Do you really know who is on your payroll? | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

Deepfake employees are becoming the next major cybersecurity challenge

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

When was the last time you met your newest hire in person?

For many organizations, particularly those operating remotely, the answer is increasingly never. With one in five companies worldwide adopting a fully remote model, hiring virtually has become increasingly popular, enabling businesses to access global talent pools and scale faster than ever before.

But in removing geography as a constraint, it has also stripped away one of the most fundamental layers of trust: the ability to verify, face-to-face, who you are actually employing.

This shift is giving rise to a new and largely under-recognized threat, the “deepfake employee”, where threat actors use synthetic identities, voice cloning, and real-time deepfake video to pass interviews and secure legitimate employment.

Accelerated by advancements in AI, it is now possible to create convincing digital personas at scale, lowering the barrier to entry for fraud and enabling highly organized operations to target corporate hiring pipelines.

The next identity frontier: Verified workforce and the rise of agentic trust

How identity fraud became the threat that never sleeps

Why proving personhood is the new standard for identity verification

In practice, these attacks can be surprisingly difficult to detect. A candidate may appear on a video interview with a natural-looking face and voice, answer questions fluently, and provide what seem to be legitimate credentials. Behind the scenes, however, AI tools can subtly alter facial expressions, sync lip movements to a cloned voice, or even feed real-time responses.

To the hiring manager, there is little reason to suspect anything is wrong. The deception often only becomes apparent much later, if at all, when activity inside the organization begins to raise concerns.

This risk is already playing out in the real world. In a recent experiment, a cybersecurity expert used AI to create deepfake personas – one a white man similar to himself and another of an Asian woman, and successfully secured two separate tech roles, beating hundreds of other candidates.

Using AI-generated credentials, real-time voice modulation and live deepfake video, both synthetic identities progressed through interview stages undetected, with employers unaware they were interacting with an entirely fabricated candidate.

Cloudflare’s latest threat research highlights the scale and sophistication of this activity. Organized “remote worker” fraud operations are using fabricated identities, deepfake-assisted interviews and remote access “laptop farms” to infiltrate payrolls. In some cases, multiple individuals operate behind a single employee identity, maintaining persistent access while appearing as one consistent, legitimate user.

Voice is the next cybersecurity battleground, and AI is accelerating the risk

‘A candidate who was hostile from day one never produces that baseline’: Nation states spies applying for legit jobs are hard to spot

Why traditional security checks are failing in the age of AI-driven fraud

Once hired, these actors are no longer external attackers. They become insider threats with valid credentials, company-issued devices and trusted access to systems. As Cloudflare notes, by the time these individuals are identified, they are already operating inside the perimeter, often blending in with normal business activity.

With nearly 60% of organizations having experienced deepfake-driven incidents, and 48% reporting damage from AI-generated impersonation or misinformation, it is clear that identity infrastructure has become a primary attack surface. Attackers are shifting away from “breaking in” to “logging in” using legitimate credentials obtained through deception.

At the heat of this issue is the flawed assumption that identity can be verified once and then trusted indefinitely.

Accounts can be shared, credentials can be compromised, and even live video can be manipulated.

This creates a critical vulnerability at the point of hire. A candidate may present documentation, pass background checks and complete onboarding, but in a world of synthetic identities, that initial verification is no longer enough.

To address this challenge, organizations need to move beyond static identity checks and towards continuous identity verification. This means verifying not only who someone is who they say they are and that they are a real human at the point of hire, but ensuring that the same individual remains present and authentic throughout their interactions with the organization.

The strongest form of defense lies in continuous biometric verification of the user’s identity. Rather than relying on a single factor, such as facial recognition or voice authentication alone, fused biometrics combines multiple identity signals, such as facial characteristics, voice patterns and behavioral cues, into a single, layered verification process, verifying directly that a real, live human is there.

It is no longer enough to confirm a person’s identity at a single moment in time. Organizations need confidence that the same individual is consistently present across every critical interaction, from interviews and onboarding, through to system access and sensitive transactions. Without this continuity, identities can be shared, replaced or hijacked without detection.

Fused biometric verification can create layered validation that is significantly harder to replicate or manipulate, enabling it to detect and block attempts to impersonate users through synthetic voices, deepfakes, or recorded audio and video.

While a single modality might be fooled by a sophisticated synthetic input, combining biometric modalities; facial recognition, voice recognition, and speech pattern recognition, it becomes significantly harder for fraudsters to mimic an identity.

Advanced biometric verification technologies are trained on large datasets of both genuine and synthetic voice samples, enabling them to recognize subtle acoustic differences between natural and deepfake voices. This helps organizations detect voice-cloning attempts, even when the audio sounds convincing to human listeners.

Crucially, fused biometric verification can operate passively in the background, consistently verifying that the right person is accessing systems, enabling smoother, lower-friction experiences and reduces the need for frustrating repeated verification attempts.

As organizations continue to embrace remote work and digital-first operations, cybercriminals will increasingly find new vulnerabilities to exploit. The question is no longer just how to keep threats out, but also how to ensure that those already inside are truly who they claim to be.

In a world where identities can be fabricated, cloned and manipulated with ease, trust cannot remain static. It must be continuously proven.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

Xiaomi’s debut full-size hybrid SUV can cover 314 electric miles before it touches a drop of gasoline

The Shards review: Ryan Murphy and Bret Easton Ellis are a match made in heaven in Hulu's stylish, blood-soaked new show about privileged teenagers stalked by a serial killer

'Enemy rags do not remain on Ukrainian soil for long': Ukrainian forces destroy Russian flag 30 seconds after it was dropped by a drone

The best dual-zone air fryers — convenient, multi-component cooking for a crowd

Can Chat GPT really replace your apps? I tried using the chatbot for 12 everyday tasks on my phone — here’s what happened

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards