What a real-time deepfake interview looks like

A deepfake interview overlay replaces the candidate's actual face with a different face on the outgoing video stream, in real time, with working lip sync and head-tracking. The operator sits in front of their own camera; the person on the other end of the Zoom call sees someone else. The technology has existed in consumer-grade form since roughly 2023 and has matured rapidly since. As of early 2026, a motivated amateur can run a live face-swap on a mid-range laptop with publicly available tooling.

In the hiring fraud context, deepfakes are used for one of two goals: hiding the identity of a proxy interviewer (so the beneficiary's LinkedIn photo appears on the call instead of the stand-in's real face), or hiding the identity of a state-sponsored operator (so the stolen US identity's face appears on the call instead of the operator's). Either way, the defense is the same: make the overlay fail.

The 2026 state of live deepfake tooling

Three things are true at once about live deepfakes in early 2026.

First, they have gotten good enough to fool a casual observer on a typical video call. The face-swap artifacts that were obvious in 2023 — mouth flickers, eye misalignment, visible edge seams — have largely been engineered away for the static face-forward view.

Second, they still fail under specific stressors. Profile angles, fast head movement, hands-near-face, and occlusions (a hand, a coffee cup, a pen) all introduce artifacts that the real-time model has to reconstruct on the fly, and that reconstruction is the weakest point of the pipeline.

Third, the detection-versus-evasion arms race means any specific artifact test will have a shelf life. The tells below are the ones that have held up over 12-18 months of tooling evolution, but treat this page as a rolling document rather than a fixed checklist.

Visual tells

  • Profile angle artifacts. Ask the candidate to turn their head 45 degrees left or right mid-sentence and keep talking. Most live face-swap models are trained heavily on frontal face data and produce visible warping, bleed, or mask snapping when the face rotates past about 30 degrees.
  • Hand-face occlusion. Ask a question that invites a natural gesture — "can you show me roughly on your hand how you'd structure this?" — and watch what happens when the hand crosses the face. Deepfake models reconstruct the occluded face region; they often fail to reconstruct the hand correctly, leaving artifacts at the intersection.
  • Fast movement. A rapid head turn or lean-in blurs the face temporarily. Real video handles the blur naturally. A deepfake often produces a one-frame mask glitch at the moment of maximum motion.
  • Face boundary inconsistency with lighting. The overlay's face should be lit consistently with the rest of the scene. In practice, many real-time deepfakes are trained on studio-lit source material and preserve that lighting regardless of the operator's actual environment. A candidate whose face appears ring-lit while everything else in the frame is dim is worth a note.
  • Accessory persistence. Glasses, earrings, and facial hair are handled by different layers of the model. Frequently they flicker, disappear briefly, or render inconsistently between frames. Glasses reflections that don't move with head motion are a classic tell.

Audio tells

  • Lip-sync latency under stress. The sync looks fine during calm, prepared speech. Ask the candidate to do a five-second mental-math exercise aloud ("count down from 47 by threes, please") and watch whether the mouth movement and audio drift apart when the cognitive load spikes.
  • Voice-changer artifacts. Many live deepfake pipelines pair face-swap with voice changing. Sibilants, consonant clusters, and laughter are the hardest for voice changers to render cleanly. A short unprompted laugh request — "the last time you broke a production system, who first pointed it out and what did they say?" — usually exposes a voice-altering layer.
  • Silence artifacts. Some voice changers produce a tell-tale floor noise or "breath pulse" in silence. Pause deliberately for a long moment in the interview and listen to what the microphone sounds like without speech.

Behavioral tells

  • Camera-angle rigidity. A candidate running a live face-swap is strongly incentivized to keep their head centered and stationary, because every departure from that pose taxes the model. If the face stays unnervingly still for long periods, note it.
  • Refusal to switch video platforms. The overlay is usually configured to intercept a specific virtual camera driver. Switching from Zoom to Google Meet to Teams at short notice forces a reconfiguration; some operators refuse rather than attempt it live.
  • Reluctance to pick up a physical object. "Could you grab a pen and show me what you mean?" The candidate's hands leave the keyboard, the face partially occludes, the model has to work harder. Operators running a fragile pipeline often decline.
  • Heavy virtual backgrounds. Not itself a deepfake signal, but virtual backgrounds hide the room inconsistencies that would otherwise contradict a claimed location and give the operator a controlled, flat-colored backdrop that is easier for the face-swap model to composite cleanly against.

Pipeline-stage controls

Watching for artifacts during an interview is worth doing, but the economics favor the defender more strongly at other stages. Three controls make a deepfake attempt a losing strategy before the interview starts.

  1. Identity verification at intake. The deepfake only protects the face. It does not protect the phone number, the email domain, or the digital footprint. A candidate whose contact infrastructure already fails a verification check never makes it to the stage where a deepfake would matter.
  2. Live, recorded onboarding check. A first-day video introduction to the team, recorded, on a different platform than the interview rounds, without a virtual background. Any meaningful inconsistency with the interview face is investigated. This is the cheapest, highest-signal deepfake defense available.
  3. Request a live, candid moment. At an arbitrary point during the final-round interview, ask the candidate to take a short video of the room they are in and share it. "Just a quick pan around the space, if you don't mind." A real candidate shrugs and does it. A deepfake operator has no clean way to produce that video.

A blunt point. The right framing for deepfake detection is not "how do I spot the overlay in the interview." The right framing is "how do I structure the hiring process so the overlay is not worth attempting." The deepfake is cheap; the surrounding pipeline of stolen identity, fabricated contact details, and laptop farm is expensive. Destroy the pipeline's economics, and the face swap becomes irrelevant.

FAQ

Are deepfake interviews common enough to worry about?

They are not the majority of hiring fraud cases today — most fraud is still crude. But the tooling has commodified fast, and the cost to an operator of adding a deepfake layer to an existing scheme is low. Treat this as a threat that is rising rather than dominant.

Is there an automated deepfake-detection tool that works in real time on video calls?

Several exist; none are reliably accurate enough to be a standalone defense. Use them as an additional signal in a stack, not as the stack itself.

What's the single highest-leverage control?

A recorded first-day onboarding video introduction, on a different platform than the interviews, with no virtual background. It is cheap, it is nearly impossible to spoof, and it catches most of the real cases that make it past interview rounds.