The placement looked flawless.
A warehouse supervisor with eight years on the tools, a tidy CV, and a confident video interview in which they answered every question about high-risk work conditions with ease.
Passport details cleared a work-rights check. Two referees spoke warmly. They even signed the contract via their phone that very evening.
But the person who turned up on site Monday had a different face.
While this scenario may strike you as a worst-case hypothetical, parts of it are already happening in Australia. And the scary part is that none of the safeguards actually "failed."
Every check did what it was designed to do. None of them confirmed the person was who they claimed to be.
That is a ghost candidate – someone whose identity, credentials, or presence in the hiring process isn’t genuine. It might be a borrowed identity, a stand-in at interview, or a profile that doesn’t belong to a real person at all.
How common is candidate fraud in Australia?
For a long time, candidate fraud meant a padded CV or an overstated qualification. The data now points to something more serious.
According to a survey conducted by YouGov, 34% of Australian organisations with 500 or more employees reported discovering identity fraud in 2025. 19% caught it before hire – during recruitment or pre-employment screening – while 10% only uncovered deception later down the line through rescreening or ongoing monitoring.
The latter figure deserves a second look because it describes fraud that managed to clear every pre-hire check and was only detected when someone took the initiative to keep looking.
The global picture is similar: Gartner surveyed 3,000 job candidates in 2025 and found 6% admitted to interview fraud – either posing as someone else or having someone else pose as them.
Gartner also predicts that by 2028, one in four candidate profiles worldwide will be fake. The forecast concerns profiles rather than people in interview chairs, but the direction of travel is hard to argue with.
RELATED: The Most Dangerous Payroll Errors Are The Ones That Look Normal
Why are recruitment agencies more exposed?
Every employer is exposed to this, but recruitment and labour hire agencies are more exposed given their business models.
Speed is a large part of what clients pay for. A client may need six pickers by Thursday, and the agency that fills the order first usually keeps the account.
Volume only compounds the pressure – dozens of new starters a week, many of them casual, many screened by phone or video, and a decent share who may never meet a consultant face-to-face before they set foot on a client's site.
High volume, limited screening, and tight deadlines are exactly the conditions that make fraud easier to miss.
Then there's the question of who carries the consequences. The agency is usually the legal employer, often the licence holder, and always the party the client trusted to send a verified person. Australian migration law imposes significant penalties for unlawfully employing or referring non-citizens for work, with penalties varying depending on the breach and potentially applying per worker.
Alongside the offences for allowing an unlawful non-citizen to work, or to work in breach of a visa condition, there are separate contraventions for referring an unlawful non-citizen for work – or a visa holder for work that breaches their conditions – as vSure's summary of the employer sanctions regime sets out.
Civil penalties for companies run into the hundreds of thousands per contravention, and they apply per worker. Those penalties were substantially strengthened when the Migration Amendment (Strengthening Employer Compliance) Act 2024 officially took effect on 1 July 2024.
Beyond the legal exposure sits the commercial aspect – an agency that places someone who isn't who they claimed to be has handed its client a safety, security, and reputational problem with the agency's name on it.
What are the main types of fake candidates?
"Fake candidate" covers a surprisingly wide spectrum, and the right response depends on which kind you’re dealing with
At the mildest end is the embellished candidate: a real person whose AI-polished CV overstates their experience. Irritating, sometimes costly, though usually caught by a competent interview or a reference call.
The next step up involves doctored credentials. Workplace Health and Safety Queensland has begun referring licence fraud to police, with five high-risk work licence holders charged across 14 offences including fraud and forgery, and white card fraud also under referral.
In Western Australia, WorkSafe has warned about licences being altered to add classes of high-risk work for which the holder was never trained. If an agency places forklift drivers, riggers, or crane operators, a forged ticket carries consequences far beyond a bad hire.
Then comes the borrowed identity: wherein a genuine passport, licence, and visa belonging to one person is presented by another. Every document is authentic, which is what makes it hard to catch.
Then there are proxy interviewees, where a person sits the interview and someone else turns up for the shift. This is where Gartner's 6% figure sits.
At the furthest end is the synthetic identity. Researchers at Palo Alto Networks' Unit 42 showed that a person with no image-editing experience and a five-year-old computer could build a deepfake identity for job interviews in 70 minutes, then reappear as a brand-new candidate with a change of wardrobe and background.
Australian recruitment commentator Ross Clennett documented the case of a US security company that discovered its newly hired remote engineer was a North Korean national using a stolen identity and an AI-enhanced photograph.
Remote technology roles have been a prominent target in reported cases of sophisticated candidate identity fraud.
Why don’t standard pre-employment checks check it?
Almost every standard pre-employment check verifies a record as intended – though almost none of them verifies that the record in question actually belongs to the person in front of you.
