The CV on your desk was probably written by AI. So how do you trust who you're hiring?

A well-written CV used to tell you something. It suggested the candidate understood the role, could organise their thinking, and had taken care to present themselves clearly. Recruiters learned to read between the lines — spotting effort, spotting carelessness, spotting exaggeration. That skill hasn't gone away, but the materials it was trained on have changed underneath it.

When a candidate pastes a job description into ChatGPT and generates a CV that maps precisely to your requirements in under a minute, the document you receive looks like effort. It reads like tailoring. It might even feel like a strong cultural fit, because the language mirrors your own. But it tells you very little about the person behind it.

This goes well beyond polished CVs. AI image tools now produce qualification certificates that pass visual inspection. Credential mills use generative AI to create academic documentation indistinguishable from the real thing. Reference letters can be generated from a named person at a real company — the company exists, the person has a LinkedIn profile, but the letter was never written by them. Most reference processes don't verify authorship, so the fabrication sails through.

At the sharper end, real-time AI coaching tools feed candidates suggested responses during video interviews. The candidate sounds articulate because they're reading from a prompt the interviewer can't see. NIST's 2025 face analysis evaluation found that morphed facial images can defeat automated identity verification systems, which means even biometric checks aren't immune. LinkedIn profiles can be constructed from scratch to mirror a fabricated employment history, complete with connections, endorsements, and a plausible timeline. If a recruiter does a quick visual check (and most do), it holds up.

Each of these methods, taken individually, might seem manageable. Together, they represent a layered fabrication capability that didn't exist three years ago. A candidate can now manufacture a complete professional identity across multiple platforms and document types, each reinforcing the others, with no single point where the fiction is obvious.

Where your process breaks

Standard background screening confirms that a qualification exists. It doesn't confirm the certificate you're looking at is the real one. It verifies a company is real and that someone worked there. It doesn't confirm the applicant is that person. It checks references against the names provided. It doesn't establish who actually wrote the letter.

These aren't flaws in screening. They're the boundaries of a model designed for a world where the main risk was exaggeration, where someone might round up a job title or stretch their dates of employment. That model assumed the underlying documents were authentic. When the risk shifts to wholesale fabrication, confirmation becomes a different problem.

The ILO's November 2025 working paper on AI in human resource management described this structural blind spot clearly: organisations tend to treat data-driven processes as inherently objective, when those processes are only as good as their inputs. A screening check run against fabricated documents will return a clean result with the same confidence as one run against real ones. The output looks identical either way.

What a stronger assessment looks like

If documents and written materials are no longer reliable proxies for capability or identity, the assessment model needs to shift weight toward signals that are harder to manufacture.

Structured interviews that test applied knowledge in real time expose gaps a polished CV can cover. Technical evaluations administered under controlled conditions tell you more about competence than a writing sample submitted from home. Reference checks that go beyond candidate-supplied names and reach into independent verification channels are harder to game than pre-written letters.

Identity verification is becoming a discipline in its own right, separate from credential verification. NIST's updated digital identity guidelines (SP 800-63A, Revision 4, 2025) treat identity proofing as a layered assurance problem — multiple evidence types, cross-referenced, with escalating rigour based on risk. The principle translates directly to hiring: a single document check at one point in time is a low-assurance process, and the threat environment now demands higher assurance than that.

This doesn't mean abandoning CVs or scrapping screening. It means changing how much weight each signal carries. A CV becomes a conversation starter, not evidence. A background check becomes one layer in a stack, not the final word. And the process itself needs to be designed around the assumption that some proportion of what arrives in your pipeline will look perfect and be entirely fabricated.

If that assumption feels uncomfortable, consider what happens without it. You're relying on the same signals your competitors rely on, assessed the same way, against a threat that has already adapted to exactly that process. The candidates who can't fabricate their way through are the ones you're most likely screening honestly. The ones who can are the ones you're most likely to miss.

‍