A Claude Skill that reads interview transcripts and the loop metadata your ATS already holds, and returns a per-candidate corroboration report: what the record confirms, what it contradicts, and which specific questions remain open. Flagged candidates go to a live verification step. They do not go to a rejection — the skill has no output field that can carry one, and the arithmetic in the next section is why.
It never touches the video file. No face geometry, no voiceprint, no blink rate, no affect scoring. That constraint is the design, not a limitation of it.
The number that decides the design
A fraud screen lives or dies on its base rate. With a prior of 2% fraudulent candidates reaching a live loop, a screen catching 80% of them at a 5% false-positive rate produces a 24.6% chance that any given flag is real. Three flags in four are innocent people. Raise the prior to 10% and the same screen reaches 64% — still not a number that rejects anyone.
So the skill routes flags to verification and stops there. A structured 45-minute follow-up resolves most of them, and the outcome of that conversation — not the score — is what reaches the hiring decision. This also keeps the workflow clear of automated-decision-system framing under NYC Local Law 144 and California’s FEHA ADS regulations, and it narrows the FCRA question: the CFPB’s Circular 2024-06 places third-party algorithmic scores about workers used for employment decisions inside the FCRA, with consent, disclosure, and pre-adverse-action duties attached. An in-house screen gating a conversation sits somewhere different from a purchased score gating an offer. The skill prints that as a counsel question rather than answering it.
When to use
A fully-remote req where the loop is the only thing standing between an applicant and production credentials.
Roles that ship equipment before day one. The address on the shipping label diverging from the address on the identity document is the cheapest signal on the list and nobody looks at it.
A candidate whose written work and live answers read as two different people, and the recruiter cannot say why.
Security or IT reqs at companies inside the DPRK IT-worker threat surface. The UN Panel of Experts estimate puts that program’s annual revenue at $250-600 million, and CrowdStrike has reported North Korean actors posing as insiders at more than 100 primarily US technology companies.
When NOT to use
To reject anyone. See the arithmetic above. A 24.6% posterior that ends a candidacy is a screen that discriminates against the innocent majority of the people it flags.
As media forensics. Deepfake detectors collapse out of distribution. Cross-dataset benchmarks show a detector at 0.998 AUC on its training distribution falling to 0.674 on an unseen dataset and 0.633 on Celeb-DF. The adversary picks the generator. A detector you cannot benchmark against the generator actually in use returns a number, not a control.
To infer emotion, stress, or honesty. EU AI Act Article 5(1)(f) prohibits inferring emotions of a natural person in the workplace from biometric data, and the Commission’s February 2025 guidelines on prohibited practices read “workplace” to cover candidates during selection and hiring. Penalties reach €35 million or 7% of worldwide annual turnover. Demeanor-based deception detection is also unsupported, so the ban costs nothing.
Where AI assistance is permitted. Decide the policy first and publish it. ai_use_policy defaults to prohibited so that turning the answer-provenance class off is a deliberate act — but if nothing is published, the honest setting is permitted, because you cannot screen against an unstated rule.
Retroactively, across a closed pipeline. Running this over last year’s rejected applicants builds a file of unadjudicated accusations against named people, discoverable in any later charge, with no verification step available to clear anyone in it.
On in-person loops. Identity substitution and live assistance both need the remote channel. An onsite final round is the stronger control and needs no skill at all.
Setup
Drop the bundle at apps/web/public/artifacts/ai-interview-fraud-detection-skill/SKILL.md into your skills directory with references/ alongside.
Set the parameters in references/1-signal-taxonomy.md §0. base_rate comes from your own confirmed cases over the last 12 months; with none, keep 0.02 and read every posterior as an upper bound. The file carries a checked: date and a 90-day review cadence.
Fill the intake in references/2-interview-record-intake.md. Section A wants utterance timestamps — mark NO_TIMESTAMPS where you lack them so the skill reports the answer-provenance class as unavailable instead of scoring it on nothing.
Answer Section E before the first run. Five consent and notice prerequisites; a NO halts the run. The row that fails most is the written camera policy, and without it the skill scores nothing on camera reluctance.
Check verification capacity in Section F. Flags are a capacity number, not a quality signal: 100 loops per month at a 2% prior and 5% false-positive rate yields about 6.5 flags, of which 1.6 are real. Negative headroom means tighten the taxonomy before running, not after the queue backs up.
What the skill actually does
Six steps. Two structural choices carry the design.
Two passes, and the extractor never sees the taxonomy. Pass one pulls the claim ledger, per-answer latency numbers, and register descriptions with no fraud vocabulary anywhere in its context. Pass two scores those facts against the taxonomy. A single primed pass manufactures what it was told to find — every pause becomes evasion once the model knows it is hunting evasion. The split costs one extra call per candidate.
The blocklist is enforced at output. Step 4 drops accent, non-native phrasing, name origin, home background, webcam and bandwidth quality, virtual-background use, timezone alone, and employment gaps. Each correlates with national origin, race, disability, or socioeconomic status, and each is the exact route by which a fraud screen becomes an AI screening bias claim. Dropped signals print in the report, so the exclusion is auditable rather than assumed.
Between those, step 1 refuses to run on consent-gated biometric artifacts without a cited consent record — voiceprints and face-geometry exports arrive attached to vendor exports, and Illinois BIPA carries statutory damages of $1,000 for negligent and $5,000 for reckless or intentional violations per person. SB 2979, signed 2 August 2024, narrowed that to a single recovery per person per collection method, and the Seventh Circuit held on 1 April 2026 that the narrowing applies retroactively. The exposure is smaller than it was and it is not zero. Strip, do not analyze.
Step 5 converts priority to a posterior and orders the queue by posterior times role risk, where role risk is day-one access rather than seniority. Step 6 prints contradictions with both the loop quote and the conflicting claim verbatim, so the reader sees evidence instead of a conclusion.
Cost reality
Per loop — a four-round loop of 45-minute interviews runs 40-55k input tokens of transcript plus about 8k of reference files, and 3-5k output across two passes. At Claude Sonnet list rates ($3 per million input, $15 per million output) that is $0.20-0.35 per candidate. Estimate, from token counts of transcripts at that length.
At volume — 100 loops a month lands at $20-35 in model spend. The cost that matters is the verification step: 6-7 structured 45-minute follow-ups per month, plus interviewer prep, is roughly 8-10 hours of loaded interviewer time.
Setup — 90 minutes to configure, honest only if your ATS already exports transcripts with timestamps. Teams wiring transcript capture for the first time spend a day or more, and the interview intelligence layer is the prerequisite.
What it does not save — the in-person round. For a HIGH-risk role with a posterior above 20%, travel costs less than the alternative and resolves all three fraud classes at once.
Success metric
Flag volume tracking the predicted rate. If a 2% prior predicts 6.5 flags and you get 30, the taxonomy is mis-tuned, not the pipeline compromised.
Every flag closed with a recorded outcome. The decision log in references/3-verification-playbook.md §4 has no partial state. An open flag on a candidate declined for unrelated reasons is the worst record to hold.
RESOLVED share above 70%. Most flags should clear at verification. A lower share means the screen is firing on noise.
Zero excluded-signal appearances in reports. A deterministic check that should never fire.
vs alternatives
vs real-time deepfake detection vendors. Pindrop, Reality Defender, and the detection layers now embedded in conferencing platforms work on the media stream, which this skill deliberately does not. Complementary, not redundant — and worth buying only from a vendor who will state their benchmark set, given the cross-dataset numbers above. They verify the pixels. They do not verify that the person answering knows what they claimed on the resume.
vs identity-verification vendors. Document-plus-liveness checks at offer stage are the right control for class A, and you likely already run something like Checkr adjacent to it. They verify who signed. They do not verify who does the work from week two, which is where the laptop-farm pattern lives.
vs proctoring and lockdown browsers. Cheaper to buy, worse to run. They push the loop toward surveillance, penalize candidates on shared connections and assistive technology, and resolve less than one well-run depth follow-up.
vs a technical assessment platform.Karat and similar run live human interviews that structurally resist both proxy and copilot assistance. Where budget allows, this is a stronger answer than any screen — the skill is for the rounds you run yourself.
vs the status quo. Untrained humans detect synthetic media at close to chance. The realistic status quo is not “recruiters catch it” but “nobody looks,” and the marginal cost of looking is $0.30 a candidate.
Watch-outs
A flag read as a finding.Guard: every flag prints its posterior with the inputs beside it, and no output field is a rejection ground.
Confirmation bias from a primed extractor.Guard: pass one runs with no fraud vocabulary in context; the taxonomy loads only in pass two.
Proxy discrimination through demeanor.Guard: the §4 blocklist is enforced at output and dropped signals are printed.
Camera reluctance scored against an accommodation need.Guard: the signal scores only where a written uniform policy and an offered accommodation path both exist; otherwise the skill reports the policy gap instead of the candidate.
Biometric artifacts arriving with the export.Guard: step 1 halts on consent-gated material without a cited consent record.
Verification capacity overrun.Guard: expected monthly flag volume prints before the first run, and the queue orders by posterior times role risk so the tail is what waits.
The report becomes discovery material.Guard: the playbook’s decision log closes each flag explicitly, and §6 publishes candidate-facing notice before the first run rather than after the first flag.
Stack
The bundle lives at apps/web/public/artifacts/ai-interview-fraud-detection-skill/ and contains:
SKILL.md — the skill definition
references/1-signal-taxonomy.md — four signal classes with weights and false-positive estimates, the excluded-signals blocklist, and the base-rate parameters
references/2-interview-record-intake.md — fillable intake with a lawful-basis column per field
references/3-verification-playbook.md — verification methods, the live re-verification protocol, the decision log, and candidate-notice scaffolding
Assumes Claude for the run, an ATS such as Greenhouse for the process facts, and a transcript source — Metaview or equivalent — for section A.
