Un skill de Claude que lee las transcripciones de entrevistas y los metadatos del proceso que tu ATS ya guarda, y devuelve un informe de corroboración por candidato: qué confirma el registro, qué contradice y qué preguntas quedan abiertas. Los candidatos marcados pasan a un paso de verificación en vivo. No pasan a un rechazo: el skill no tiene ningún campo de salida capaz de sostenerlo, y la aritmética de la siguiente sección explica por qué.
Nunca toca el archivo de video. Sin geometría facial, sin huella de voz, sin frecuencia de parpadeo, sin puntuación de afecto. Esa restricción es el diseño, no una carencia del diseño.
El número que define el diseño
Un filtro de fraude vive o muere por su tasa base. Con una probabilidad previa de 2% de candidatos fraudulentos que llegan a una entrevista en vivo, un filtro que detecta el 80% de ellos con una tasa de falsos positivos del 5% produce un 24,6% de probabilidad de que cualquier marca dada sea real. Tres de cada cuatro marcas son personas inocentes. Sube la probabilidad previa a 10% y el mismo filtro llega a 64%: sigue sin ser un número que rechace a nadie.
Por eso el skill enruta las marcas a verificación y se detiene ahí. Un seguimiento estructurado de 45 minutos resuelve la mayoría, y el resultado de esa conversación — no la puntuación — es lo que llega a la decisión de contratación. Esto también mantiene el workflow lejos del encuadre de sistema de decisión automatizada bajo la NYC Local Law 144 y las regulaciones ADS de FEHA en California, y acota la pregunta sobre FCRA: la Circular 2024-06 del CFPB sitúa las puntuaciones algorítmicas de terceros sobre trabajadores usadas para decisiones de empleo dentro de la FCRA, con deberes de consentimiento, divulgación y notificación previa a la acción adversa. Un filtro interno que activa una conversación está en un lugar distinto de una puntuación comprada que activa una oferta. El skill lo imprime como una pregunta para el área legal en vez de responderla.
Cuándo usarlo
Una vacante totalmente remota donde la entrevista es lo único que separa a un postulante de las credenciales de producción.
Roles que envían equipos antes del primer día. Que la dirección de envío difiera de la del documento de identidad es la señal más barata de la lista y nadie la mira.
Un candidato cuyo trabajo escrito y sus respuestas en vivo parecen de dos personas distintas, y el reclutador no sabe explicar por qué.
Vacantes de seguridad o IT en empresas dentro de la superficie de amenaza de los trabajadores IT de la RPDC. La estimación del Panel de Expertos de la ONU sitúa los ingresos anuales de ese programa en 250-600 millones de dólares, y CrowdStrike ha reportado actores norcoreanos haciéndose pasar por empleados internos en más de 100 empresas tecnológicas, principalmente estadounidenses.
Cuándo NO usarlo
Para rechazar a alguien. Mira la aritmética de arriba. Una probabilidad posterior de 24,6% que termina una candidatura es un filtro que discrimina contra la mayoría inocente de las personas que marca.
Como análisis forense de medios. Los detectores de deepfakes se derrumban fuera de su distribución. Los benchmarks entre conjuntos de datos muestran un detector con 0,998 AUC en su distribución de entrenamiento cayendo a 0,674 en un conjunto no visto y a 0,633 en Celeb-DF. El adversario elige el generador. Un detector que no puedes evaluar contra el generador realmente en uso devuelve un número, no un control.
Para inferir emoción, estrés u honestidad. El Artículo 5(1)(f) del EU AI Act prohíbe inferir emociones de una persona física en el lugar de trabajo a partir de datos biométricos, y las directrices de la Comisión de febrero de 2025 sobre prácticas prohibidas leen «lugar de trabajo» de forma que cubre a los candidatos durante la selección y la contratación. Las sanciones llegan a 35 millones de euros o el 7% de la facturación anual mundial. La detección de engaño por comportamiento tampoco tiene respaldo, así que la prohibición no cuesta nada.
Donde el uso de IA está permitido. Define la política primero y publícala. ai_use_policy viene por defecto en prohibited para que apagar la clase de procedencia de respuestas sea un acto deliberado; pero si no hay nada publicado, el valor honesto es permitted, porque no puedes filtrar contra una regla que nunca enunciaste.
De forma retroactiva, sobre un pipeline cerrado. Correr esto sobre los postulantes rechazados del año pasado construye un expediente de acusaciones no adjudicadas contra personas con nombre y apellido, exhibible en cualquier reclamo posterior, sin ningún paso de verificación disponible para exonerar a nadie.
En entrevistas presenciales. Tanto la sustitución de identidad como la asistencia en vivo necesitan el canal remoto. Una ronda final presencial es el control más fuerte y no necesita ningún skill.
Configuración
Coloca el bundle que está en apps/web/public/artifacts/ai-interview-fraud-detection-skill/SKILL.md en tu directorio de skills, con references/ al lado.
Define los parámetros en references/1-signal-taxonomy.md §0. base_rate sale de tus propios casos confirmados de los últimos 12 meses; si no tienes ninguno, deja 0.02 y lee cada probabilidad posterior como una cota superior. El archivo lleva una fecha checked: y una cadencia de revisión de 90 días.
Llena el formulario de ingesta en references/2-interview-record-intake.md. La sección A pide marcas de tiempo por intervención: escribe NO_TIMESTAMPS donde no las tengas, para que el skill reporte la clase de procedencia de respuestas como no disponible en vez de puntuarla sobre nada.
Responde la sección E antes de la primera corrida. Cinco requisitos de consentimiento y notificación; un NO detiene la ejecución. La fila que más falla es la política escrita de cámara, y sin ella el skill no puntúa nada sobre la reticencia a encenderla.
Revisa la capacidad de verificación en la sección F. Las marcas son un número de capacidad, no una señal de calidad: 100 entrevistas al mes con una probabilidad previa de 2% y una tasa de falsos positivos de 5% dan unas 6,5 marcas, de las cuales 1,6 son reales. Un margen negativo significa ajustar la taxonomía antes de correr, no después de que la cola se acumule.
Qué hace el skill en realidad
Seis pasos. Dos decisiones estructurales sostienen el diseño.
Dos pasadas, y el extractor nunca ve la taxonomía. La pasada uno saca el registro de afirmaciones, los números de latencia por respuesta y las descripciones de registro lingüístico sin ningún vocabulario de fraude en su contexto. La pasada dos puntúa esos hechos contra la taxonomía. Una sola pasada preparada fabrica lo que se le dijo que buscara: cada pausa se vuelve evasión en cuanto el modelo sabe que caza evasiones. La separación cuesta una llamada extra por candidato.
La lista de exclusión se aplica en la salida. El paso 4 descarta acento, fraseo no nativo, origen del nombre, fondo del hogar, calidad de cámara y de ancho de banda, uso de fondo virtual, zona horaria por sí sola y huecos de empleo. Cada uno correlaciona con origen nacional, raza, discapacidad o nivel socioeconómico, y cada uno es la ruta exacta por la que un filtro de fraude se convierte en un reclamo por sesgo en el screening con IA. Las señales descartadas se imprimen en el informe, así que la exclusión es auditable en vez de asumida.
Entre ambas, el paso 1 se niega a correr sobre material biométrico sujeto a consentimiento sin un registro de consentimiento citado: las huellas de voz y las exportaciones de geometría facial llegan adjuntas a las exportaciones de proveedores, y la BIPA de Illinois contempla daños estatutarios de 1.000 dólares por violación negligente y 5.000 por violación imprudente o intencional, por persona. La SB 2979, firmada el 2 de agosto de 2024, lo redujo a una única recuperación por persona y por método de recolección, y el Séptimo Circuito resolvió el 1 de abril de 2026 que esa reducción se aplica retroactivamente. La exposición es menor que antes y no es cero. Elimina el material, no lo analices.
El paso 5 convierte la prioridad en una probabilidad posterior y ordena la cola por posterior multiplicada por riesgo del rol, donde el riesgo del rol es el acceso del primer día y no la seniority. El paso 6 imprime las contradicciones con la cita textual de la entrevista y la afirmación en conflicto, para que quien lee vea evidencia en vez de una conclusión.
Costo real
Por entrevista completa — un loop de cuatro rondas de 45 minutos consume 40-55k tokens de entrada de transcripción más unos 8k de archivos de referencia, y 3-5k de salida entre las dos pasadas. A tarifas de lista de Claude Sonnet (3 dólares por millón de entrada, 15 por millón de salida) eso da 0,20-0,35 dólares por candidato. Estimación, a partir del conteo de tokens de transcripciones de esa duración.
A volumen — 100 loops al mes quedan en 20-35 dólares de gasto de modelo. El costo que importa es el paso de verificación: 6-7 seguimientos estructurados de 45 minutos al mes, más la preparación del entrevistador, son unas 8-10 horas de tiempo cargado de entrevistador.
Configuración — 90 minutos, y ese número solo es honesto si tu ATS ya exporta transcripciones con marcas de tiempo. Los equipos que conectan la captura de transcripciones por primera vez gastan un día o más, y la capa de interview intelligence es el prerrequisito.
Lo que no ahorra — la ronda presencial. Para un rol de riesgo ALTO con una probabilidad posterior sobre 20%, el viaje cuesta menos que la alternativa y resuelve las tres clases de fraude a la vez.
Métrica de éxito
Volumen de marcas siguiendo la tasa predicha. Si una probabilidad previa de 2% predice 6,5 marcas y obtienes 30, la taxonomía está mal calibrada, no el pipeline comprometido.
Cada marca cerrada con un resultado registrado. El registro de decisiones en references/3-verification-playbook.md §4 no tiene estado parcial. Una marca abierta sobre un candidato descartado por razones ajenas es el peor registro que puedes conservar.
Proporción de RESOLVED sobre 70%. La mayoría de las marcas debe despejarse en la verificación. Una proporción menor significa que el filtro dispara sobre ruido.
Cero apariciones de señales excluidas en los informes. Un chequeo determinista que nunca debería dispararse.
Frente a las alternativas
Frente a proveedores de detección de deepfakes en tiempo real. Pindrop, Reality Defender y las capas de detección ya integradas en las plataformas de videoconferencia trabajan sobre el flujo de medios, que este skill deliberadamente no toca. Son complementarios, no redundantes, y vale la pena comprarlos solo a un proveedor dispuesto a declarar su conjunto de evaluación, dados los números entre conjuntos de datos de arriba. Verifican los píxeles. No verifican que quien responde sepa lo que declaró en el currículum.
Frente a proveedores de verificación de identidad. Los chequeos de documento más prueba de vida en la etapa de oferta son el control correcto para la clase A, y probablemente ya corres algo como Checkr junto a ellos. Verifican quién firmó. No verifican quién hace el trabajo desde la segunda semana, que es donde vive el patrón de las granjas de laptops.
Frente a proctoring y navegadores bloqueados. Más baratos de comprar, peores de operar. Empujan la entrevista hacia la vigilancia, penalizan a candidatos con conexiones compartidas y tecnología asistiva, y resuelven menos que un solo seguimiento en profundidad bien hecho.
Frente a una plataforma de evaluación técnica.Karat y similares corren entrevistas humanas en vivo que resisten estructuralmente tanto al proxy como al copiloto. Donde el presupuesto alcanza, esta es una respuesta más fuerte que cualquier filtro: el skill es para las rondas que corres tú.
Frente al statu quo. Los humanos sin entrenamiento detectan medios sintéticos cerca del azar. El statu quo real no es «los reclutadores lo cachan» sino «nadie mira», y el costo marginal de mirar es 0,30 dólares por candidato.
Puntos de cuidado
Una marca leída como un hallazgo.Guarda: cada marca imprime su probabilidad posterior con los insumos al lado, y ningún campo de salida sirve como causal de rechazo.
Sesgo de confirmación por un extractor preparado.Guarda: la pasada uno corre sin vocabulario de fraude en contexto; la taxonomía se carga solo en la pasada dos.
Discriminación indirecta a través del comportamiento.Guarda: la lista de exclusión de la §4 se aplica en la salida y las señales descartadas se imprimen.
Reticencia a la cámara puntuada contra una necesidad de acomodación.Guarda: la señal solo puntúa donde existen una política escrita aplicada de forma uniforme y una vía de acomodación ofrecida; si no, el skill reporta el hueco de política en vez del candidato.
Artefactos biométricos que llegan con la exportación.Guarda: el paso 1 se detiene ante material sujeto a consentimiento sin un registro citado.
Capacidad de verificación desbordada.Guarda: el volumen mensual esperado de marcas se imprime antes de la primera corrida, y la cola se ordena por posterior por riesgo del rol, de modo que lo que espera es la cola larga.
El informe se convierte en material de exhibición judicial.Guarda: el registro de decisiones del playbook cierra cada marca explícitamente, y la §6 publica la notificación al candidato antes de la primera corrida en vez de después de la primera marca.
Stack
El bundle vive en apps/web/public/artifacts/ai-interview-fraud-detection-skill/ y contiene:
SKILL.md — la definición del skill
references/1-signal-taxonomy.md — cuatro clases de señales con pesos y estimaciones de falsos positivos, la lista de señales excluidas y los parámetros de tasa base
references/2-interview-record-intake.md — formulario de ingesta con una columna de base legal por campo
references/3-verification-playbook.md — métodos de verificación, el protocolo de reverificación en vivo, el registro de decisiones y la plantilla de notificación al candidato
Asume Claude para la ejecución, un ATS como Greenhouse para los hechos del proceso, y una fuente de transcripciones — Metaview o equivalente — para la sección A.
---
name: ai-interview-fraud-detection
description: Screen an interview record — transcripts plus loop metadata you already hold — for identity-substitution, proxy-interview, and real-time answer-assistance signals, and emit a corroboration report that routes named candidates to a live verification step. Works on text and process facts, never on biometric or affect analysis. Produces a verification queue, never a fraud verdict and never a rejection.
---
# AI interview fraud detection
## When to invoke
Use this skill when a remote hiring loop has finished or is mid-flight and someone needs to know which candidates carry unresolved corroboration gaps before an offer goes out. It reads the interview transcripts and the process record around them, and returns a per-candidate report separating what the record corroborates from what it contradicts.
The output is an input to a verification step — a live structured re-interview, a document check, a reference call. It is not an input to a hiring decision. That separation is load-bearing and section *Method* explains why.
Typical triggers: a fully-remote engineering or IT req, a role with production-system or customer-data access, a candidate whose written work and live answers read as different people, a req where equipment ships before day one.
Do NOT invoke this skill for:
- **Rejecting a candidate.** No output field is a rejection ground. Section *Base rates* shows why: at a 2% prior and a 5% false-positive rate, roughly 3 in 4 flags are innocent candidates. A flag that rejects is a screen that discriminates against the innocent majority of the flagged set.
- **Media forensics.** The skill does not analyze video frames, face geometry, voiceprints, blink rate, or micro-expressions. It never touches the media file. Section *Why text and process, not media* gives the accuracy reason and the legal reason.
- **Inferring emotion, confidence, honesty, or stress.** EU AI Act Article 5(1)(f) prohibits AI systems that infer emotions of a natural person in the workplace from biometric data, and the Commission's February 2025 guidelines on prohibited practices read "workplace" to cover candidates during selection and hiring. Deception detection from demeanor is out of scope regardless of jurisdiction — it does not work, and it converts an interview into a polygraph.
- **Screening for AI use where AI use is permitted.** Decide the policy first. If candidates are told they can use an assistant, answer-provenance signals are noise. Set `ai_use_policy` and the skill drops signal class C.
- **Retroactive sweeps of a closed pipeline.** Running this across last year's rejected candidates manufactures a dataset of unadjudicated accusations against named people, discoverable in any later charge, with no verification step available to clear anyone. Run it forward-looking only.
- **In-person loops.** Identity substitution and real-time assistance both require the remote channel. An onsite final round is the stronger and cheaper control; see `references/3-verification-playbook.md` section 1.
## Inputs
- Required: `interview_record` — per candidate, the transcripts of each round with speaker labels and utterance timestamps, plus the round type and the interviewer. Timestamps are what make answer-latency analysis possible; without them signal class C is unavailable and the skill says so rather than guessing. Template in `references/2-interview-record-intake.md`.
- Required: `claim_set` — the candidate's own assertions available to you before the loop: resume, application answers, portfolio or repository links, and any written take-home. This is the corroboration baseline. A contradiction is only meaningful against a recorded claim.
- Required: `process_facts` — the loop metadata your ATS and IT already hold: scheduling history, reschedule and no-show events, the address on file for equipment, the application-source record, and whether the same contact details appear on other applications. Section B of the intake template.
- Optional: `ai_use_policy` — `prohibited`, `permitted`, or `permitted_with_disclosure`. Default `prohibited`. Anything other than `prohibited` disables signal class C.
- Optional: `base_rate` — your estimated prior for fraudulent candidates reaching a live loop, as a decimal. Default 0.02. The skill uses it to compute expected flag volume and posterior probability; see *Base rates*.
- Optional: `jurisdictions` — work locations in scope. Controls which notice and consent prerequisites the preflight checks.
## Reference files
- `references/1-signal-taxonomy.md` — the four signal classes, per-signal weights, the excluded-signals blocklist, and the base-rate parameters. The skill reads weights from this file and never from model memory.
- `references/2-interview-record-intake.md` — fillable intake template with a lawful-basis column per field, so the collection question is answered before the analysis question.
- `references/3-verification-playbook.md` — what happens after a flag: the live re-verification protocol and script, the decision log, and the candidate-notice scaffolding.
## Method
Six steps, in order. Two structural choices drive the whole design and are worth stating before the steps.
**Two passes, and the extractor never sees the taxonomy.** Pass one extracts claims, timings, and contradictions with no fraud framing in its context at all. Pass two scores those extracted facts against `references/1-signal-taxonomy.md`. A single pass primed with a fraud taxonomy manufactures the signals it was told to look for — every hesitation becomes evasion once the model knows it is hunting for evasion. Splitting the passes costs one extra call per candidate and is the difference between a report about the record and a report about the prompt.
**The output routes to verification, not to a decision.** A flag opens a verification step whose *outcome* is the only thing that reaches the hiring decision. This keeps the skill out of automated-decision-system territory under California's FEHA ADS regulations and NYC Local Law 144, and it keeps the FCRA question narrow — CFPB Circular 2024-06 holds that algorithmic scores about workers obtained from third parties for employment decisions are often governed by the FCRA, with consent, disclosure, and pre-adverse-action duties attached. An in-house screen that gates a verification step rather than a decision sits in a different place than a purchased score that gates an offer. Where the line falls for your setup is a counsel question, and the skill prints it as one.
### 1. Preflight the collection basis
Refuse to run if the record contains material the intake template marks as consent-gated and no consent artifact is cited: voiceprint or face-geometry data under Illinois BIPA, or an Illinois AI Video Interview Act consent where video interviews are AI-analyzed. The skill's own analysis is text-only and does not itself trigger BIPA, but records assembled for it frequently arrive with biometric artifacts attached, and BIPA carries statutory damages of $1,000 for negligent and $5,000 for reckless or intentional violations per person — narrowed to a single recovery per person per collection method by SB 2979 (signed 2 August 2024), which the Seventh Circuit held applies retroactively on 1 April 2026. Strip, do not analyze.
