# Checkr: 40% of Managers Met a Fake. Cross-Check Footprints, Not IDs

_Checkr's Hiring Hoax 2026 says 40% of managers met a fake candidate. ID checks won't stop it, but sourcing people whose GitHub, LinkedIn, and peers agree will._

- Canonical URL: https://www.refolk.ai/blog/checkr-hiring-hoax-2026-fake-candidates-cross-check-footprints
- Published: 2026-11-01
- Reading time: 10 min
- Keywords: how to spot fake job candidates, deepfake candidate interview fraud, verify candidate identity before interview, Checkr Hiring Hoax 2026, candidate fraud remote engineering hiring

If you run a remote engineering pipeline, there is a real chance one of your recent interviews was with someone using a fake identity. In Checkr's Hiring Hoax 2026, released October 15, 2026, 40% of 3,000 US managers said they had interviewed a candidate later revealed to be using one, up from 31% a year earlier. Most teams are responding by adding more ID checks to the inbound pile. That treats the symptom. The cheaper fix is to change where your candidates come from.

## What did Checkr's Hiring Hoax 2026 actually find?

Checkr found that candidate fraud is growing faster than managers' confidence in catching it. 40% of managers have interviewed a fake candidate, but only 23% are extremely confident their process would catch one.

> **40%** of US managers have interviewed a candidate later found to be using a fake identity
>
> Checkr's Hiring Hoax 2026 survey of 3,000 managers, up from 31% in 2025.

Checkr surveyed 3,000 US managers between September 11 and 16, 2026. Confidence did rise a little, from 19% to 23%, but the share of managers who met a fake rose more than twice as fast. The rest of the report says the same thing in different ways:

| Finding | Figure | Source |
|---|---|---|
| Interviewed a fake identity | 40% (31% in 2025) | Checkr |
| Extremely confident they'd catch fraud | 23% (19% in 2025) | Checkr |
| Employers facing hiring fraud | 86% | Checkr |
| Verify identity at application | 29% | Checkr |
| Encountered an interview proxy | 67% | Checkr |
| Suspect a fraud on payroll right now | 38% | Checkr |

An interview proxy is someone other than the real candidate who turns up to the interview. Brittany Nguyen, a talent recruitment specialist at Oklo, told Checkr about applications that arrive with "nearly identical language, formatting and accomplishments." That is what an inbound funnel looks like once generating applicants costs almost nothing.

## Why won't more ID checks at application fix candidate fraud?

ID checks confirm who owns a document. They don't confirm who is doing the work, and the large fraud schemes are built around that gap. Even if the 29% of employers who verify identity at application rose to 100%, the schemes the DOJ just charged would still get through.

On October 13, 2026, two days before Checkr's release, the Department of Justice charged 14 people and seized about 187 computers in a North Korean IT worker scheme that affected more than 70 US companies. These schemes beat document checks in two ways:

- **Real people lend real identities.** One defendant, Bostelle, gave his name and a fraudulent driver's license to help a remote worker get a job. The identity check had a real person behind it.
- **The work is subcontracted.** According to the DOJ, North Korean operatives are recruiting American facilitators to get around better private-sector detection, and in some cases they hand entire jobs to third-party foreign nationals.

The reason this matters: a document check ties a name to a face once, at one moment. A laptop farm separates that name from whoever is actually typing for as long as the job lasts. Better documents don't close that gap.

> An ID check proves who owns the document. It says nothing about who has been doing the work.

## How cheap is a fake candidate to build?

A passable real-time deepfake for a job interview takes about 70 minutes to build. Palo Alto Networks' Unit 42 showed that one researcher with no image-editing experience, using free tools and a graphics card bought in late 2020, built one in roughly that time.

That 70 minutes covers the video layer only, not a full fake profile with a resume and work history. Still, the video was supposed to be the hard part. A deepfake candidate is an applicant whose face or voice in a video interview is generated or swapped in real time so they appear to be someone else. Recruiters are already seeing them:

- **Pin's 2026 survey:** 22.4% of 475+ recruiters confirmed a deepfake or identity swap in a video interview, and another 16.3% suspected one. The sample is self-selected, so read it as a signal, not a census.
- **Checkr on proxies:** 34% of managers confirmed an interview proxy and another 33% strongly suspected one.

The economics explain why this keeps growing. Applying inbound is free. The attacker spends about an hour, and you spend a recruiter screen, a technical loop, and a panel. When it costs this little to get into your funnel, every extra screening step adds cost to your side, not theirs.

## Is an old GitHub account proof that a candidate is real?

An old GitHub account is not proof on its own, because account age can be bought or reused. What is hard to fake is several independent sources agreeing with each other: commits, LinkedIn tenure, talks, and coworkers all describing the same career.

The working title of this piece was "fakes rarely have 2019 commits," and that's only half right. Nisos found DPRK operators reusing matured GitHub accounts and portfolio content from older personas to backstop new ones. Microsoft Threat Intelligence has reported hundreds of fake profiles and portfolios for North Korean IT workers on developer platforms like GitHub. Group-IB documented shared repos and recycled portfolios across personas.

So a 2019 commit can be inherited. The more useful Nisos finding is what was missing: the personas typically had no social media accounts, which suggests they were created only to get hired. They had depth on one platform and nothing anywhere else.

That gives you the actual test. A real engineer's history leaks across many systems that nobody coordinates. A former employer shows up in commit emails. A conference lists them as a speaker. A coworker's LinkedIn overlaps the same years. A fake can buy depth on one platform, but getting several unrelated platforms to agree is much more expensive.

## How does the co-author graph expose fake engineers?

The co-author graph exposes fakes because fabricated accounts tend to commit alongside other fabricated accounts. Researchers found manufactured contribution histories in which fake accounts had co-authored commits with previously identified DPRK-affiliated accounts. The network around the account gave it away.

The co-author graph is the set of people a developer has shared commits, pull requests, or repos with over time. For a real engineer, it's full of other real engineers who have their own LinkedIn profiles, their own employers, and their own long histories. For a fabricated persona, it often loops back to a small cluster of accounts that exist mainly to vouch for each other.

CrowdStrike tracks this group as "Famous Chollima" and helped with the FBI's Operation Lonestar Roundup. You don't need their tooling to use the same idea. Checking who a candidate builds with is ordinary good sourcing: it shows you their team, their seniority, and who could give you a reference. It also happens to be a fraud check that no document scan can perform.

## Why can't you just filter for engineers with a public footprint?

Filtering for a labeled public footprint fails because most real engineers never label theirs. In [Refolk](/)'s index of professional profiles, only about 1 in 241 US software engineers with Git listed as a skill says "open source" in their headline, so a keyword filter throws away almost everyone legitimate.

The index has 81,457 US Software Engineers and Senior Software Engineers with Git as a skill. Only 338 of them, about 0.4%, put "open source" in their headline. The two filters measure different things (a skill tag versus a headline keyword), so treat the ratio as directional. The top employers in the open-source group are what you'd guess: Red Hat, Docker, and OpenTelemetry. Those are people whose employers pay them to work in public.

> **1 in 241** US engineers with Git as a skill who say "open source" in their headline
>
> 338 of 81,457 profiles in Refolk's index. The rest have footprints you have to connect yourself.

This keeps the advice from turning into "only hire famous open-source contributors." Most legitimate engineers have a GitHub account that never mentions their LinkedIn and a LinkedIn that never links to their GitHub. The footprint exists, but it isn't labeled. Outbound sourcing that protects against fraud means matching those accounts yourself, which is the gap Refolk closes: you describe the person in plain English and get back profiles with their GitHub, LinkedIn, and open-web traces already connected.

