Solutions / Hiring
Candidate Impersonation Detection
Stop candidate impersonation before it becomes workforce access.
Add candidate fraud detection to the live hiring process: catch North Korean IT workers, proxy candidates and hidden operators before the first live interview. Protect every round, detect when the operator or environment changes, and carry that risk into enrollment before access is issued.
Four candidates caught with DPRK IT worker tradecraft.
Across 600 remote interviews, imper.ai identified four candidates exhibiting overlapping infrastructure and identity indicators consistent with published DPRK IT worker operations, including Astrill VPN, AnyDesk, multi-hop proxies and location inconsistency.
Read the Q1 threat researchBuilt for the live hiring process
Protect the human behind every interview.
imper.ai embeds candidate impersonation detection into the ATS and interview workflow. Detect North Korean IT workers, proxy candidates and hidden operators before the first live interview, follow risk across later rounds, and carry that context into enrollment before workforce access is activated.
Protect before the first live interview.
Connect imper.ai to the ATS and interview workflow so protection is in place before the candidate joins. The first interaction can surface risk immediately, then later rounds add continuity and change detection.
Detect the operator across every round.
Evaluate device, network, location, environment, remote-control tooling and behavior during each protected interview. Then correlate what changes from one round to the next.
Carry risk into enrollment.
When the candidate becomes a new hire, imper.ai evaluates the access handoff again so hiring risk carries into device, MFA and credential enrollment.
Low friction by design: Talent Acquisition schedules and runs interviews as usual. imper.ai works in the background, legitimate candidates keep moving, and security gets an explainable impersonation risk decision when risk surfaces.
Candidate fraud business case
What is candidate impersonation costing your hiring process?
Use your own funnel assumptions to estimate recruiting capacity consumed by suspicious candidates, then model the downside if even one fraudulent worker gets through. The calculator keeps TA time and sanctions context separate so the assumptions stay visible.
Your hiring funnel
Start with a conservative assumption and replace it with your own observed volume and hiring process.
RECRUITING CAPACITY EXPOSED
0 hrsEstimated recruiter and interviewer time consumed if suspicious candidates are only identified after those human touchpoints.
One bad hire can move the problem beyond recruiting.
Treasury says DPRK IT worker schemes systematically use false identities to gain employment and generated nearly $800 million for the DPRK regime in 2024. If a sanctioned or blocked person is involved, the issue can become a sanctions and compliance matter in addition to a security incident.
Illustrative business-case model only. It is not a forecast of imper.ai detection performance and is not legal advice. Recruiting savings depend on when risk is detected, the customer’s process and the action taken. Explore the North Korean IT Worker Threat Center.
Featured ATS integration
Workday schedules. imper.ai protects.
Talent Acquisition schedules the interview from the candidate record in Workday. A Workday validation rule keeps the imper.ai interview account in the external video-interview flow, so the candidate is routed through imper.ai protection before joining the scheduled meeting. TA stays in Workday rather than operating a parallel security process.
Keep the recruiting workflow familiar
Protection follows the ATS and meeting workflow.
Recruiters keep scheduling interviews in Workday and ATS platforms such as Ashby, Greenhouse, SmartRecruiters, Bullhorn and iCIMS. imper.ai protects those live candidate interactions and gives HR, Talent Acquisition and security a consistent risk history across the hiring process.
See it inside the hiring flow.
The interactive demo shows how imper.ai evaluates a candidate environment, builds detections and routes the result back to the hiring team while the interview itself stays familiar to recruiters and candidates.
How imper.ai detects candidate impersonation
Detect what is happening now. Correlate what changes later.
One interview can reveal a suspicious operating environment on its own. Repeated interviews add another layer: whether the candidate’s device, network, location, tooling and operator pattern remain consistent across the process.
Turn signals into impersonation detections.
imper.ai evaluates the infrastructure and operating environment around the interaction, not just what the candidate looks or sounds like.
THE HISTORY
Catch operator handoffs and material change.
A candidate can look consistent while the operating pattern changes. Cross-interview correlation turns those changes into additional context for the impersonation risk decision while preserving a low-friction candidate experience.
Why candidate impersonation is now a security problem.
The public threat, the raw identity material available to attackers and the emerging control category are all moving in the same direction: hiring teams need a way to evaluate the human operating behind a candidate identity.
The threat is now on the record.
On July 31, 2026, eleven governments issued a coordinated warning on North Korean IT worker schemes. The alert describes false identities, third-party facilitators, VPNs, remote desktop software, laptop farms and AI-assisted impersonation. Those are the same kinds of operating indicators imper.ai saw when it caught four candidates exhibiting DPRK IT worker tradecraft across 600 remote interviews.
Read the warning analysisReal identity data can become raw material for hiring fraud.
A dark-web service claimed access to more than 153 million U.S. and Canadian driver’s-license records. The final scope remains unconfirmed, but the broader point is clear: stolen identity data can make a fraudulent candidate persona more convincing across applications, screening, background checks and formal proofing. The live operator and environment around the interview become an additional layer of assurance.
Read the developing analysisCandidate Impersonation Detection is now an emerging recruiting technology.
Gartner separates Candidate Impersonation Detection from broader Candidate Fraud Detection and Machine Candidates, rates the capability High benefit, and lists imper.ai as a Sample Vendor. Gartner also highlights the need to know that the person applying, interviewing and taking assessments remains the same person throughout the process.
Candidate impersonation detection FAQ
What is candidate impersonation detection?
Candidate impersonation detection evaluates whether the expected human is actually behind a hiring interaction. It can use device, network, location, environment, tooling and behavioral signals to identify proxy candidates, hidden operators and suspicious operating conditions during recruiting.
How is candidate impersonation detection different from broader candidate fraud detection?
Candidate fraud detection can cover application fraud, resume falsification, assessment cheating, synthetic identities and other recruiting abuse. imper.ai focuses on candidate impersonation: whether the expected human is actually behind the live interaction, and whether that remains true across interviews and into enrollment.
Does imper.ai replace background checks or identity verification?
No. Background checks, assessments and formal IDV answer different questions. imper.ai focuses on the live human and operating environment behind the candidate interaction and can coexist with those controls.
Does imper.ai change the recruiter workflow?
imper.ai is designed to preserve the normal recruiting process by integrating with ATS and interview scheduling workflows. In Workday, interview-stage orchestration can activate imper.ai silently when the candidate enters the Interview stage and conclude protection after the final interview stage.
Can imper.ai detect a different operator across interview rounds?
Yes. imper.ai can detect suspicious conditions in a first interaction without prior history, then correlate later interviews to identify material changes in device, network, location, remote-control state and operating environment.
Protect every interview inside the hiring workflow.
See how imper.ai adds candidate impersonation detection across your ATS, interview process and enrollment handoff while keeping the candidate and recruiter experience familiar.