How to Spot Deep Fake Remote Workers
As technology advances, organizations are subject to increasingly sophisticated attacks targeting their data.
Millions of dollars are stolen from US companies yearly due to cyber and ransomware attacks, and that number keeps growing. Business leaders are well aware of the risk, and many are spending large sums trying to shield themselves from these attacks. The predicted IT security spending was expected to exceed $150 billion worldwide by 2021.
As businesses bolster their defenses, bad actors turn to new and emerging ways to penetrate the company's information security. Harnessing the power of artificial intelligence (AI), hackers have shown they can now generate what has been termed a "deep fake," an almost exact rendering of another individual. Deep fakes began as fake videos, but more recently have gone live — the most talked about incident perhaps being how a deep fake of the Kyiv mayor duped four mayors of European capitals over video calls.
Most companies know that a cyber attack is not a matter of if but when, so being prepared to respond is key to limiting the extent of the damages. While there is a strong focus on hacking and identity theft, the threat of deep fakes in the remote work environment is growing.
What Are Deep Fake Remote Workers?
Deep fake remote workers are fake personalities that take on a real role with a company. The motivation for setting up a fake profile and going through the process of getting hired by a company can vary. Some IT experts believe the reason connects to the position. Many positions have access to sensitive information, so criminals might want access to that information or other valuable data. Or they might just want to commit common theft.
In the US, the FBI has found that some companies were unknowingly hiring IT staff from North Korea. These candidates were lying about their location and identity to gain access to sensitive information. Such fraud can lead to significant financial losses. The company is paying wages to a remote worker who is not completing work, and they are falling victim to theft of such magnitude that it can cripple the business. About 60% of small businesses will fold within six months of a data breach.
In addition to financial considerations, the FBI warned that any company hiring staff from North Korea may be exposing themselves to legal consequences for sanction violations. Those are big incentives for companies to be wary not to fall into the trap.
Related Article: It's Time to Re-evaluate Your Cybersecurity Strategy
How to Spot Fake Remote Workers
There are several ways to help companies spot fake remote workers, but eliminating the risk from the start is key. Here are five measures HR leaders can take during the application process:
1. Video Glitches
First, understand that deep fake candidates are trying to be increasingly sophisticated. They will most likely steal a real person's identity to legitimize their application, so a Google search for a particular individual may not be the best way to verify the information.
However, these bad actors often rely on software that hasn't yet reached the level of sophistication where voice and images are synchronized. Grayson Milbourne, security intelligence director at OpenText Security Solutions, said hiring managers should be on the lookout for suspicious cues in video interviews where the video doesn't align with the audio. Blinking may also be another tail-tale sign.
"Researchers from the United States made the discovery in 2018 that deep fake faces do not blink regularly. It should not come as a surprise that this happened because the majority of photos show people with their eyes open; hence, computer programs never actually learn about blinking," said Antoine Boquen, CEO and co-founder of hiring firm New Horizons Global Partners.
If you notice any of these signs, try re-scheduling the interview or consider rejecting the candidate altogether.
2. Plagiarism
Most deep fakes won't create a unique resume. They will most likely have stolen a qualified candidate's resume or sample work to add credibility and boost the chances of being retained. But they may also piece together different profiles to create an even better one.
In most cases, recruiters and HR leaders will be able to find these online using free software. Therefore, a quick plagiarism analysis can determine whether the work is from the candidate or someone else.
Learning Opportunities
Related Article: A Zero Trust Security Primer
3. Background Checks
Many companies conduct background checks on candidates. These checks can include whether a candidate has graduated from the university mentioned in the resume or worked for the organizations they listed.
In late June, the FBI issued a public service announcement stating that pre-employment background checks helped discover that the personally identifiable information (PII) given by some of the deep fake applicants belonged to another individual.
This step is critical in the process of risk management, particularly for remote positions in IT, where individuals have access to the company's network.
4. Social Media
Many deep fakes will try to create a digital footprint online before applying for a position. Once again, this serves to build credibility in the recruiting process.
A report by Stanford Internet Observatory found that LinkedIn has thousands of fake profiles for virtual employees, so making these profiles is not challenging. There are several ways for recruiters and HR leaders to spot a fake social media profile. These include:
- The profile was recently created and only contains a handful of often generic photos.
- The candidate's friends and connections aren't real people.
- There is limited profile information, such as updates, news or location.
Related Article: End of Year Incidents Remind Us of Our Corporate IT Vulnerabilities
5. Gut Instinct
A candidate might seem too good to be true on paper, and that should be a warning sign, especially if that is paired with other cues that something is not right. These cues can be just about anything, from how the person talks of past experiences, speech mannerisms, how they're only available at certain times or with plenty of prior notice.
Any sign can insinuate there is something wrong with the candidate. Trusting that instinct might be the right call. Studies have shown business managers who trust their gut instinct are often 20% more accurate than those who don't.
So, if you have a bad feeling about someone, it may be best to let go of a candidate. The person may not be a deep fake, but there may be other issues emerging down the line. Extending the hiring process is better than hiring the wrong person, let alone a fake candidate, and suffering the adverse financial consequences.
About the Author
Kaya Ismail is a business software journalist and commentator with years of experience in the CMS industry.
Featured Research
Research Report
Read Now
eBook
Read Now
Guide
Read Now
Guide
Read Now
Research Report
Read Now
Buyer's Guide
Read Now
Infographic
Read Now
White Paper
Read Now
Related Stories
Smarter Experiences Win — Learn from Today's Leaders
