Candidate dishonesty: Key red flags

You spot red flags in candidates by comparing claims against evidence: what the resume says, what the person says out loud, and what they can actually do when asked to do it. Most dishonesty shows up as a gap between those three, not as one dramatic lie.

That used to be a judgement call. It is now partly a security problem. Hiring teams are dealing with inflated job titles in one pile and organised identity fraud in the other, and the two need different responses.

TL;DR

• Treat a single warning sign as a question to ask, not a verdict. Clusters are what matter.
• Resume lies concentrate in four places: employment dates, job titles, education, and skill lists.
• Interview dishonesty sounds like confidence without specifics. Ask for the number, the name, the date.
• Remote hiring added a new category: proxy test takers, AI answer scripts, and deepfaked video.
• Only three in five employers run identity checks, so the gap is usually process, not perception.
• Verify with evidence you control (skills assessments, proctoring, reference assessments) rather than with gut feel.

How do you start identifying red flags in candidates?

Start by writing down what the role genuinely requires, then check each claim against something you can verify. A red flag is a mismatch between a claim and the evidence, not a personality trait you dislike. Nervousness is not dishonesty. A story that changes twice is.

The practical order matters. Screen the resume for internal contradictions first, because that is the cheapest check. Then use the interview to test the two or three claims that would most change your decision. Then verify the skills that the job actually turns on, with work rather than conversation. By the time you reach references, you want to be confirming a picture, not building one.

This is where most hiring loops leak. Teams run the sequence in reverse: they fall for a strong interview, then look for reasons to justify it. A good rule is to decide before the first call which two claims you will insist on proving. Write them down. If a candidate cannot back either one, that is your signal, and it arrives early enough to be cheap.

There is a fairness side to this too. Hiring on suspicion is both unpleasant and legally risky, so the goal is a process that applies the same checks to everyone, in the same order, with the same evidence standard. Consistency is what turns a hunch into a defensible decision.

What makes a candidate dishonest?

A dishonest candidate misrepresents something a hiring decision depends on: what they did, what they can do, or who they are. Exaggeration sits at one end, identity fraud at the other, and the distance between them is the whole reason you need two different playbooks.

The scale is not trivial. In an Equifax survey of 254 HR professionals reported by HR Dive in August 2025, 71% said they had already encountered fake or misleading candidate details, while only one in five felt very confident they could spot them. That gap, between how often it happens and how well anyone catches it, is the real problem.

It helps to sort dishonesty by what it costs you:

• Inflation. A stretched title, a rounded-up date, a skill learned once and listed as a strength. Common, usually recoverable, and often caught by one follow-up question.
• Fabrication. A job that never happened, a degree never earned, a reference who is actually a friend. This changes the hire, and it needs verification, not conversation.
• Substitution. Someone else sits the assessment, answers the questions, or appears on camera. The person you evaluated is not the person you hire.
• Identity fraud. A constructed persona built on stolen documents, aimed at the access the job comes with rather than the job itself.

The first two are hiring problems. The second two are security problems that arrive dressed as hiring problems, which is exactly why they slip through a process designed only to assess skill.

One caveat worth holding onto: plenty of resume padding is the job market talking, not a character flaw. A candidate who describes a six-month contract as a year because the gap scared them is not the same risk as someone running a stolen identity. Treat them differently, or you will reject good people and keep the dangerous ones.

What are the resume red flags to watch for?

Resumes are where most dishonesty starts, because they are the only part of the process the candidate controls completely. HireRight's Global Benchmark Report, a survey of 1,000 HR, risk and talent professionals covered by Personnel Today in June 2025, found discrepancies clustered in past employment details (64%) and education credentials (47%), with almost two in five respondents finding at least one discrepancy per 20 candidates screened, and 13% finding one per five.

Common red flags that a candidate lied on their resume

Five patterns do most of the work. Employment dates that overlap or leave an unexplained gap. A title that outranks the responsibilities described under it. Education or certificates with no issuing body you can contact. Skill lists so long that no one person could be current in all of them. And a public profile that tells a different story from the document in your hand.

Job history that does not add up

Overlapping dates are sometimes honest (contract work, a notice period, a side project), so ask before you conclude. What should concern you is a candidate who cannot explain their own timeline without changing it. Ask for months, not years. A resume that lists only years is often hiding a gap of several months on either side.

Titles that look inflated

"Project Manager" covering work that was really coordination is the classic version. The tell is not the title, it is the answer when you ask who approved the budget, who reported to them, and what they decided alone. Seniority leaves a trail of decisions. If the trail is missing, the title was decoration.

Skill lists that look unrealistic

A resume naming fourteen tools is making a claim about depth it cannot support. Pick the two the role depends on and ask for something specific: the last problem they solved with it, the version they used, what they would do differently. Honest candidates get more specific under pressure. The pattern to watch for is someone who gets vaguer.

Education that cannot be checked

Fake degrees and bought certificates are more common than most teams assume, and they are also the easiest category to settle, because registrars exist. Confirm education through background screening rather than by reading the PDF a candidate sent you. Mismatched fonts, a blurry seal, a programme name that does not match the institution's catalogue: all worth a phone call.

Pro Tip: Do not interrogate the resume in the interview. Pick the two claims that would change your decision and ask about those in detail. You will learn more from two deep questions than from ten shallow ones, and the candidate will not spend the call feeling accused.

What interview behaviors signal dishonesty?

The interview is where a resume meets follow-up questions, and dishonesty tends to show up as a pattern rather than a moment. One vague answer means nothing. Three vague answers about the three things you most needed to verify is a signal.

1. Answers that avoid the specific question

Ask "what was your role on that project?" and a dishonest answer sounds busy without being clear: involved in many parts, fast-paced environment, worked closely with the team. No task, no decision, no number. Honest candidates answer small questions with small, checkable facts.

2. A story that changes

Ask the same thing twice, twenty minutes apart, phrased differently. Team sizes drift. Dates move. Results grow. People misremember details, so a minor wobble is normal. A story whose core facts reorganise themselves is not.

3. Rehearsed delivery that breaks under a new question

Watch what happens when you leave the script. A candidate who is fluent on the expected questions and suddenly halting on an unexpected one may be reading, coached, or assisted. This is the tell that matters most in remote interviews, and it is worth deliberately engineering: change the order of your questions, then ask one thing nobody prepares for.

4. Deflecting every mistake

A candidate who has never got anything wrong is telling you something. It may be dishonesty, or it may be fear of the question. Ask what they would do differently, and give them room to answer honestly. The ones who cannot name a single thing are usually managing an image rather than describing a career.

5. No real interest in the work

Questions only about salary and time off are not proof of dishonesty, and treating them that way is unfair. But a candidate who cannot say what the role involves has not engaged with it, and that is worth knowing before an offer. A structured culture fit assessment is a fairer way to read motivation than reading a room.

Body language deserves a warning of its own. Avoiding eye contact is a terrible lie detector. It tracks nerves, neurodivergence, cultural norms and bad webcams far more reliably than it tracks deception. Weigh what a candidate says and whether it holds up, not how comfortable they look saying it. More interview warning signs are worth reviewing before you build your question set.

Pro Tip: Score each answer against the claim it was meant to prove, during the call, in writing. A scorecard filled in afterwards becomes a record of your impression. One filled in live becomes evidence.

What are the top candidate fraud red flags?

Remote hiring made the process faster and the evidence thinner. In a live room, you know who sat the assessment. Over a video call, that is now a claim rather than a fact, and the fraud that exploits it has its own warning signs.

Camera excuses that only happen at the wrong moment

A broken camera in the screening call and a working one in the offer conversation is a pattern. So is a candidate who joins on video but keeps a heavy filter or virtual background running. Ask for a simple live action: turn your head, hold up a hand, read a line off the screen. A pre-recorded or synthetic feed handles this badly.

Audio and video that do not quite line up

The FBI's Internet Crime Complaint Center flagged this in a June 2022 public service announcement about deepfakes and stolen personal information being used to apply for remote positions: complainants described lip movements that did not match the audio, and coughs and sneezes that landed out of sync with what they were watching. The same tell caught a fake candidate at a security firm in 2025, where a recruiter noticed the applicant's facial expressions were slightly out of sync with his words.

Assessment behaviour that does not match interview behaviour

A candidate who scores in the top band on an unsupervised assessment and then cannot explain their own approach is the clearest signal in the set. It is also the one most teams never see, because the two stages are reviewed by different people and never compared. Put the score and the conversation side by side.

Answers that arrive in the wrong register

AI-assisted answers tend to be well structured, generic, and oddly complete. They explain the concept rather than the candidate's own work. The fix is not to ban the tools, it is to ask questions that only the person who did the work can answer: what broke, who pushed back, what you would skip next time.

None of this is a reason to treat remote hiring as suspect by default. It is a reason to put the controls where the evidence is thin, which is usually the unsupervised assessment and the first video call. Recruitment fraud carries financial and brand risk well beyond a single bad hire, which is why it is worth designing for rather than reacting to.

What are the red flags for fake candidates?

A fake candidate is not an exaggerating one. It is a constructed identity applying for the access the role carries, and the economics behind it are now well documented. Gartner has forecast that by 2028, 1 in 4 candidate profiles worldwide could be fake, and its survey of 3,000 candidates found 6% admitted taking part in interview fraud, either by posing as someone else or having someone pose as them.

The criminal version is specific. In January 2025 the US Justice Department indicted two North Korean nationals and three facilitators over a scheme that ran from approximately April 2018 through August 2024, obtained work from at least 64 US companies using forged and stolen identity documents, and generated at least $866,255 from payments by ten of them. Company laptops were shipped to addresses in the United States and fitted with remote access software, so the work looked local while the worker was not.

What that pattern looks like from the hiring side:

• A candidate whose documents, name and public history do not reconcile across any two sources.
• A request to ship equipment to an address that is not the one on file, or to change it late in onboarding.
• Remote-only insistence for a role where a single in-person step is normal, paired with reluctance to verify identity.
• Referees reachable only on a personal email or a phone number the candidate supplied.
• Unusual interest in system access, admin rights or customer data during interviews for a role that does not need them.

The honest answer on prevention is that this is not a hiring-team problem alone. Identity verification, device shipping and access provisioning sit across HR, IT and security, and the schemes above worked because nobody owned the seam between them. If your process cannot say who confirmed that the person onboarding is the person interviewed, that is the gap to close first. Our guide to stopping employment fraud covers the controls in more detail.

The verification gap is measurable. In that same HireRight survey, only three in five respondents globally said their company ran identity checks as part of pre-employment screening, and one in six said their business had already experienced ID fraud during hiring.

What should you do when a candidate lies?

Confirm it, size it, then decide once. The most common mistake is reacting at the moment of discovery, when the only information you have is that something does not match. The second most common is doing nothing because the candidate is otherwise strong.

A workable sequence:

1. Confirm the discrepancy from a second source. A date that does not match is sometimes your note-taking, not their lie. Check the original document, the verification report, or the public record before you treat it as fact.
2. Give the candidate one clear chance to explain. Describe what you found, name the specific gap, and ask directly. Honest explanations tend to arrive fast and with detail. Evasive ones expand.
3. Size it against the role. A rounded-up employment date on a marketing hire is not a falsified licence on a safety-critical one. Ask whether the misrepresentation touches something the job actually depends on.
4. Separate inflation from fabrication from identity. Inflation is usually a conversation. Fabrication usually ends the process. A suspected identity issue goes to security, not to a hiring debate.
5. Write down the decision and why. Record the discrepancy, the explanation, the standard you applied, and the outcome. This is what makes the decision defensible later, and what keeps it consistent across candidates.
6. Fix the hole it came through. If a lie reached the final round, your process let it. Add the check that would have caught it at the stage where it was cheapest.

Two edges worth naming. First, rescinding an offer or ending employment over a resume misrepresentation has legal and contractual consequences that vary by jurisdiction, so involve whoever owns employment law at your company before you act, not after. Second, proportionality protects you. A team that fires people over trivia will stop reporting discrepancies, and then you lose the signal entirely.

How does Testlify help you spot red flags early?

Most of what is written above is a verification problem, and verification is the part Testlify is built for. The relevant idea is the Testlify Assessment Integrity Framework: protect assessment validity through identity checks, proctoring controls, AI assistance detection, suspicious-behaviour signals and reviewable evidence, while final judgement stays with the hiring team. Flags surface context. People decide.

In practice, that means a claim gets tested rather than discussed. If a candidate lists advanced spreadsheet work, an Excel assessment settles it in 20 minutes. Role-based skills assessments cover coding, cognitive ability, personality, situational judgement and software skills, so the evidence matches the job rather than the resume.

On the interview side, AI video interviews run one-way or as a two-way conversation, with audio questions as a lighter option, selectable AI avatars and voices, custom prompts, attempt and recording-time limits, 150+ interview templates, and automatic multilingual transcripts. Auto-scoring is a first pass that a human can override, which is the correct order for anything this consequential. Video violation detection watches for the webcam being off, no face detected, or multiple faces appearing. One boundary to be clear about: Testlify does not schedule live human interview panels, so calendar coordination stays wherever it lives today.

The proctoring controls are where substitution gets expensive. Three presets (Standard, Strict, Custom) cover photo ID verification with a face match against the document, periodic webcam snapshots, multiple-face and different-person detection, full-screen enforcement, tab-switch and copy-paste tracking, multi-monitor restriction, and AI-tool and browser-extension detection. Dual-device proctoring turns the candidate's phone into a second camera positioned to capture both the person and their screen, and it is a hard gate: the assessment will not start until mobile monitoring is active.

Results come back as a three-tier flag rather than a verdict. Green means the session followed the rules. Yellow means something was not ideal and a quick manual review is recommended. Red means cheating was confirmed. Auto-termination exists but is opt-in, with a threshold the recruiter sets, so a flag never rejects anyone on its own. Face verification data is deleted after 30 days and candidates can withdraw consent at any time, which matters when you are asking people to be filmed.

One honest constraint: assessments run on Chromium desktop browsers, and the mobile app is a capture fallback rather than a way to sit a full assessment on a phone. Worth knowing before you promise candidates anything about devices.

Where to focus in your next hiring cycle

Pick the single stage where your process currently takes a claim on trust, and put evidence there instead. For most teams that is the unsupervised assessment, the first video call, or the handover into onboarding where nobody re-checks that the person starting is the person hired. One control at the thinnest point beats a checklist nobody has time to run.

If you want to see how identity checks, proctoring and skills evidence fit together in one screening flow, book a demo and bring a role you are hiring for now.

Frequently asked questions (FAQs)