---
name: ai-interview-fraud-detection
description: Screen an interview record — transcripts plus loop metadata you already hold — for identity-substitution, proxy-interview, and real-time answer-assistance signals, and emit a corroboration report that routes named candidates to a live verification step. Works on text and process facts, never on biometric or affect analysis. Produces a verification queue, never a fraud verdict and never a rejection.
---
# AI interview fraud detection
## When to invoke
Use this skill when a remote hiring loop has finished or is mid-flight and someone needs to know which candidates carry unresolved corroboration gaps before an offer goes out. It reads the interview transcripts and the process record around them, and returns a per-candidate report separating what the record corroborates from what it contradicts.
The output is an input to a verification step — a live structured re-interview, a document check, a reference call. It is not an input to a hiring decision. That separation is load-bearing and section *Method* explains why.
Typical triggers: a fully-remote engineering or IT req, a role with production-system or customer-data access, a candidate whose written work and live answers read as different people, a req where equipment ships before day one.
Do NOT invoke this skill for:
- **Rejecting a candidate.** No output field is a rejection ground. Section *Base rates* shows why: at a 2% prior and a 5% false-positive rate, roughly 3 in 4 flags are innocent candidates. A flag that rejects is a screen that discriminates against the innocent majority of the flagged set.
- **Media forensics.** The skill does not analyze video frames, face geometry, voiceprints, blink rate, or micro-expressions. It never touches the media file. Section *Why text and process, not media* gives the accuracy reason and the legal reason.
- **Inferring emotion, confidence, honesty, or stress.** EU AI Act Article 5(1)(f) prohibits AI systems that infer emotions of a natural person in the workplace from biometric data, and the Commission's February 2025 guidelines on prohibited practices read "workplace" to cover candidates during selection and hiring. Deception detection from demeanor is out of scope regardless of jurisdiction — it does not work, and it converts an interview into a polygraph.
- **Screening for AI use where AI use is permitted.** Decide the policy first. If candidates are told they can use an assistant, answer-provenance signals are noise. Set `ai_use_policy` and the skill drops signal class C.
- **Retroactive sweeps of a closed pipeline.** Running this across last year's rejected candidates manufactures a dataset of unadjudicated accusations against named people, discoverable in any later charge, with no verification step available to clear anyone. Run it forward-looking only.
- **In-person loops.** Identity substitution and real-time assistance both require the remote channel. An onsite final round is the stronger and cheaper control; see `references/3-verification-playbook.md` section 1.
## Inputs
- Required: `interview_record` — per candidate, the transcripts of each round with speaker labels and utterance timestamps, plus the round type and the interviewer. Timestamps are what make answer-latency analysis possible; without them signal class C is unavailable and the skill says so rather than guessing. Template in `references/2-interview-record-intake.md`.
- Required: `claim_set` — the candidate's own assertions available to you before the loop: resume, application answers, portfolio or repository links, and any written take-home. This is the corroboration baseline. A contradiction is only meaningful against a recorded claim.
- Required: `process_facts` — the loop metadata your ATS and IT already hold: scheduling history, reschedule and no-show events, the address on file for equipment, the application-source record, and whether the same contact details appear on other applications. Section B of the intake template.
- Optional: `ai_use_policy` — `prohibited`, `permitted`, or `permitted_with_disclosure`. Default `prohibited`. Anything other than `prohibited` disables signal class C.
- Optional: `base_rate` — your estimated prior for fraudulent candidates reaching a live loop, as a decimal. Default 0.02. The skill uses it to compute expected flag volume and posterior probability; see *Base rates*.
- Optional: `jurisdictions` — work locations in scope. Controls which notice and consent prerequisites the preflight checks.
## Reference files
- `references/1-signal-taxonomy.md` — the four signal classes, per-signal weights, the excluded-signals blocklist, and the base-rate parameters. The skill reads weights from this file and never from model memory.
- `references/2-interview-record-intake.md` — fillable intake template with a lawful-basis column per field, so the collection question is answered before the analysis question.
- `references/3-verification-playbook.md` — what happens after a flag: the live re-verification protocol and script, the decision log, and the candidate-notice scaffolding.
## Method
Six steps, in order. Two structural choices drive the whole design and are worth stating before the steps.
**Two passes, and the extractor never sees the taxonomy.** Pass one extracts claims, timings, and contradictions with no fraud framing in its context at all. Pass two scores those extracted facts against `references/1-signal-taxonomy.md`. A single pass primed with a fraud taxonomy manufactures the signals it was told to look for — every hesitation becomes evasion once the model knows it is hunting for evasion. Splitting the passes costs one extra call per candidate and is the difference between a report about the record and a report about the prompt.
**The output routes to verification, not to a decision.** A flag opens a verification step whose *outcome* is the only thing that reaches the hiring decision. This keeps the skill out of automated-decision-system territory under California's FEHA ADS regulations and NYC Local Law 144, and it keeps the FCRA question narrow — CFPB Circular 2024-06 holds that algorithmic scores about workers obtained from third parties for employment decisions are often governed by the FCRA, with consent, disclosure, and pre-adverse-action duties attached. An in-house screen that gates a verification step rather than a decision sits in a different place than a purchased score that gates an offer. Where the line falls for your setup is a counsel question, and the skill prints it as one.
### 1. Preflight the collection basis
Refuse to run if the record contains material the intake template marks as consent-gated and no consent artifact is cited: voiceprint or face-geometry data under Illinois BIPA, or an Illinois AI Video Interview Act consent where video interviews are AI-analyzed. The skill's own analysis is text-only and does not itself trigger BIPA, but records assembled for it frequently arrive with biometric artifacts attached, and BIPA carries statutory damages of $1,000 for negligent and $5,000 for reckless or intentional violations per person — narrowed to a single recovery per person per collection method by SB 2979 (signed 2 August 2024), which the Seventh Circuit held applies retroactively on 1 April 2026. Strip, do not analyze.
### 2. Extract without framing
Pass one. Produce three artifacts per candidate, with no fraud vocabulary in scope:
- **Claim ledger.** Every checkable assertion made in the loop, with the round and timestamp, normalized against `claim_set`. "Led the migration off Postgres 11 in 2023" is checkable. "I'm a strong collaborator" is not; drop it.
- **Timing profile.** Per answer: elapsed seconds from question end to first substantive word, total answer length, and the position of the longest intra-answer pause. Raw numbers only.
- **Register profile.** Per answer: a description of vocabulary level, sentence structure, and specificity, without comparison across answers.
### 3. Score against the taxonomy
Pass two reads the pass-one artifacts and `references/1-signal-taxonomy.md`. Four classes:
- **A — Identity continuity.** Appearance or voice descriptions that shift across rounds where interviewers noted it in writing; the equipment address diverging from the identity-document address; the same phone or email appearing on unrelated applications.
- **B — Channel and infrastructure.** Repeated declines of unscheduled live video where a policy exists and was applied uniformly; multiple candidates presenting from one IP; remote-desktop artifacts visible in shared screens.
- **C — Answer provenance.** Latency that inverts — long lead-in before easy factual answers, short before hard synthesis ones; register discontinuity between spontaneous exchanges and set-piece answers; answers that restate the interviewer's question near-verbatim before answering; specificity that collapses under an unscripted follow-up. Disabled when `ai_use_policy` is not `prohibited`.
- **D — Record contradiction.** Loop claims contradicted by `claim_set` or by a public artifact the candidate themselves cited.
Each signal returns `corroborated`, `unresolved`, or `contradiction`. There is no `fraudulent` value and no aggregate fraud score. Weights sum to a *verification priority*, which orders a queue and nothing else.
### 4. Apply the excluded-signals blocklist
Before anything is reported, drop every signal on the blocklist in `references/1-signal-taxonomy.md` section 4. Accent, non-native phrasing, name origin, home background, webcam or bandwidth quality, virtual-background use, and timezone alone are excluded. Each correlates with national origin, race, disability, or socioeconomic status, and each is the exact vector by which a fraud screen becomes a disparate-impact claim. The blocklist is enforced at output, so a signal reaching the report has already survived it.
Camera reluctance is a special case and is scored only when a written, uniformly-applied camera policy exists and an accommodation path was offered. Absent both, the skill reports the policy gap instead of the candidate.
### 5. Compute the posterior and the queue
Convert priority to an explicit probability using `base_rate` and the taxonomy's per-class false-positive estimates, and print it next to every flag. See *Base rates*. Then order the verification queue by posterior times role risk, where role risk comes from the intake template's access-level field. A production-credentials role and a marketing-coordinator role with the same posterior are not the same problem.
### 6. Emit the report
Per candidate: the corroboration table, the posterior with its inputs shown, the specific unresolved items phrased as questions for the verification step, and the excluded signals that were dropped and why. Contradictions print with both the loop quote and the conflicting claim verbatim, so a human reads the evidence rather than the conclusion.
## Base rates
The single most common way a fraud screen fails is arithmetic. With prior `p`, recall `r`, and false-positive rate `f`, the probability that a flagged candidate is actually fraudulent is:
```
PPV = (p * r) / (p * r + (1 - p) * f)
```
At `p = 0.02`, `r = 0.80`, `f = 0.05`: PPV = 0.016 / (0.016 + 0.049) = **24.6%**. Three flags in four are innocent people. At `p = 0.10` and the same screen, PPV rises to 64%.
Two consequences the skill enforces rather than mentions. Flags open a verification step, because a 24.6% posterior cannot carry a rejection. And flag volume is a capacity number: 100 loops per month at `p = 0.02` and `f = 0.05` produces about 6.5 flags per month, of which 1.6 are real. If your verification step cannot absorb 6-7 structured re-interviews a month, tune `f` down in the taxonomy before running, not after the queue backs up.
## Why text and process, not media
Two reasons, and either alone would be sufficient.
**Accuracy.** Deepfake detectors collapse out of distribution. Published cross-dataset benchmarks show detectors near-perfect on their training distribution falling to chance-adjacent on unseen generators — one widely-benchmarked detector drops from 0.998 AUC in-dataset to 0.674 cross-dataset, and to 0.633 on Celeb-DF. The adversary chooses the generator. A detector you cannot benchmark against the generator actually in use gives you a number, not a control.
**Law.** Face-geometry and voiceprint analysis of candidates is biometric collection under BIPA and its successors, with the consent and retention duties and per-person statutory damages in step 1. Affect inference from that same data in a hiring context is prohibited outright in the EU under Article 5(1)(f), with penalties up to €35 million or 7% of worldwide annual turnover. Text-and-process analysis of records you already lawfully hold carries neither exposure.
Real-time media detection has a place — at the stream layer, from a vendor who can attest to their benchmark set. It is a different control at a different layer, and it does not replace corroboration.
## Output format
```markdown
## Verification queue — req ENG-2291, loop closed 2026-07-24
### 1. Candidate C-4471 — posterior 31% — role risk HIGH — VERIFY
Inputs: base_rate 0.02 · recall 0.80 · class-weighted FPR 0.036
| Class | Signal | Status | Evidence |
|---|---|---|---|
| D | Postgres migration year | contradiction | Round 2 14:02 "we cut over in early 2023"; resume lists the role ending Nov 2022 |
| C | Latency inversion | unresolved | Factual recall 9.4s mean lead-in; open-ended design 1.8s mean |
| A | Equipment address | unresolved | Shipping ZIP 07102 vs identity-document ZIP 94103 |
| B | Live video | corroborated | Two unscheduled calls accepted, 2026-07-11 and 2026-07-18 |
Questions for verification (see references/3-verification-playbook.md §2):
1. Walk through the cutover timeline against the employment dates on the application.
2. Unscripted depth probe on the migration's rollback plan.
3. Confirm the shipping address against the identity document at offer stage.
Excluded and not reported: 2 signals (bandwidth quality, phrasing register vs. first language).
### 2. Candidate C-4468 — posterior 6% — role risk LOW — NO ACTION
All four classes corroborated or unresolved-immaterial. No verification step.
---
Loop total: 11 candidates · 1 verification · 0 contradictions unresolved after verification
Counsel review queue: 1 item — FCRA characterization of the corroboration report if the
verification outcome contributes to a no-hire. See references/3-verification-playbook.md §5.
```
## Watch-outs
- **A flag gets treated as a finding.** *Guard:* every flag prints its posterior with inputs beside it, and no output field is a rejection ground. The verification outcome is the only decision input.
- **Confirmation bias from a primed extractor.** *Guard:* pass one runs with no fraud vocabulary in context; the taxonomy loads only in pass two.
- **Proxy discrimination through demeanor signals.** *Guard:* the section-4 blocklist is enforced at output, and dropped signals print in the report so the exclusion is auditable.
- **Camera reluctance scored against a candidate with an accommodation need.** *Guard:* the signal scores only where a written uniform policy and an offered accommodation path both exist; otherwise the skill reports the policy gap.
- **Biometric material arriving with the record.** *Guard:* step 1 refuses to run on consent-gated artifacts without a cited consent record, and instructs stripping rather than analysis.
- **The screen runs where AI use is allowed.** *Guard:* `ai_use_policy` gates signal class C, and the default is `prohibited` so the setting is a deliberate act.
- **Verification capacity is overrun and flags age out silently.** *Guard:* step 5 prints expected monthly flag volume from `base_rate` and the taxonomy FPR before the first run, and the queue is ordered by posterior times role risk so the tail is the part that waits.
- **The report becomes discovery material.** *Guard:* the playbook's decision log records verification outcomes and closes each flag explicitly. An open flag with no recorded outcome is the artifact that hurts you later.
# Signal taxonomy
checked: 2026-07-29
maintainer: <your name>
review cadence: every 90 days, or on any change to the hiring AI-use policy
The skill reads weights, false-positive estimates, and the exclusion blocklist from this file. Edit the numbers to match your pipeline; do not edit them to make a candidate fit.
---
## 0. Parameters
| Parameter | Default | Set it from |
|---|---|---|
| `base_rate` | 0.02 | Your own confirmed cases over loops run in the last 12 months. If you have none, keep 0.02 and treat every posterior as an upper bound. |
| `recall` | 0.80 | Assumption, not a measurement. Lower it to 0.6 if your loops are under 45 minutes — short loops give class C almost nothing to work with. |
| `role_risk` | see §5 | The access the role gets on day one, not seniority. |
| `ai_use_policy` | `prohibited` | Your published candidate-facing policy. If nothing is published, the answer is `permitted` — you cannot screen against an unstated rule. |
Class-weighted false-positive rate is computed from the per-signal `fpr` column below across the classes that are enabled.
---
## 1. Class A — Identity continuity
Whether the person in round 3 is the person in round 1, and whether that person is the applicant.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Interviewer noted in writing that appearance or voice differed from a prior round | 0.30 | 0.02 | Only counts from a contemporaneous written note, never from a later recollection. |
| Equipment-shipping address diverges from the identity-document address | 0.20 | 0.08 | High innocent base — sublets, family addresses, mid-move candidates. |
| Same phone or email on an unrelated application under a different name | 0.30 | 0.01 | Strong when it is exact-match, worthless when it is fuzzy. |
| Application-source record inconsistent with the candidate's account of how they applied | 0.10 | 0.15 | Weak. Included because it is cheap, excluded from the queue on its own. |
| Reference contact details resolve to a domain registered inside 90 days | 0.20 | 0.03 | Check the domain, not the person. |
## 2. Class B — Channel and infrastructure
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Declined 2+ unscheduled live video requests under a written uniform policy | 0.20 | 0.10 | Scores ONLY with the policy and the accommodation path in place. See §4. |
| Multiple concurrent candidates presenting from one IP | 0.35 | 0.01 | Ask IT for the join records; do not infer from the recording. |
| Remote-desktop or screen-relay artifacts visible during a shared screen | 0.25 | 0.05 | Chrome Remote Desktop, AnyDesk, TeamViewer, RustDesk banners. Legitimate on a work-issued machine — check whose machine it is before scoring. |
| Second voice audible or a second person's cursor visible | 0.35 | 0.02 | Also fires on a noisy household. Requires the interviewer's written note. |
## 3. Class C — Answer provenance
Disabled entirely unless `ai_use_policy` is `prohibited`. All four need utterance timestamps; without them the class returns `unavailable`, not `corroborated`.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Latency inversion — longer lead-in on factual recall than on open synthesis | 0.25 | 0.12 | The characteristic shape of retrieval-then-read. Also the shape of an anxious candidate warming up; treat 0.12 as optimistic. |
| Register discontinuity between spontaneous exchange and set-piece answer | 0.20 | 0.15 | Highest innocent rate in the taxonomy. Prepared answers are prepared. |
| Interviewer's question restated near-verbatim before the answer begins | 0.15 | 0.10 | Artifact of transcription-then-generation. Also a normal stalling habit. |
| Specificity collapses on an unscripted follow-up to a detailed answer | 0.30 | 0.06 | The strongest signal in the class, and the one that needs an interviewer trained to ask the follow-up. |
If your interviewers do not routinely ask one unscripted depth follow-up per detailed answer, fix that before running this skill. It costs nothing and it outperforms every other signal here.
## 4. Excluded signals — never reported, enforced at output
Each of these correlates with a protected characteristic and produces a disparate-impact vector rather than a fraud signal. The skill drops them and prints that it dropped them.
- Accent, prosody, or non-native phrasing
- Name origin, transliteration, or spelling convention
- Home or office background, furnishings, or visible household members
- Webcam resolution, lighting, or bandwidth quality
- Virtual-background or background-blur use
- Timezone, or working hours, in isolation
- Employment gaps
- Typing speed, or written-English fluency, as a standalone signal
- Any inference of emotion, confidence, honesty, nervousness, or engagement from voice or video — prohibited in the EU under AI Act Article 5(1)(f) for workplace and recruitment contexts, and unsupported everywhere else
Camera reluctance is scored under class B only where BOTH a written camera policy applied uniformly across the req AND an offered accommodation path are recorded. Where either is missing, the skill reports the policy gap and scores nothing.
## 5. Role risk
| Level | Definition | Multiplier |
|---|---|---|
| HIGH | Production credentials, customer PII, payments, or source-code write access on day one | 1.5 |
| MEDIUM | Internal systems, no production or customer data | 1.0 |
| LOW | No systems access beyond email and documents in the first 30 days | 0.6 |
Role risk orders the queue. It never changes a posterior — a 6% posterior on a HIGH-risk role is still 6%.
## 6. Biometric and consent-gated material — strip, do not analyze
Presence of any of these in the record halts the run until a consent artifact is cited:
- Voiceprint or speaker-embedding files
- Face-geometry templates or facial-landmark exports
- Third-party AI-video-analysis scores attached to an Illinois-based candidate
- Any vendor "authenticity", "integrity", or "confidence" score derived from the media stream
The skill's analysis is text and metadata only. These arrive attached to exports and are the most common reason a text-only screen acquires biometric exposure it never needed.
# Interview record intake
Fill one copy per requisition. The lawful-basis column is not decoration — answer it before the field is collected, because the cheapest way to fail this workflow is to assemble a record you had no basis to assemble.
req_id: ENG-2291
work_locations: [Remote-US: CA, NY, IL, TX]
ai_use_policy: prohibited
policy_published_at: https://example.com/careers/ai-use-policy
base_rate: 0.02
checked: 2026-07-29
---
## Section A — Per-candidate loop record
One row per round. Timestamps are required for signal class C; mark `NO_TIMESTAMPS` rather than leaving blank, so the skill reports the class as unavailable instead of scoring it silently.
| candidate_id | round | date | interviewer | transcript_path | timestamps | interviewer_written_notes |
|---|---|---|---|---|---|---|
| C-4471 | recruiter screen | 2026-07-08 | R. Ade | records/C-4471/r1.txt | yes | records/C-4471/r1-notes.md |
| C-4471 | technical 1 | 2026-07-14 | M. Osei | records/C-4471/r2.txt | yes | records/C-4471/r2-notes.md |
| C-4471 | system design | 2026-07-21 | M. Osei | records/C-4471/r3.txt | NO_TIMESTAMPS | records/C-4471/r3-notes.md |
| C-4468 | recruiter screen | 2026-07-09 | R. Ade | records/C-4468/r1.txt | yes | records/C-4468/r1-notes.md |
Lawful basis for this section: interview records created by you, in the ordinary course, with candidate notice at scheduling. Recording requires consent in all-party-consent states — confirm the notice text covers analysis, not only recording.
## Section B — Process facts
Pulled from the ATS and IT, not from the candidate. Leave a cell `UNKNOWN` rather than estimating it.
| candidate_id | reschedules | unscheduled_video_declines | equipment_ship_zip | id_document_zip | contact_reuse_hits | application_source | reference_domains_age_days |
|---|---|---|---|---|---|---|---|
| C-4471 | 2 | 0 | 07102 | 94103 | 0 | inbound-careers | 412 |
| C-4468 | 0 | 0 | 30303 | 30303 | 0 | referral | 2100 |
Lawful basis for this section: employment-administration records you already hold. `id_document_zip` is populated at offer stage only, from the right-to-work document — never requested earlier as a screening input, which would invert the order the law expects.
`contact_reuse_hits` counts exact matches of phone or email across applications under a different candidate name, within your own ATS. Do not extend this to purchased identity-graph data; that changes the FCRA analysis in a direction you do not want.
## Section C — Claim set
The corroboration baseline. A contradiction only exists against something written down first.
| candidate_id | resume_path | application_answers_path | portfolio_urls | take_home_path |
|---|---|---|---|---|
| C-4471 | claims/C-4471/resume.pdf | claims/C-4471/application.json | github.com/example, example.dev | claims/C-4471/takehome/ |
| C-4468 | claims/C-4468/resume.pdf | claims/C-4468/application.json | — | — |
## Section D — Role risk
| req_id | day_one_access | role_risk | rationale |
|---|---|---|---|
| ENG-2291 | production DB read/write, customer PII | HIGH | On-call rotation from week 3 |
Answer for day one, not for month six. A role that earns production access after a 90-day probation is MEDIUM, and the probation itself is the control.
## Section E — Consent and notice prerequisites
Check before the first run. A `NO` here halts the run.
| Prerequisite | Applies when | Status | Artifact |
|---|---|---|---|
| Candidate notice that interview records are analyzed | always | YES | https://example.com/careers/ai-use-policy |
| All-party recording consent captured | recording in a two-party-consent state | YES | ats://consent/ENG-2291 |
| Illinois AI Video Interview Act consent | AI analysis of video interviews, IL candidates | N/A | text-only analysis, no video analyzed |
| BIPA written release and retention schedule | any voiceprint or face-geometry collection | N/A | none collected — see taxonomy §6 |
| Written camera policy applied uniformly + accommodation path | scoring camera reluctance | NO | not published — class B camera signal disabled |
The last row is the common one. Absent both artifacts, the skill scores nothing on camera reluctance and reports the gap against the process rather than the candidate.
## Section F — Verification capacity
| Loops per month | base_rate | class-weighted FPR | Expected flags/mo | Verification slots/mo | Headroom |
|---|---|---|---|---|---|
| 100 | 0.02 | 0.05 | 6.5 | 8 | +1.5 |
If headroom is negative, raise the taxonomy weights to tighten the screen before running. A queue that outruns capacity does not fail loudly — it ages, and the tail is where the real case sits.
# Verification playbook
What happens after a flag. The screen produces a queue; this file produces an outcome. A flag with no recorded outcome is the artifact that hurts you in a later charge, so section 4 is not optional.
checked: 2026-07-29
---
## 1. Pick the verification method
Ordered by strength. Use the cheapest one that resolves the specific unresolved items, not the strongest one available.
| Method | Resolves | Cost | Use when |
|---|---|---|---|
| Onsite or in-person final round | Identity substitution, proxy, real-time assistance — all three at once | Travel, 3-6 hours | HIGH role risk and a posterior above 20%. The strongest control on this list, and it needs no skill to run. |
| Live structured re-verification (§2) | Answer provenance, record contradictions | 45 min | The default. Most flags resolve here. |
| Right-to-work document check at offer | Identity, address divergence | Built into your existing offer process | Class A signals. Already happening — just sequence it before equipment ships. |
| Direct employer and institution verification | Record contradictions on employment or education | 2-5 business days | Class D contradictions. Contact the institution directly, never the reference number the candidate supplied. |
| Paid work sample, observed live | Real-time assistance, competence substitution | 2-4 hours, paid at market rate | Where class C is the whole flag and the role is hands-on. Pay for it; an unpaid extra round on a flagged candidate is a fairness problem on top of everything else. |
Do not add a proctoring or lockdown-browser layer as the response. It moves the loop toward surveillance, disadvantages candidates on shared connections and assistive technology, and resolves less than a single well-run live follow-up.
## 2. Live structured re-verification — protocol
45 minutes, same interviewer where possible, camera on for both sides, no recording beyond your standard practice.
**Do not tell the candidate they are suspected of fraud.** Say what is true: there are specifics from the earlier round you want to go deeper on. A candidate told they are under suspicion performs worse whether or not they did anything, which corrupts the only measurement you have left.
Structure:
1. **Rapport, 5 min.** Unscripted, unscored. Establishes the spontaneous-register baseline that step 3 compares against.
2. **Depth probes on the flagged claims, 25 min.** Take each unresolved item from the report. Ask the candidate to walk the specific decision, then ask one unscripted follow-up they could not have prepared: what broke, who disagreed, what you would do differently. Prepared and retrieved answers both thin out here; lived experience does not.
3. **Register comparison, inline.** The interviewer notes whether depth-probe answers match the section-1 baseline in vocabulary and specificity. Written note, contemporaneous.
4. **Contradiction, direct, 10 min.** Read the contradiction back verbatim — the loop quote and the conflicting claim — and ask them to reconcile it. Most contradictions are resume compression or a date error and resolve in one sentence. Give that sentence room.
5. **Close, 5 min.** Standard candidate questions. Do not signal the outcome.
## 3. Scoring the verification
One of four outcomes per flag. Nothing else.
- `RESOLVED` — the unresolved items are now corroborated. Close the flag, proceed with the loop normally, and record it. The candidate carries no residue into the decision.
- `RESOLVED_WITH_CORRECTION` — a claim was wrong and the candidate corrected it. This is a normal resume-accuracy matter and goes to the hiring manager on the ordinary path, not through this workflow.
- `UNRESOLVED` — the items are still open after a fair attempt. Escalate to §5 before any decision. Do not reject on `UNRESOLVED` without that step.
- `CONTRADICTED` — the candidate's account is inconsistent with a document they themselves supplied, restated and unreconciled. Route to §5 with the artifacts attached.
There is no `FRAUDULENT` outcome. That determination sits with counsel and, where sanctions or identity theft are in play, with law enforcement.
## 4. Decision log — fill one per flag
```
flag_id: F-2291-003
candidate_id: C-4471
opened: 2026-07-24
posterior_at_open: 0.31
role_risk: HIGH
unresolved_items: [D-migration-year, C-latency-inversion, A-address-divergence]
method: live structured re-verification
conducted: 2026-07-29 by M. Osei
outcome: RESOLVED_WITH_CORRECTION
notes: Cutover was Nov 2022 under the prior employer; resume date correct,
round-2 recollection wrong. Rollback plan detail was specific and
matched the public postmortem the candidate had cited.
Address divergence: sublet, lease provided at offer stage.
closed: 2026-07-29
decision_impact: none — candidate proceeded to offer
```
Every field populated, every flag closed. An open flag on a candidate you declined for unrelated reasons is the worst possible record to hold.
## 5. Escalation and counsel review
Send to counsel, with the report and the decision log, when any of these hold:
- Outcome is `UNRESOLVED` or `CONTRADICTED` on a HIGH-risk role.
- Class A signals point at identity substitution rather than answer assistance. Sanctions exposure attaches to who is employed, not to how well they interviewed — DOJ enforcement to date has treated employers as victims, and OFAC has not filed against inadvertent employers, but both have signaled expectations of diligence.
- The candidate is in Illinois and any biometric artifact was collected at any point in the loop.
- The verification outcome will contribute to a no-hire, and any part of the corroboration input came from a third-party vendor. Under CFPB Circular 2024-06, third-party algorithmic scores about workers used for employment decisions are often consumer reports, which pulls in the pre-adverse-action sequence: the report and a summary of rights to the candidate, a waiting period, then the final notice. Whether your setup crosses that line is a counsel call, not a skill output.
## 6. Candidate notice — scaffolding
Publish this before the first run, not after the first flag. Adapt the bracketed parts.
> **How we review interviews.** We review interview transcripts and application records for consistency, and we do this for every candidate in a requisition, not for selected individuals. We do not analyze video, faces, voices, or emotional expression, and no automated output decides whether you are hired.
>
> If our review leaves something unresolved, we ask you about it directly in a follow-up conversation before any decision is made. You can ask what was unresolved and respond to it.
>
> [Our policy on AI assistance during interviews is here.] Records are retained for [N] months and then deleted, except where a longer retention period is required by law.
The second paragraph is the one that does the work. A screen the candidate can answer is defensible; one they cannot is not.
