Fake job applicants are becoming a genuine cyber security concern for UK businesses. A major UK bank reportedly received more than 700 suspicious applications for remote roles from candidates believed to be connected to North Korea.
The applicants appeared credible. They had polished CVs, gave convincing answers and seemed technically capable. However, unusual patterns in their applications suggested that fake identities and artificial intelligence were being used to make them appear legitimate.
It may sound like the plot of a spy film, but it highlights an important point: recruitment is now part of business cyber security.
What reportedly happened?
According to recent reporting, more than 700 suspicious candidates applied for remote positions at a major UK bank.
The applications were identified during the initial recruitment process by an AI recruitment platform. It reportedly noticed warning signs including repeated language, coordinated behaviour and location information that did not match the candidates’ claims.
The concern was that the applicants were not simply exaggerating their experience. They may have been part of an organised attempt to secure employment using false or stolen identities.
Once employed, a fraudulent remote worker could potentially receive:
- A company laptop
- An email account
- Access to internal systems
- Customer or employee information
- Confidential documents
- Software and company data
They may also receive a salary that is then transferred overseas.
This turns what appears to be an HR problem into a wider security, financial and compliance risk.
How is AI making fake applications more convincing?
People have lied on CVs for as long as CVs have existed. What has changed is the speed and scale at which convincing applications can now be created.
AI tools can help someone:
- Produce a professional CV in seconds
- Tailor an application to match a job description
- Create realistic profile photographs
- Write convincing answers to interview questions
- Improve their spoken or written English
- Alter voices or video during remote interviews
- Complete some technical assessments
One false applicant can therefore appear much more credible than they might have done a few years ago.
AI can also make it easier to submit large numbers of applications. Rather than carefully creating one fake profile, criminals can produce and manage many different identities at the same time.
Why would someone want a job inside your business?
Salary is one motivation, but it is not the only risk.
A fraudulent employee could attempt to gain access to sensitive information, intellectual property, financial details or customer data.
They could also create an opportunity for a future cyberattack by installing unauthorised software or retaining access to systems after leaving the business.
The possible risks include:
- Theft of company or customer information
- Unauthorised access to business systems
- Financial fraud
- Theft of intellectual property
- Malware or ransomware being introduced
- Damage to customer trust
- Legal or regulatory problems
Not every fraudulent applicant is part of an international operation. Some may simply be using a false identity, hiding their real location or misrepresenting their qualifications.
However, the security checks needed to identify them are largely the same.
Could smaller UK businesses be targeted?
It would be easy to assume this only affects banks, technology companies and large international organisations.
That would be a mistake.
Smaller businesses can be attractive targets because their recruitment and onboarding processes may be less formal. A growing company may be keen to fill a position quickly and may not have a dedicated HR or cyber security team.
Remote working has also made it normal to recruit, interview and onboard someone without meeting them in person.
This provides flexibility for legitimate employees, but it can also create opportunities for someone using a false identity.
Any business recruiting remote employees, contractors, software developers, finance staff or people with access to sensitive systems should take the risk seriously.
Warning signs during remote recruitment
No single warning sign proves that an applicant is fraudulent. However, several unusual details together should prompt further checks.
Potential warning signs include:
- The candidate repeatedly avoids a live video call
- Their appearance or voice changes between interviews
- Their location does not match the information provided
- Their answers sound rehearsed or strangely repetitive
- There are inconsistencies between their CV and interview answers
- They appear to receive help from someone off camera
- They ask for equipment to be sent to an unrelated address
- They insist on using unusual payment arrangements
- Their identity documents cannot be verified
- Their online history appears very recent or incomplete
Businesses should remain fair and avoid making assumptions based on someone’s accent, nationality or location. The aim is to verify identity and employment information consistently for every candidate.
How UK businesses can make recruitment safer
You do not need an expensive investigation team to improve your recruitment security.
A few sensible checks can make a significant difference.
Verify the person’s identity
Use a proper identity verification process and confirm that the candidate matches the documents provided.
Where appropriate, complete right-to-work checks and employment screening before giving the person access to business systems.
Include a live interview
Hold at least one live video interview. For sensitive or senior positions, consider meeting the candidate in person where practical.
Ask natural follow-up questions about their experience rather than relying entirely on prepared questions.
Check employment history
Confirm previous employment and contact referees using independently verified contact details.
Do not rely only on the telephone number or email address supplied by the candidate.
Involve IT before the employee starts
Your IT provider should know when someone is joining, what equipment they will receive and which systems they genuinely need.
New employees should not automatically receive access to everything.
Use limited access from day one
Give each person only the access required for their role.
For example, a new member of staff may not immediately need access to every customer folder, financial system or management document.
Access can be expanded when there is a genuine business need.
Secure company devices
Company laptops should be configured and protected before they are issued.
Security monitoring, multi-factor authentication, device encryption and software controls can help reduce the damage if an account or device is misused.
Have a clear offboarding process
Access should be removed promptly when an employee or contractor leaves.
This includes email accounts, cloud systems, remote access, shared passwords and company devices.
Recruitment and cyber security can no longer be separate
The main lesson from this story is not that every remote applicant should be treated with suspicion.
It is that hiring someone gives them a trusted position inside your organisation.
Recruitment checks, IT access and employee onboarding should therefore work together. HR may confirm who the person is, while IT controls what they can access and monitors company devices.
Neither process is as effective on its own.
AI is helping genuine applicants improve their CVs and prepare for interviews, which is not necessarily a problem. However, the same technology can also help dishonest applicants create much more convincing false identities.
UK businesses do not need to panic or stop recruiting remotely. They do need to make sure convenience has not replaced basic verification.
A careful recruitment process, secure onboarding and sensible access controls can allow businesses to benefit from remote working without opening the door to unnecessary risk.
