

On that call, compare the person with what you saw before, and ask two or three questions that only the person from round one could answer: "Last week you described the reporting rebuild. Who signed off on the new schema?" Then act on the outcome:

• Clear match, consistent answers. Continue the process and remove the suspicion from the record. A cleared concern should not follow the candidate.
• Declines, stalls or withdraws. Close the process politely. You do not need to say why beyond "we've decided not to move forward."
• A different person, or ID that does not match. End the process, document the result and move to the steps below.

What should you write in the candidate record?

Write it so it would read as fair to a regulator, a court or the candidate. Avoid labels ("fraudster," "fake"), anything about accent, nationality or ethnicity, and guesses about motive. Use this shape:

Round:        Technical interview, [date], [interviewer]
Observed:     Voice and appearance differed from phone screen on [date]
              (screen interviewer: [name]). Could not describe the
              project discussed at screen when asked twice.
Action:       Standard finalist ID verification offered [date].
Outcome:      Candidate withdrew / ID did not match / verified.
Decision:     Process closed [date] by [name]. Client informed [date].

More on wording is in what not to write in interview notes. Keep recordings and transcripts only as long as your retention policy allows. If you use Interview Signal, which we make, each round's transcript and quotes stay on the interviewer's computer, so the comparison between rounds can rest on the candidate's exact words rather than memory.

When do HR, legal and security need to be involved?

Three points that catch teams out:

• Background check reports carry notice rules. If your decision relies even partly on a consumer report from a screening company, the FTC says you must give a pre-adverse action notice with a copy of the report and a summary of rights before acting, then an adverse action notice. See the FCRA background check process.
• A hire may already have done damage. For suspected North Korean IT workers, the FBI asks victims to evaluate network activity from the suspected worker and their devices and report quickly. Security should act before HR tells the person anything, so access is not used in the meantime.
• Payments can create sanctions exposure. Treasury says civil penalties for dealing with sanctioned persons can apply on a strict liability basis. If you may have paid a North Korean worker, talk to counsel about next steps with OFAC. The warning signs are in North Korean IT worker red flags.

Throughout, judge the facts, not the person's background. The EEOC's national origin guidance covers decisions based on accent, ancestry or appearance, none of which is evidence of a proxy.

What do you tell the client, if you are an agency?

Tell them the same day you confirm anything, and tell them early if they have already met the candidate. The client needs facts it can act on, not a story:

Subject: [Candidate name], [role]: verification concern

Hi [client], a heads-up on [candidate]. In [round] on [date] we
observed [fact, e.g. the person on camera differed from the person
at our screen]. We ran our standard finalist identity check on
[date]; [outcome]. We have withdrawn them from your process.

You interviewed them on [date]. It is worth comparing your notes with
ours, and if any access, equipment or paperwork has started, please
involve your security team. Happy to talk it through.

Do not forward the candidate's identity documents, screenshots of their face or your speculation about who was behind it. If the person has already started on assignment, treat it as a security incident at the client first and an employment matter second. The FBI's January 2025 warning tells employers to confirm that third-party staffing firms have robust hiring practices, so expect the client to ask what your process was. Have your verification steps written down.

What do you tell the candidate?

Keep it short and neutral. Explaining your suspicion invites an argument you cannot settle, and if the person is an identity theft victim rather than the fraudster, it can hurt someone innocent.

Hi [name], thank you for your interest in the [role]. We've decided
not to move forward with your application. We wish you the best with
your search.

If the decision relied on a background check report, send the FCRA notices instead of, or as well as, this message. More wording is in candidate rejection email templates.

Should you report it, and to whom?

Report suspected organized schemes, especially anything that looks like a North Korean IT worker, a laptop farm or a facilitator, to the FBI at ic3.gov or a local field office. The FBI's October 2026 announcement asks reporters to include:

• Any street address linked to the activity, especially one that received a work device or other items.
• Identifiers: names, phone numbers, emails, bank accounts, IP addresses, social media and professional networking accounts.
• Images, screenshots, videos, messages or documents from the person.
• Details about anyone else involved, such as facilitators.

Also report the profile to the job board or networking site it came through. One caution from the same FBI announcement: do not rely on name-based ban lists, which can harm identity theft victims. The name on the application may belong to a real person whose identity was stolen; block phone numbers, emails, devices and documents instead.

How do you stop it happening again?

• Move the identity step earlier. If the proxy reached a final round, the check came too late. Put a live camera check with ID at the first video interview for remote roles.
• Keep one thread across rounds. The same recruiter at the screen and the final, or notes and transcripts the later interviewers actually read, make a switched person visible.
• Tell candidates up front. "We verify identity on camera at the second interview" in the invitation deters proxies and treats everyone the same.
• Debrief the miss. Which signal was there in round one, and who noticed it but said nothing? Add it to interviewer training.