How to combat candidate fraud

Fraudulent job applications used to be an occasional headache. A year ago, most recruiting teams heard about a suspicious application every few weeks. Now it comes up every day.

At Recfest this year, it was the topic recruiters raised most unprompted. The flood of convincing-but-hollow applications, fake job applicants, and outright application fraud has become part of the regular volume. Most teams don't have a systematic way to deal with it. They're either manually reviewing everything or letting things through that shouldn't get past the first stage.

In episode 9 of the Pinpoint How-To Series, we walked through a layered approach to tackling this: a set of checks built into Pinpoint that make it significantly harder for fraudulent applications to survive, without adding friction for genuine candidates.

First: what do we actually mean by fraud?

It's a catch-all term that covers very different things, and the distinction matters for how you respond.

Positioning is a real candidate putting themselves in the best possible light. They've polished their resume, possibly tidied it with AI, and they're applying widely because the job market is hard right now. That's not a problem. What you need to do is validate what's real and test the skills behind it. The tools for that are the same ones covered below.

Noise is where most of what teams call fraud actually lives. Someone pasting your job description into a language model and generating responses. Someone applying to dozens of roles without tailoring anything. Bots submitting scripted mass applications. These are hollow, generic, and easy to spot once you're looking, but they make up the bulk of the volume problem. The goal here isn't to punish candidates; it's to clear them efficiently so genuine applications can surface.

Actual fraud (or application fraud, as it's sometimes called) is the smallest category and the fastest-growing. Candidates misrepresenting who they are: the same person applying under two different names, someone different showing up to the panel interview from who was on the screening call, a previous employer that has no online presence. Gartner predicts that by 2028, 1 in 4 candidate profiles worldwide could be fake, and in a survey of 3,000 candidates, 6% admitted to interview fraud. Organized schemes using stolen identities to place remote workers at large employers have already been prosecuted in the US.

The honest headline: most of what teams label as fraud is actually noise. Clear the noise and the actual fraud becomes much easier to spot. That's what the rest of this article is about.

The layered approach

There's no single filter that catches this. What works is a stack of checks, each one filtering a different type of problem. The framework I walked through runs across six layers, from the moment someone finds your jobs page through to offer and day one.

One principle runs through all of it: nothing here auto-rejects on an AI signal or a fraud flag. The only automatic rejections are rules you've set and can explain, like knockout question answers or application limits. Everything else routes a suspicious application to a human check. A real candidate clears that check in a few minutes. An application that isn't genuine either stops there or has to do real work for the first time.

Step 1: Lock the front door

Before anyone writes a word, there are settings that stop certain traffic from ever reaching you. Most teams have never touched them.

First, what's already there: every Pinpoint career site (including ones hosted on your own domain) sits behind a security layer that blocks automated junk and rate-limits submissions. Scripts can't fire 70 applications in 20 seconds. That's handled by default, with no setup required.

On top of that, there are three controls worth switching on:

1. Application caps. Limit how many of your jobs one person can apply to in a set window (four jobs in four weeks, for example). If you're a large employer with many simultaneous openings, you can adjust the number to fit. Contact Pinpoint support through the in-app chat to enable this and set the limit yourself.
2. Duplicate application handling. If someone applies to the same job twice, you can block the second submission or allow it through with a duplicate tag. That lets you see the pattern without automatically excluding anyone.
3. reCAPTCHA. When you're seeing a flood of applications that don't look like real people, Pinpoint support can switch on a verification step on your application form. Particularly useful for technical roles where bot submissions are common.

Setup: Contact Support to get these set up. You’ll find application caps and duplicate handling under Company > Preferences. Support can enable reCAPTCHA for you.

Step 2: Design your application form

Whatever gets past the front door lands on your application form. This is where most teams should spend the majority of their time, because the form is the only part of the process that controls what a candidate actually has to give you.

There are two types of question doing two very different jobs.

Knockout questions

Knockout questions are simple yes/no questions about genuine non-negotiables for the role. Their job is to clear applications that were never going to work, automatically and consistently, without anyone on your team reading each one.

Use these only for things that are genuinely black and white:

• Right to work / need for visa sponsorship
• Required license or certification
• Minimum years of experience in a specific technology
• Availability requirements (shift work, weekend availability)

Keep them to things you'd reject on anyway. The questions that work best are the ones where there's no judgment call: either someone has the right to work where the job is, or they don't.

One compliance note: If you're in the UK or EU, automatically rejecting candidates based on knockout question answers counts as an automated decision under data protection law. You'll need a line in your privacy notice and a mechanism for candidates to request a human review. Contact Pinpoint support for suggested wording.

Open-ended questions

Open-ended questions do different work. Their purpose isn't to clear volume: it's to raise the effort required to fake a convincing application. A genuine candidate can answer one of these questions in a few minutes because they've lived it. Someone applying to hundreds of roles with a copy-paste approach will give you something generic, and you'll be able to tell.

Two types work well:

A broad question: "Tell us why you'd be a great fit." A question like this is more revealing than it sounds. Most genuine candidates will answer it with something personal: their own story, their own spin, something specific to their experience. Others will feed your job description back to you through a language model. Both responses tell you something.

A specific "tell me about a time" question: "Describe a project where you built or owned something that depended on a third-party service. What went wrong on the vendor's side, and how did you handle it?" A question that specific can only be answered convincingly by someone who has actually done the work. It's also easy to follow up on in a call.

Match the question to the role: for sales, ask about a renewal that went sideways; for retail or hourly work, ask them to describe the busiest shift they've ever worked. Something they did, not something they could research.

Step 3: Automate the black-and-white decisions

Knockout questions work best when an automation runs behind them. Here's how to set it up.

When an application comes in, the automation checks the knockout answers. If a candidate answers incorrectly, it:

1. Tags the application with the specific reason (for example, "needs sponsorship" or "missing required certification")
2. Moves the application to Rejected
3. Sends a polite rejection email, delayed by two working days

The delay matters. Nobody likes being rejected instantly: it reads as automated and generates replies. A short delay keeps the experience more human.

Tag the reasons. This step is easy to skip and worth not skipping. If you're consistently rejecting a high proportion of applicants who need sponsorship, that's a signal to make the requirement clearer in the job advert itself. The tags give you that data over time.

Add internal alerts. Without a notification that an application has been flagged, a review stage fills up and sits unread. An internal email or task assigned to the right person keeps the system working in practice.

These automations are part of Pinpoint's advanced automations package. Register your interest.

Step 4: Use an AI field as a sniff test

Once automations have cleared the obvious cases, what's left is the gray area: applications that passed the knockouts but still don't feel quite right. This is where an AI field helps you decide where to look first.

Pinpoint already has an AI match score that answers "does this person have what the job needs?" This is a different question: does the application look like the candidate's own work?

You set this up using Pinpoint's Custom AI fields. Create a field (I call mine "Verification Check") and write instructions telling it to read the candidate's written answers, their resume, and the job description, then check for:

• Are the answers in the candidate's own words, or do they closely mirror the job description?
• Do the answers contain specifics: named tools, concrete examples, real numbers?
• Does what they describe match what's on their resume?

The field gives you a signal you can sort on. Filter high to low, and start your review with the applications that raised questions.

This is not an AI detector. It doesn't auto-reject anyone. It points out where you might want to dig in further. A real candidate who used AI to tidy their writing should score mid-range; someone who generated answers wholesale from your job description will score differently. That distinction is what you're calibrating for.

A note on fairness: This kind of check can produce misleading signals for non-native English speakers or candidates who write more formally. The field doesn't decide anything. It tells you where to look. Keep that distinction clear in how you use it, and make sure your prompt explicitly instructs the field not to penalize those groups.

Get the AI field prompt instructions

I offered to share the exact prompt instructions that were used for the Verification Check field during the session.

You can download the 3 prompt guide here.

Setup reminder: Scope the AI field to the specific job before saving. An unscoped field runs against every application in your account and generates cost across all of them. Check the cost preview dialog before you save.

Step 5: Add verification stages for the gray area

Applications that flagged in the AI field but aren't clear-cut rejections can be routed into a verification stage before moving to interview. This is where you ask the candidate to do something real.

Pinpoint lets you build custom stages directly in your hiring workflow. Three options that work well:

Written questions

Send candidates a short follow-up: two or three questions that you couldn't answer from the job description alone, but anyone who actually does this work would know immediately.

Ask them to name a tool or system they use day to day. Ask them to describe a specific project. These questions go out automatically when someone hits the stage.

