Deepfakes Reportedly Deployed in Online Interviews for Remote Work Positions

Voice and video deepfakes were reported by FBI Internet Crime Complaint Center (IC3) in complaint reports to have been deployed during online interviews of the candidates for remote-work positions.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves malicious actors using synthetic media (deepfakes) to impersonate job applicants for fraudulent employment and unauthorized access to corporate systems, which constitutes fraud and targeted manipulation.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The fraudulent applications relied on stolen personally identifiable information (PII) of real individuals to bypass background checks.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors who intentionally utilized post-deployment deepfake technology and stolen PII to deceive employers during remote job interviews.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The report describes the use of AI-generated content such as deepfakes, which are subject to transparency obligations under the Act to ensure users are aware they are interacting with synthetic media.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: unknown
• Alleged deployer: unknown
• Alleged harmed parties: interviewers of remote-work positions, employers of remote-work positions

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the report describes the creation and use of deepfake video and voice spoofing technology to deceive employers.

Directly caused: Malicious actors created deepfake videos and voice recordings to impersonate job applicants during online interviews.

Inferred additional harm: Numerous deepfake profiles and video/audio streams were generated to target multiple remote employers.

Privacy

Reported: Yes, the report explicitly mentions the use of stolen Personally Identifiable Information (PII) to apply for positions.

Directly caused: Stolen PII of real individuals was used to pass pre-employment background checks.

Indirectly caused: Successful applicants gained unauthorized access to corporate databases containing customer PII and proprietary information.

Inferred additional harm: An unknown number of individuals had their personal data compromised and exploited, exposing them to identity theft and further privacy violations.

Epistemic

Reported: Yes, the report describes the use of deepfakes to fabricate applicant identities and visual/auditory presence during interviews.

Directly caused: Deepfake video and voice spoofing were used to mislead interviewers into believing they were speaking with a legitimate candidate.

Inferred additional harm: The widespread use of deepfakes in hiring processes erodes trust in remote verification and online communication channels.

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 50

Potential causes

Technology

• Voice Spoofing: Voice deepfakes are used to spoof applicant audio during live interviews.
• Deepfake Video Manipulation: Altered video misrepresents the applicant's identity and live actions.

Data Inputs

• Stolen PII: Stolen personal data is used to bypass initial identity verification.

Human Factors

• Delayed Detection by Interviewer: Interviewers fail to immediately spot audio-visual synchronization issues.

Process and Methods

• Remote-Only Interviewing: Virtual interview processes lack physical verification of applicant identity.
• Insufficient Background Checks: Pre-employment checks fail to detect stolen identities early in the process.

Information quality

• Classification confidence: High
• Reason for confidence: The FBI PSA provides clear, authoritative details on the methodology of the fraud, specifically identifying the use of deepfakes and stolen PII. While specific statistics on victims and financial losses are not quantified, the nature of the AI safety risk and its classification under the taxonomies is highly unambiguous.
• Ambiguities identified: The report does not specify the exact deepfake software used, the number of complaints received, or the specific companies targeted.
• Alternative interpretations: The incident could be viewed primarily as a traditional cybersecurity/identity theft issue, but the central role of synthetic media (deepfakes) to bypass human verification makes it an AI safety incident.

FBI warning highlights malicious actors using deepfakes and stolen PII to secure remote IT and programming positions, gaining unauthorized access to corporate databases, financial data, and proprietary information. While representing an innovative fraud vector, the national security impact remains minor and manageable through standard corporate security and identity verification protocols.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Near-term. Represents a growing trend of remote work fraud requiring active monitoring and updated corporate verification procedures.
• Autonomy: Human-controlled. The deepfake technology was directly controlled and deployed by human malicious actors to generate specific synthetic media during interviews.
• Novelty: Evolved capability. Represents a significant adaptation of deepfake technology, moving from passive media generation to real-time interactive deception.

Impact by dimension

• Physical security: Negligible. No physical infrastructure or human safety threats were reported; the incident is limited to remote corporate recruitment fraud.
• Information security: Minor. Use of deepfakes to bypass identity checks and access corporate databases, but lacks evidence of state-sponsored intelligence compromise or mass disinformation.
• Sovereignty: Negligible. The incident targeted private corporate job positions and did not impact government operations, elections, or state sovereignty.
• Economic security: Minor. Threatens corporate financial and proprietary data, but impacts are manageable within standard security procedures and do not threaten national-level economic stability.
• Societal stability: Minor. Involves identity theft affecting individuals whose PII was stolen, but does not represent population-scale social manipulation or systemic civil rights violations.