Deepfake Screening: Liveness + Telemetry Runbook

A candidate clears early screens, then a final interviewer flags video artifacts and off-camera reading. Recruiting Ops attempts to reconstruct what happened across tools and finds the usual failure mode: no single timeline tying identity, device session, and assessment behavior to the final decision. This is where SLAs break: panels get paused, time-to-offer slips, and offer-to-start fallout increases because the candidate sits in limbo. Legal exposure shows up immediately. If counsel asks, "Who decided this was fraud, on what evidence, and when?" many teams have a decision without evidence, spread across screenshots and emails. Remote-role fraud is now observable at material rates: Pindrop reports 1 in 6 remote applicants showed signs of fraud in one real-world pipeline, and Checkr reports 31% of hiring managers have interviewed a candidate who later turned out to be using a false identity. SHRM notes replacement costs can range from 50-200% of annual salary depending on role.

Most stacks were assembled for throughput, not defensibility. The market failed to solve deepfakes and proxy test takers because workflow ownership and evidence capture are fragmented. Legacy flows are sequential: ATS stage moves, then background checks, then interviews, then assessments. Once suspicion appears, everything stalls and becomes a manual investigation. The bigger gap is auditability. Many systems cannot produce unified evidence packs with timestamps, reviewer identity, and linked artifacts. There are no review-bound SLAs for fraud queues, no standardized rubric storage tied to identity, and no ATS-anchored audit trails that show who approved access to the next step. Shadow workflows appear to compensate: DM threads, spreadsheets, exported videos. Shadow workflows are integrity liabilities. If it is not logged, it is not defensible.

Fraud defense scales only when ownership is explicit and tied to queues and SLAs. Recruiting Ops owns workflow sequencing, risk-tier policy rollout, SLA enforcement, and time-to-event metrics. Security owns access control and audit policy: trigger thresholds, step-up rules, evidence pack requirements, and who can confirm fraud dispositions. Hiring Managers own rubric discipline and evidence-based scoring. They should not be asked to adjudicate identity without a compiled evidence pack. Sources of truth must be explicit: the ATS for stage transitions and decisions, the verification service for identity events, and the interview-assessment layer for telemetry and artifacts with write-backs into the ATS.

Treat hiring like secure access management. Candidates should not get access to higher-trust steps without an identity gate before access. An instrumented workflow uses event-based triggers, automated evidence capture, and ATS-anchored audit trails. It correlates signals across steps because deepfakes evolve fast and no single signal is a silver bullet. Dashboards should segment integrity signals by role, source channel, geo, and time-to-event. Time delays cluster where identity is unverified, so instrumentation is how you keep throughput while increasing control. False positive management is part of the model: define what triggers review, what evidence is required, and how to clear candidates quickly without accusations.

IntegrityLens AI acts as the ATS-anchored control plane that turns fraud detection into enforceable gates and review queues, with evidence packs that survive audit questions.

These patterns increase fraud exposure and also increase false positives because decisions become inconsistent.

Implementing tomorrow means prioritizing controls that reduce fraud without stalling throughput. Business outcomes: reduced time-to-hire by avoiding late-stage rework, defensible decisions backed by evidence packs, lower fraud exposure via defense in depth, and standardized scoring across teams.