Set a response deadline. I use five days, with a clear note in the outreach email that candidates should respond within three to stay in the running. People who are mass-applying, or who applied without genuine interest, typically don't respond. The ones who do respond quickly tend to be the ones who know the answer.

One-way video interview

A one-way video interview is a fast, low-effort way to verify you're dealing with a real person. Set it up with two short questions at one minute each, with one retake only. Enough time to recover from a stumble, but not enough to rehearse.

When you review responses, you can cross-reference against the candidate's LinkedIn profile. Do they match? Not a perfect check (deep fakes have been used in hiring contexts before), but it narrows the field significantly, and someone who won't record a video at all is telling you something.

Interested in setting up one-way video interviews in Pinpoint? Register your interest

Phone screen

Old-school, but the most effective of the three. This routes a notification to the recruiter to call the candidate and ask a few questions about their CV and the role. Not a full interview, just enough to confirm you're talking to someone who knows their own background.

Most genuine candidates will answer confidently in five minutes. Candidates who aren't who they claim to be tend to struggle with questions they should be able to answer from memory.

Step 6: Live interview, offer stage, and background checks

By the time a candidate reaches a live interview, the noise should be gone. What you're dealing with at this point is the small slice that was specifically built to get past a form and a video: organized fraud designed to clear standard checks.

For virtual interviews, a few things worth watching:

• Camera that stays off. There might be a legitimate reason, but it's worth noting as a signal.
• Audio out of sync with the video. A common tell for deep fakes.
• Location checks. If you know a candidate is based in a particular city, look up the weather there before the call. Mention casually that you heard it's been raining heavily there. If they don't correct you when the weather is actually fine, that's worth paying attention to.

On identity verification: You can request ID uploads in Pinpoint as a stage action, under additional information requests. Whether and when to do this depends on your jurisdiction. In the US, requesting ID before a conditional offer can create legal exposure, so run it past your legal counsel and data protection officer before enabling it.

Background checks are your most reliable backstop. Employment verification, education verification, identity checks: these catch almost everything that got through the earlier stages. All of this is available through Pinpoint's integrations. If a candidate can clear a thorough background check, the odds of genuine fraud are very low. This is your last line of defense, and it should rarely need to be used.

Close the loop: audit where your applications come from

One step that most teams skip: go back and look at where the rejected candidates came from.

In Pinpoint's Insights hub, you can break down applications by channel. If candidates you're tagging as fraudulent or low-quality are consistently coming from one job board, you have a few options:

• Turn off one-click apply for that channel
• Build an automation that routes any application from that source into an additional verification step automatically
• Remove the channel entirely if the signal-to-noise ratio is consistently poor

Channel is a legitimate filter to act on. You can wire this directly into your automation rules as a condition. This keeps your checks focused on the problem source rather than running heavy verification on every application across every channel.

Key takeaways

• Most of what teams call candidate fraud is actually noise: mass, low-effort applications that can be cleared with the right form design and automations. Clear the noise and the actual fraud stands out.
• A layered approach works better than any single check. Each step filters a different type of problem.
• Nothing here auto-rejects on an AI signal or subjective review. The only automatic rejections are rules you've set and can explain. Everything else routes to a human.
• Real candidates clear verification steps in minutes. Applications that aren't genuine either stop there or have to do real work for the first time, which is a useful filter in itself.
• The live interview and background checks are backstops, not first lines of defense. Build the process so most problems are caught before that point.

What to do this week

1. Check your front-door settings. Contact Pinpoint support to confirm whether application caps, duplicate handling, and reCAPTCHA are configured for your account.
2. Add one open-ended question to a live role. Make it specific enough that only someone who has actually done the work could answer it convincingly.
3. Set up your knockout question automation. Tag the reasons, not just the outcome. That data is how you improve your job ads over time.
4. Create a Verification Check AI field. Scope it to one role, run five real applications through it, and calibrate before rolling it out further. Use this prompt guide to get you started.

Want to add Advanced Automations?

The branching automations covered in this session (routing applications based on knockout answers, tagging by reason, scheduling rejection emails, and routing by channel) are part of Pinpoint's Advanced Automations package.

If you'd like to explore adding them to your plan, register your interest here and your Customer Success Manager will get in touch.

‍

Note: This work is accredited to Mike Bradshaw, VP of Talent at Pinpoint. The live webinar was hosted by Paul Simpson, Head of Customer Success, who stepped in at short notice. The recording features Paul rather than Mike.

‍