I have recruited for nineteen years. Roughly half of that time has been in the highly cleared federal space. Six months ago, I launched Velocity Talent, a recruiting firm built around an AI-driven screening process. That process now flags about one in fifteen applicants for our software development roles as fraudulent. Not a weak candidate. Not the wrong stack. Fraudulent, as in: the person on the screening call is not the person who would show up to work.
Two years ago, that number would have been close to zero. Much of what we see comes through commercial requisitions, but the same people, using the same methods, are applying to cleared and national security programs. They are counting on a fast-moving hiring process to wave them through.
Here is what we catch, in order of how often it shows up.
Résumés that mirror the job description
The most common tell and the easiest to miss. The résumé repeats the requisition’s language, phrase for phrase, in the same order. A human wrote the job description; a model wrote the résumé from it. On its own, this isn’t fraud, but it’s where fraud starts, and a résumé that matches your posting too well is now a reason to look harder, not a reason to relax.
Answers read off a second screen.
On video, the candidate’s eyes track left to right in a line, drop, then repeat. The cadence is reading, not thinking. Ask a follow-up that requires them to contradict something they just said and the pattern breaks, or they stall while whatever is on the other screen catches up.
Synthetic voices
Cloned or generated audio on the phone screen. The tells are subtle and getting subtler: unnatural consistency in pitch, no breath sounds under longer answers, a slight lag before responding to anything unexpected. We catch these with tooling now, not by ear.
Lip-sync mismatch
The candidate’s mouth doesn’t quite match the audio. Sometimes it’s a proxy, with one person on camera and another answering. Sometimes it’s a deepfake overlay. Either way, the person you would hire is not the person you interviewed.
Experience that predates the technology
Five years with a framework that shipped three years ago. A certification dated before the certification existed. This one is pure carelessness on the fraudster’s part, and it’s the easiest check to automate.
None of this was caught by reading a résumé. All of it was caught before a hiring manager spent a minute in an interview, which is the only place it’s worth catching. Once a fraudulent candidate reaches a technical panel, you’ve already spent your most expensive people’s time, and the panel isn’t looking for this. They’re looking for whether the candidate can code.
Why this is a security problem, not an HR problem
In commercial hiring, a proxy interview produces a bad hire. Costly, embarrassing, fixable. In cleared and national security work, it means the person who passed your screen may not be the person who holds the clearance, or the person who ends up on a government network was never vetted by anyone at all.
Federal law enforcement has publicly warned that foreign actors use stolen or borrowed identities to land remote technical jobs at U.S. companies, then use that access for income, for data, or both. On a defense or intelligence program, a fraudulent hire is an insider threat that came in through the front door. The clearance process is thorough, but it investigates the identity it is handed, and it starts after someone has already decided to hire. The pre-hire screen is the first checkpoint, and right now it’s the weakest one.
Who is most exposed
The organizations most at risk are the ones least equipped to spot it: small and mid-sized primes and subcontractors, often 50 to 500 people, that just won an award and have sixty days to staff it. They post on ClearanceJobs and everywhere else; they hire fast, and for software development roles they often allow remote or hybrid work. Those are exactly the openings fraudsters target, because they pay well and rarely require anyone to show up in person before day one. Their talent acquisition team, if they have one, is not screening for synthetic voices.
What hiring teams can do now
I’m not going to tell you to buy anything. Four things that cost nothing:
Treat a résumé that mirrors your posting as a flag, not a match
Read it against the job description side by side before you schedule anything.
Ask one question that can’t be scripted.
On every video screen, ask the candidate to push back on something they said earlier. Reading scripts can’t do that.
Verify one date
Pick one technology or certification on the résumé and check when it actually existed.
Bring your security team in early.
Your FSO and insider threat program should know what your recruiters are seeing. Look for patterns, not just individuals: we have seen the same phone number attached to two different applicants for the same role. One flagged candidate is a hiring problem. A pattern is a security report.
A word to cleared job seekers
If you hold a clearance and you’re on the market, expect more of this: more on-camera interviews, more identity checks, more questions you can’t prepare for. It isn’t personal. The people you are competing against for that role are not all who they say they are, and every check that catches them protects the value of the clearance you earned. And never let anyone interview on your behalf, or lend your name or credentials to someone who wants to.
If you want the full list of what we check, it’s one page, and it’s free at velocitytalent.ai/redflags. I’d rather every hiring manager in this market had it than keep it as a competitive edge. The fraudsters already share notes. We should too.
Adam Solomon is the founder of Velocity Talent, a technical recruiting firm in Northern Virginia specializing in cleared federal IT and AI/ML hiring. He has recruited for nineteen years, about half of that in the cleared federal market. velocitytalent.ai
