Do you really know who is on your payroll?

When was the last time you met your newest hire in person?

For many organizations, particularly those operating remotely, the answer is increasingly never. With one in five companies worldwide adopting a fully remote model, hiring virtually has become increasingly popular, enabling businesses to access global talent pools and scale faster than ever before.

But in removing geography as a constraint, it has also stripped away one of the most fundamental layers of trust: the ability to verify, face-to-face, who you are actually employing.

This shift is giving rise to a new and largely under-recognized threat, the “deepfake employee”, where threat actors use synthetic identities, voice cloning, and real-time deepfake video to pass interviews and secure legitimate employment.

Accelerated by advancements in AI, it is now possible to create convincing digital personas at scale, lowering the barrier to entry for fraud and enabling highly organized operations to target corporate hiring pipelines.

In practice, these attacks can be surprisingly difficult to detect. A candidate may appear on a video interview with a natural-looking face and voice, answer questions fluently, and provide what seem to be legitimate credentials. Behind the scenes, however, AI tools can subtly alter facial expressions, sync lip movements to a cloned voice, or even feed real-time responses.

To the hiring manager, there is little reason to suspect anything is wrong. The deception often only becomes apparent much later, if at all, when activity inside the organization begins to raise concerns.

This risk is already playing out in the real world. In a recent experiment, a cybersecurity expert used AI to create deepfake personas – one a white man similar to himself and another of an Asian woman, and successfully secured two separate tech roles, beating hundreds of other candidates.

Using AI-generated credentials, real-time voice modulation and live deepfake video, both synthetic identities progressed through interview stages undetected, with employers unaware they were interacting with an entirely fabricated candidate.

Cloudflare’s latest threat research highlights the scale and sophistication of this activity. Organized “remote worker” fraud operations are using fabricated identities, deepfake-assisted interviews and remote access “laptop farms” to infiltrate payrolls. In some cases, multiple individuals operate behind a single employee identity, maintaining persistent access while appearing as one consistent, legitimate user.

Once hired, these actors are no longer external attackers. They become insider threats with valid credentials, company-issued devices and trusted access to systems. As Cloudflare notes, by the time these individuals are identified, they are already operating inside the perimeter, often blending in with normal business activity.

What needs to change

With nearly 60% of organizations having experienced deepfake-driven incidents, and 48% reporting damage from AI-generated impersonation or misinformation, it is clear that identity infrastructure has become a primary attack surface. Attackers are shifting away from “breaking in” to “logging in” using legitimate credentials obtained through deception.

At the heat of this issue is the flawed assumption that identity can be verified once and then trusted indefinitely.

In physical environments, identity is rarely in doubt. You can see who walks through the door, recognize familiar faces and detect inconsistencies in behavior. In virtual environments, however, organizations rely almost entirely on screen names, login credentials and video, none of which reliably confirm who is actually behind the screen.

Accounts can be shared, credentials can be compromised, and even live video can be manipulated.

This creates a critical vulnerability at the point of hire. A candidate may present documentation, pass background checks and complete onboarding, but in a world of synthetic identities, that initial verification is no longer enough.

Building continuous identity assurance

To address this challenge, organizations need to move beyond static identity checks and towards continuous identity verification. This means verifying not only who someone is who they say they are and that they are a real human at the point of hire, but ensuring that the same individual remains present and authentic throughout their interactions with the organization.

The strongest form of defense lies in continuous biometric verification of the user’s identity. Rather than relying on a single factor, such as facial recognition or voice authentication alone, fused biometrics combines multiple identity signals, such as facial characteristics, voice patterns and behavioral cues, into a single, layered verification process, verifying directly that a real, live human is there.

It is no longer enough to confirm a person’s identity at a single moment in time. Organizations need confidence that the same individual is consistently present across every critical interaction, from interviews and onboarding, through to system access and sensitive transactions. Without this continuity, identities can be shared, replaced or hijacked without detection.

Fused biometric verification can create layered validation that is significantly harder to replicate or manipulate, enabling it to detect and block attempts to impersonate users through synthetic voices, deepfakes, or recorded audio and video.

While a single modality might be fooled by a sophisticated synthetic input, combining biometric modalities; facial recognition, voice recognition, and speech pattern recognition, it becomes significantly harder for fraudsters to mimic an identity.

Advanced biometric verification technologies are trained on large datasets of both genuine and synthetic voice samples, enabling them to recognize subtle acoustic differences between natural and deepfake voices. This helps organizations detect voice-cloning attempts, even when the audio sounds convincing to human listeners.

Crucially, fused biometric verification can operate passively in the background, consistently verifying that the right person is accessing systems, enabling smoother, lower-friction experiences and reduces the need for frustrating repeated verification attempts.

As organizations continue to embrace remote work and digital-first operations, cybercriminals will increasingly find new vulnerabilities to exploit. The question is no longer just how to keep threats out, but also how to ensure that those already inside are truly who they claim to be.

In a world where identities can be fabricated, cloned and manipulated with ease, trust cannot remain static. It must be continuously proven.

We’ve featured the best secure smartphone.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit