Ask a founder to describe a fake applicant and you'll usually hear about a deepfake on a video call. The ordinary version is far more common. In 2024, 64.2% of more than 2,100 U.S. respondents told ResumeBuilder.com they had lied about personal details, skills, experience, or references on a resume at least once, as Human Resources Online reported on the survey. Most of those lies are cosmetic. The ones that aren't arrive with a price attached to payroll, laptops, and production access.
The fake applicant problem (how much fraud is costing startup hiring teams) is a budget question before it's a security question. You can't decide how much verification a role deserves until you know what a bad hire costs, and what a good candidate costs you when you reject them by mistake.
That's the frame for everything below. Each check gets priced twice, once against the fraud it blocks and once against the qualified person it might turn away.
Start with a number a founder can act on. SHRM estimates that replacing a bad hire costs roughly 50% to 200% of salary, with the top of that range landing on senior and specialized roles, in its analysis of how to assess skills when candidates can fake them in real time. On a $180,000 senior engineer, that lands at $90,000 to $360,000 before you count incident response, legal time, or the code that walked out with the credentials.
The average understates the danger. Most fraudulent hires cost far less than the top of that range, and a few cost far more, because the multiplier is access: payroll, equipment, and production systems handed over in week one. A startup that ships a laptop and a production login to an impostor lands in that tail fast.
| Cost source | Benchmark | What it means for a startup |
|---|---|---|
| Bad-hire replacement | 50% to 200% of annual salary (SHRM) | $90,000 to $360,000 for a $180,000 senior engineer |
| Hiring or identity fraud losses | Managers in hiring-fraud surveys report losses reaching well past a bad hire's salary | Material loss that justifies verifying before the offer |
| Where the heaviest losses sit | Exposure concentrates in roles granted payroll, equipment or system access early | Companies that grant access in week one carry the largest risk |
| Recruiter time on junk applications | Recruiters report losing large blocks of the workweek to spam and low-fit applications (Greenhouse) | Founders screening alone lose hours that would otherwise go to product or engineering work |
| Unverified education claims | Many employers never check whether a claimed degree exists | Degrees can pass the whole funnel on trust |
Salary replacement is the visible line item. The invisible ones are the founder reading applications at 11pm, the two weeks of onboarding that produce nothing, and the security review that starts the day someone asks why a new hire's laptop shipped to an address that isn't theirs.
The asymmetry runs in your favor. A cheap check placed early prevents an expensive failure discovered late, after access has already been granted. Each check also carries a second price: the qualified candidate it might turn away. Early, low-friction checks carry almost none of that cost, which is why they belong at the front of the funnel.
Rank before you screen: expected loss equals the probability an application is deceptive, multiplied by salary, replacement cost, delayed delivery and security remediation. Production access and payment permissions push that multiplier up, so those roles get verified first and hardest.
That formula is why a ten-person startup should treat a senior backend engineer differently from a content marketer. The engineer's credentials provide access to databases, deploy pipelines, and sometimes customer records. The marketer's provide access to a CMS. Same company, different expected loss, different depth of check.
Before you choose a single verification step, list every open and upcoming role and sort them by what the person would be able to touch in week one. Let that ranking decide where the budget goes. A generic background-check package can't make that call.
Treating applicant fraud as one problem produces one blunt answer, which is to distrust everyone. The risk splits into five forms, and each one surfaces at a different stage of your funnel.
| Fraud type | Warning sign | Where to catch it | Countermeasure |
|---|---|---|---|
| Resume fabrication | Inflated titles, dates or degrees that fail a check | Application and reference stage | Verify employment history and degrees before the offer |
| Identity impersonation | Video interviewee does not match the named applicant | Live interview | Liveness check and government ID match |
| Interview assistance | Answers stall or change style under follow-up questions | Live task or code walkthrough | Time-boxed live task with follow-up on the candidate's own work |
| Fabricated documents | Forged ID, altered photo or a valid but stolen identity | Pre-offer and pre-equipment | Identity verification before equipment or access is issued |
| Automated or scam applications | Mass applications, impersonated recruiters or data harvesting | Inbound intake | Behavioral filters and verified recruiter contact details |
Here's how the five forms look when you map them against real screening data.
A 2025 NBC report laid out the mechanics behind fraudulent remote-tech applications: AI-generated profiles, fabricated employment histories, forged photo identification, and real-time interview assistance, as NBC Chicago's coverage of fake remote job seekers described. The same report cited KnowBe4's disclosure that it hired a North Korean software engineer who used an AI-altered stock photograph and a valid but stolen U.S. identity, then cleared background checks and four video interviews.