Take work rights, for example. An agency running a VEVO check enters a passport number, date of birth, and country of issue; then Home Affairs returns the visa attached to that passport, along with its conditions.
It's an essential check, and regular rechecks matter too – but keep in mind VEVO answers the question, "What is this passport holder allowed to do?" It has no way of knowing whether the person who supplied those details is the passport holder.
Identity documents run into the same wall.
The government's Document Verification Service checks whether the details on a passport or driver licence match the issuing agency's record, which makes counterfeit documents far harder to use.
A genuine licence lent by, say, a cousin passes cleanly. The companion Face Verification Service, which compares a person's photo against the image on their identity document, is the piece that would close the gap – yet for now, it remains limited to Australian Government agencies, with private-sector access flagged for the future under strict conditions of consent and oversight.
Licence registers, reference calls, and video interviews share the same blind spot.
A register confirms a licence number is valid; WorkSafe WA has found valid numbers attached to someone else entirely. A referee is only as independent as the phone number the candidate supplied. And a video call used to feel like it settled the matter… right up until real-time deepfakes made a face on a screen equally easy to forge.
The weak point, in other words, is the binding step: proving the person and the paperwork belong together. It's also the step most hiring processes skip.
RELATED: The Best Onboarding Software in Australia (2026)
Why onboarding is the final line of defence
If the CV can be generated and the interview can be faked, the most reliable place to prove someone is real is the exact point where they hand over documents, sign a contract, and become a worker on your books.
Onboarding is where verification has evidence to work with. That makes it a recruitment agency's last clean opportunity before a new worker reaches a client's site.
The strongest approach layers several checks, each covering a gap left by the others.
Bind the person to the document
A liveness-checked photo, matched against the photo on a verified identity document by a reputable identity verification provider, is what separates a borrowed identity from a genuine one. Pair it with a document check, so you know the document itself is real. A facial image used for verification is sensitive information under the Privacy Act 1988, so obtain the candidate’s consent and explain how it will be stored and used.
Verify credentials at the source (against that same identity)
Check licence and ticket numbers on the issuing register and confirm the name and classes match the verified person. WorkSafe WA's advice is blunt: sight the original, and don't settle for an emailed or texted photo of a licence.
Check work rights, then keep checking
Run VEVO against the verified passport, record the result, and schedule rechecks for anyone whose visa can change – bridging visas and student visas especially.
Find referees yourself
Call the employer's switchboard listed on the CV rather than the mobile number provided alongside it.
Close the loop on day one
The simplest control here is a supervisor at the host site confirming that the person who arrived matches the verified photo on file. It takes 30 seconds, and it stops most proxies at the gate.
Keep looking after the start date
The YouGov survey data showed one in 10 Australian organisations found identity fraud only through rescreening or ongoing monitoring. A check performed once captures a moment. Credentials expire, visas change, and some fraud surfaces only later.
How Xemplo helps close the gaps
Xemplo works alongside specialist screening providers rather than replacing them. Here, we ensure the right checks happen for every worker, every time, and that the evidence is kept in a single place.
Work rights checked at onboarding (then rechecked)
When VEVO Checking is switched on for a position, workers give their consent and supply their work rights as part of onboarding – and Xemplo runs the check with the Department of Home Affairs. Active workers are rechecked every 14 days. If a check is incomplete or shows a worker isn't eligible, you receive an email and the worker's profile is flagged for review.
Identity, police, and reference checks through MVSI
Through Xemplo's native integration with MVSI, you can request background checks from within Xemplo – including 100-point ID checks, National Police Checks, independent reference checks, and trade and driver's licence checks.
The right credentials for every role
Required licences, tickets, and certifications are set on each position and can be locked so they won’t be removed for an individual hire. Workers provide evidence at onboarding (e.g. the front and back of a licence; Xemplo tracks expiry dates, and managers can be alerted before a credential expires).
The same steps for everyone
Default credentials, documents, and questions apply to every new position, so each worker goes through the same process. That consistency makes anything unusual stand out, without singling anyone out.
One record to go back to
Check results, work rights history, credentials and contracts sit on the worker's profile. When a client or regulator asks what was checked, the answer is already there.
The question worth asking
For most of recruitment's history, the toughest part was searching for the right person.
Proving they existed was always assumed. That assumption no longer holds, and the agencies that notice first will hold an advantage their clients can feel – placements that turn up as described, credentials that hold up under audit scrutiny, and a record that answers questions before anyone asks them.
None of it requires treating every candidate as a suspect. It just requires a process that verifies the same things, in the same order, for everyone (and keeps the evidence somewhere it can be found).
So before your next Monday start, it's worth asking a straightforward question about your own pipeline: If the person on your paperwork and the person at the gate were two different people, which step would have told you?
.webp)
