Is this person who they say they are?
Impostors go after the moments where a person is trusted on sight: the remote interview, the call asking for a password reset, the first day at work, and the remote employee who has been on the payroll for a year. This track studies whether a live second view from the person's own phone, a handful of independent signals and a human decision can catch them, and leave a proof that holds up later.
The prototype runs alongside Zoom, Teams and Meet, with no change to the phone system or interview process.
"Almost every CISO of a Fortune 500 company that I've spoken to — I'll just characterize as dozens that I've spoken to — have admitted that they had a North Korean IT worker problem."
Charles Carmakal, CTO, Mandiant Consulting, quoted in The Register, 13 July 2025.
Most of them are already past the interview. The pay funds the regime; some have stolen data and extorted employers who tried to let them go.
Scenarios under study
Remote interviews
Deepfaked video, candidates fed answers by AI in real time, and bait-and-switch, where one person interviews and another turns up. What the prototype tries:
- Dual-angle live video. The conference camera plus a side view from the candidate's phone. Faking two devices consistently in real time is much harder than faking one.
- AI coaching check. Interview questions are transcribed and answered by AI in parallel; close tracking between the candidate and the machine is flagged.
- Same person every time. Captures from every session kept side by side across interviews, devices and locations.
- ATS round trip. An Ashby integration tests whether the result and proof link can live in the hiring record.
Helpdesk impersonation
Account takeovers that start with a convincing voice on the phone. Before MFA is reset or access granted, the caller gets a link, joins on their phone, and the agent sees live signals and decides.
- Invite by SMS, WhatsApp or QR. The caller joins on mobile; the agent stays on the desktop.
- Integrity signals. Location against the claimed location, device, liveness, and VPN, Tor or hostile-network checks.
- A human decides. Pass or fail by a named agent, with the evidence in front of them.
- Proof in the ticket. Webhook and Zendesk experiments put the result and proof link back on the case.
Hire to start
Proxy workers and swapped identities often surface after the offer. The open question: can one verified record carry from the first interview to day one, and be re-checked before equipment and access go out?
Employee audits: who is actually doing the job?
The interview is not the only way in, and most of these workers are already on the payroll. An audit sends each remote employee, or a chosen group, the same live check: a link that opens on their own phone.
- Laptop farms show up. The company laptop may sit in a US apartment on a US address, so IP checks on it look clean. The check runs on the person's own phone, which reports where the person is and what network they are on, including VPNs and hostile providers.
- Same person as the one hired. The audit capture sits beside the interview and onboarding captures, so a different face in the same job stands out.
- Nothing to install on the laptop. A link by text or email, a minute on the phone, and a proof for each person checked.
- A record for the auditors. Who was checked, when, what the signals showed and who signed off, hash-chained, for security, HR and legal.
Signals
Several independent signals, shown to a person who decides. This is not automated document KYC; it is a live check at the moment that matters.
Liveness and video
A live second view from the person's own phone, watched for deepfake and background-replacement tells.
Location
Where the person physically is, against where they say they are and where the connection comes from.
Network
VPN, Tor, bot traffic and known hostile providers.
History
Every session's captures kept together, so a change of face or place stands out.
A proof, not a promise
Each verification ends in a proof link: who was checked, what the signals showed, who decided, and when. The records are hash-chained, so an edit or a missing entry shows.
The screenshot is a real proof page from June 2026: the live view from the person's phone, the side-by-side captures from two devices, and the row of signal checks underneath (email, location, network, device and more), each one green, amber or red.
Have a case that tests this?
Interview fraud, helpdesk social engineering, a hire that went wrong: real cases make better research.