The lesson isn't that KnowBe4 was careless. It's that four video calls measure how well someone performs in a video call. The person supplying the answers and the person whose resume was under review were never the same human being, so every check that assumed they were produced a false pass.
That's why identity is verified separately from capability. A live coding exercise with follow-up questions tests whether someone can do the work. A government ID match with a liveness check tests whether the person doing the work is the applicant. Neither substitutes for the other, and teams that run only one of the two leave a gap an organized operation can drive through.
Polishing a bullet, reordering roles to lead with the relevant one, or dropping a two-month contract are normal. Embellishment crosses into fraud when a claim becomes checkable and false: a degree never awarded, a title never held, dates moved to hide a gap, a reference who never managed the candidate.
That line matters, because teams that treat every rewrite as deception reject strong candidates who wrote a better resume than the person ahead of them. Save the suspicion for claims you can test.
The strongest prevalence signal in current data comes from recruiters themselves. A 2025 Greenhouse survey of 4,136 respondents found that 91% of recruiters had observed candidate deception, and 65% of hiring managers had caught applicants using AI deceptively, including AI-generated scripts, resume prompt injection, and deepfake presentation, as Apollo Technical's review of AI-era interview cheating reports.
Caveats matter more here than in most hiring research, because a detection rate read as a fraud rate turns a screening problem into a panic.
Employer-reported surveys point the same direction: a substantial share of hiring managers say they have interviewed a candidate whose identity later proved false, or suspected that someone other than the named applicant appeared on a virtual interview. Those are incidents employers caught or guessed at, which makes them directionally useful and statistically softer than an audit.
Candidates admit to some of it directly. Gartner reported that 6% of 3,000 candidates surveyed in 2025 admitted to interview fraud, such as impersonating someone else or arranging for another person to take the interview, per Gartner's release on candidate trust in AI hiring. Gartner also projected that one in four candidate profiles worldwide could be fake by 2028, a forecast rather than a measurement, reported in Proof's analysis of fake candidates.
Greenhouse counts what recruiters noticed, employer surveys count what employers caught or suspected, and Gartner counts what candidates admitted. Read all three as floor estimates pointing at the same problem from different directions.
A floor estimate cuts both ways. It justifies spending real money on verification, and it warns against the overcorrection that treats every polished resume as a plant. Screening calibrated to a guessed-at fraud rate rejects qualified candidates at the same rate it catches impostors, and the false rejections never show up in any survey.
Treat applicant authenticity as an operating risk with a budget line. Size the budget to a floor, not a headline, and spend it on checks that protect real candidates while catching fake ones.
Wellfound's enforcement policy treats a complaint as a user report involving spam, misleading roles, unprofessional communication, or another guideline violation, and it escalates in three tiers, per Wellfound's community guidelines and enforcement FAQ.
Tier one, isolated reports. A single complaint doesn't automatically produce a ban. Say a candidate reports that a listing's salary range was misleading. That gets logged, monitored, and nothing more unless a pattern emerges.
Tier two, repeated or significant complaints. These can trigger immediate limits on an account or on recruiting privileges. The plausible version is several candidates reporting the same recruiter profile presenting itself as a company's internal team, each report individually minor.
Tier three, severe violations. Scams, fake jobs, data harvesting, and impersonation can bring a permanent ban without warning. The clearest example is a "recruiter" who asks for personal identification or banking details during a screening call.
The job-seeker side of the policy names two violations that map directly onto fake applicant behaviour: misrepresenting geographic location, and impersonating another person, both prohibited under Wellfound's code of conduct for job seekers. Those cover a candidate claiming to sit in an eligible hiring market when they are elsewhere, and an impostor using someone else's identity through screening.
For a hiring team, the useful part is the escalation logic rather than the penalties. Three habits do the work.
Wellfound doesn't publish a fraud rate, so complaints are evidence of reported incidents, not a prevalence estimate for the platform or for startup hiring generally. Build your escalation process on patterns, not on single reports.
