Come across a candidate who’s too good to be true in today’s job market? According to a release from the FBI today, there is a growing trend of deepfakes using stolen PII to apply for remote job listings, particularly those with access to financial data, proprietary information or corporate databases.
The notice, published on the FBI’s Internet Crime Complaint Center, notes how deepfakes have been identified during virtual job interviews. “Complaints report the use of voice spoofing, or potentially voice deepfakes, during online interviews of the potential applicants,” the notice states. “In these interviews, the actions and lip movement of the person seen interviewed on-camera do not completely coordinate with the audio of the person speaking. At times, actions such as coughing, sneezing, or other auditory actions are not aligned with what is presented visually.”
ClearanceJobs reported on the rise of deepfakes in June of 2020. Deepfakes get their name from the deep learning technology used to create the fake videos. While commonly used to depict celebrities, the use of deepfakes in a job interview setting indicated the interest by criminal actors and nation states in using remote work environments to target workplaces.
A deepfake would be unlikely to make it very far in a government or security clearance onboarding process. (Try deepfaking your way through the SF-86), but as deepfake technology and nation-state interest grows, it wouldn’t be impossible for a deepfake profile to make its way through the job search process, similarly to how we see LinkedIn as a frequent target of Chinese intelligence gathering. Once you’ve gathered enough profile data, one could easily set up a fake job application and move through the application process.
The FBI report notes that it’s the combination of deepfakes along with stolen PII that makes the remote job targeting possible. Companies or victims are asked to contact the IC3 with any information, including IP addresses, and any identifying information provided.