> **Example search:** "Find US senior backend engineers whose GitHub commits since 2019 line up with the employers on their LinkedIn, and who have given at least one conference talk." - [run it on Refolk](https://www.refolk.ai/s/4aa4x8n79j)
>
> A ranked shortlist with each person's GitHub, LinkedIn, and talk links side by side, so you can see whether the sources agree before anyone books an interview.

The direction of search matters here. Inbound puts the burden on you to disprove a claim someone handed you. Outbound starts from evidence that existed before anyone knew you were hiring, and that is much harder to stage for a single role.

## How do you verify candidate identity before the interview?

Check whether independent sources tell the same story before the first call. Look at five things, and treat agreement between them as the signal rather than any single one.

1. **Commit history against employment dates.** Do the GitHub contribution periods and commit email domains match the employers and years on LinkedIn?
2. **The co-author graph.** Are their regular collaborators real engineers with their own long, cross-linked histories, or a small cluster of thin accounts?
3. **Talks, papers, and issue threads.** Does a conference page, meetup recording, or long-running issue discussion show the same person, with the same name and employer, at the same time?
4. **Social presence beyond job platforms.** Nisos's personas had developer and job-board accounts and nothing else. Real people leave traces in places that have nothing to do with getting hired.
5. **A coworker you found yourself.** Find a former teammate through the co-author graph or overlapping tenure, not through the candidate's reference list, and ask about specific work.

Here is what each check proves, and where it fails:

| Check | What it proves | What it misses |
|---|---|---|
| ID document at application | Someone holds this document | Lent identities, subcontracted work |
| Old GitHub account | The account has history | Matured accounts reused across personas |
| Cross-source agreement | Several unrelated systems tell one story | Very thin but genuine footprints |
| Independently found coworker | Someone saw this person do the work | Rare collusion |

Doing this by hand is slow. For a hard-to-fill role, cross-referencing commits, tenure, and coworkers for every name on a long list can leave the seat open for weeks while inbound applications, some of them fake, keep coming.

## Does sourcing outbound protect you after the offer, too?

Outbound sourcing protects you after the offer because it leaves you a record of the work you hired against, and that is where most companies have no defense at all. 38% of managers suspect a fraudulent employee is on their payroll right now, yet only 6% of organizations reportedly prioritize fraud prevention after hiring.

Inbound screening is a gate you pass through once. When the gate fails, nothing downstream catches it, and the DOJ's laptop-farm cases show a subcontracted worker can sit behind a real name after the hire. A hire you sourced from a cross-linked footprint has provenance: you know which commits, which coworkers, and which talks you hired against. If the person on the video call six months later doesn't match that body of work, you have a baseline to compare against.

Ilan Frank, Checkr's chief product officer, put the problem plainly: employers can't assume "a polished resume, a convincing interview or a seemingly valid identity tells the whole story." Each of those is a single artifact you can't verify on its own. A career that several unrelated systems recorded over years is much harder to fake.

## FAQ

### How do you spot fake job candidates before the interview?

Look for agreement across independent sources rather than polish in any one of them. Check that GitHub commit dates and email domains match LinkedIn tenure, that the candidate's co-authors are real engineers with their own histories, and that a talk, paper, or issue thread shows the same person. Nisos found fake personas with developer and job-board accounts but no social media, so depth on one platform with nothing anywhere else is a warning sign.

### Does a verified ID stop deepfake candidate interview fraud?

Not reliably. The October 13, 2026 DOJ case involved real Americans lending their names and driver's licenses, and operatives subcontracting the actual work. An ID check confirms who holds a document, not who writes the code. It's worth doing, but it can't replace checking whether the candidate's work history holds together across sources.

### What if a strong candidate has almost no public footprint?

That's common. In Refolk's index, only 338 of 81,457 US engineers with Git as a skill mention "open source" in their headline. A thin footprint isn't a red flag on its own. In that case, rely more on a former coworker you find independently and on live technical work in the interview, and treat a footprint that contradicts itself as a much stronger signal than one that's sparse.

---

_From the Refolk blog. More posts: https://www.refolk.ai/blog/index.md_