Verification depth should follow access, not seniority or salary. The question that sets the tier is simple. What can this person reach on day one?
| Role risk tier | Example roles | Checks required | Complete by |
|---|---|---|---|
| Low: no system or data access | Marketing, customer support, junior content | Identity match and employment history check | Before the offer |
| Medium: customer or financial data access | Account managers, finance analysts | Identity match, employment history and degree verification | Before the offer |
| High: production or privileged access | Senior engineers, DevOps, security | Identity match, live time-boxed task, code walkthrough and reference checks | Before equipment or credentials are issued |
| Remote hires across borders | Any remote role in any country | The same identity and capability checks applied by role tier, not by candidate location | Before onboarding starts |
The case for running any of this is not speculative. A 2018 report summarized by the Society for Human Resource Management, based on a HireRight survey of 4,000 respondents, found that 85% of employers had uncovered a lie or misrepresentation on a resume or job application during screening, up from 66% five years earlier, according to SHRM's coverage of resume fraud checks. Senior candidates were embellishing too.
Coverage is the weak spot. Only 49% of employers in that survey checked education credentials, which means roughly half of hiring teams take degrees on trust. And the 85% is a lower bound on the problem, because it counts detected misrepresentation rather than the true rate of fraud.
A curated pipeline cuts the number of applications a human has to read. It doesn't remove the need to validate titles, licenses, degrees, and hands-on technical experience before you commit salary and equity.
For the high-risk tier, the live task matters more than the interview. A short time-boxed exercise followed by a walkthrough where the candidate explains trade-offs and edits their own solution in real time gives you evidence that can't be outsourced to a second screen. The guide to testing candidates in the AI era walks through how to structure that exercise so it stays fair to people who have never seen your stack.
Low-risk roles don't need it. A support hire who never touches production or payment data needs an identity match and a verified work history, not a four-hour take-home.
Every verification step has two costs. One is the fraud it blocks. The other is the qualified candidate it turns away, and most hiring content only counts the first.
The pressure to over-screen is real. Greenhouse's report on the AI trust crisis in hiring notes that 91% of recruiters have encountered candidate deception and that 34% spend up to half their workweek filtering spam or junk applications. That is a strong argument for tightening intake, and a weak argument for treating every applicant as hostile.
Aggressive screening cuts impersonation risk and raises false-rejection risk at the same time. A real senior engineer who used AI to tighten a resume summary, or whose portfolio looks generic because the projects were internal, gets flagged by the same rule that catches a fabricated profile.
A check that flags a genuine engineer costs exactly as much as the check that catches an impostor. You only ever notice the second one.
Four measures, tracked monthly, tell you whether the balance is right: review time per candidate at each stage, days added to time-to-hire by verification steps, candidate drop-off after each step, and false rejections found on appeal or re-review. If drop-off spikes at the identity check and no fraud was caught that month, the check is mispriced.
Three fairness rules keep the process defensible and keep good people in the funnel.
Detection software alone won't settle this. Layered access controls limit the damage when screening misses an impostor, which is the part most tooling conversations skip. Pair whatever you deploy with staged onboarding and scoped credentials, and read candidate experience best practices before adding a fourth round to prove a point.
The sequence below is cheap enough to start this week, and it front-loads the roles where fraud does the most damage.
Steps two and three answer different questions, and teams that run only one keep the gap open. Identity verification asks whether this is the applicant. The live task asks whether the applicant can do the job. You need both answers before money and access change hands.
Founders at seed stage rarely have a recruiter or a security team, and the verification work lands on whoever is closest to the hire. Where the team lacks recruiting or security capacity, a contract recruiter or fractional security reviewer can run these steps and hand back a verified shortlist. If the bottleneck is sourcing rather than checking, Hunt by Underdog.io puts a team of vetted tech recruiters on the search on a contingent basis.
If a curated platform sits in your pipeline, confirm its screening scope in writing. At Underdog.io, every candidate profile is screened before employers see it, and our team checks that each candidate is a good fit for startups hiring on the platform. That cuts the volume of unverified profiles you review. The obligation to verify identity and work authorization stays with you.
Reference checks belong in the same sequence. One well-run call with a former manager, structured around specific projects and dates, costs less than a day of a bad hire's salary and catches inflated titles that automated checks miss. Standardize the reference check process that actually surfaces problems before your next senior search.
Then track the four funnel measures from the screening section every month. A verification step that catches two impostors a quarter while turning away three strong engineers is a net loss, and counting both sides is the only way to know which kind you are running.
The rule I'd adopt: verify before the offer, verify again before access is granted. Two cheap checkpoints, placed where they block the expensive mistakes.
If the cheaper fix is a smaller pool of real applicants rather than a heavier screening stack, start upstream. Underdog.io reviews every candidate profile before an employer sees it and shares only a small percentage of the people who sign up, so your interview hours go to candidates who exist, can do the work, and are ready to talk. Post a role or browse the current cohort at Underdog.io.