### 2. Extract without framing
Pass one. Produce three artifacts per candidate, with no fraud vocabulary in scope:
- **Claim ledger.** Every checkable assertion made in the loop, with the round and timestamp, normalized against `claim_set`. "Led the migration off Postgres 11 in 2023" is checkable. "I'm a strong collaborator" is not; drop it.
- **Timing profile.** Per answer: elapsed seconds from question end to first substantive word, total answer length, and the position of the longest intra-answer pause. Raw numbers only.
- **Register profile.** Per answer: a description of vocabulary level, sentence structure, and specificity, without comparison across answers.
### 3. Score against the taxonomy
Pass two reads the pass-one artifacts and `references/1-signal-taxonomy.md`. Four classes:
- **A — Identity continuity.** Appearance or voice descriptions that shift across rounds where interviewers noted it in writing; the equipment address diverging from the identity-document address; the same phone or email appearing on unrelated applications.
- **B — Channel and infrastructure.** Repeated declines of unscheduled live video where a policy exists and was applied uniformly; multiple candidates presenting from one IP; remote-desktop artifacts visible in shared screens.
- **C — Answer provenance.** Latency that inverts — long lead-in before easy factual answers, short before hard synthesis ones; register discontinuity between spontaneous exchanges and set-piece answers; answers that restate the interviewer's question near-verbatim before answering; specificity that collapses under an unscripted follow-up. Disabled when `ai_use_policy` is not `prohibited`.
- **D — Record contradiction.** Loop claims contradicted by `claim_set` or by a public artifact the candidate themselves cited.
Each signal returns `corroborated`, `unresolved`, or `contradiction`. There is no `fraudulent` value and no aggregate fraud score. Weights sum to a *verification priority*, which orders a queue and nothing else.
### 4. Apply the excluded-signals blocklist
Before anything is reported, drop every signal on the blocklist in `references/1-signal-taxonomy.md` section 4. Accent, non-native phrasing, name origin, home background, webcam or bandwidth quality, virtual-background use, and timezone alone are excluded. Each correlates with national origin, race, disability, or socioeconomic status, and each is the exact vector by which a fraud screen becomes a disparate-impact claim. The blocklist is enforced at output, so a signal reaching the report has already survived it.
Camera reluctance is a special case and is scored only when a written, uniformly-applied camera policy exists and an accommodation path was offered. Absent both, the skill reports the policy gap instead of the candidate.
### 5. Compute the posterior and the queue
Convert priority to an explicit probability using `base_rate` and the taxonomy's per-class false-positive estimates, and print it next to every flag. See *Base rates*. Then order the verification queue by posterior times role risk, where role risk comes from the intake template's access-level field. A production-credentials role and a marketing-coordinator role with the same posterior are not the same problem.
### 6. Emit the report
Per candidate: the corroboration table, the posterior with its inputs shown, the specific unresolved items phrased as questions for the verification step, and the excluded signals that were dropped and why. Contradictions print with both the loop quote and the conflicting claim verbatim, so a human reads the evidence rather than the conclusion.
## Base rates
The single most common way a fraud screen fails is arithmetic. With prior `p`, recall `r`, and false-positive rate `f`, the probability that a flagged candidate is actually fraudulent is:
```
PPV = (p * r) / (p * r + (1 - p) * f)
```
At `p = 0.02`, `r = 0.80`, `f = 0.05`: PPV = 0.016 / (0.016 + 0.049) = **24.6%**. Three flags in four are innocent people. At `p = 0.10` and the same screen, PPV rises to 64%.
Two consequences the skill enforces rather than mentions. Flags open a verification step, because a 24.6% posterior cannot carry a rejection. And flag volume is a capacity number: 100 loops per month at `p = 0.02` and `f = 0.05` produces about 6.5 flags per month, of which 1.6 are real. If your verification step cannot absorb 6-7 structured re-interviews a month, tune `f` down in the taxonomy before running, not after the queue backs up.
## Why text and process, not media
Two reasons, and either alone would be sufficient.
**Accuracy.** Deepfake detectors collapse out of distribution. Published cross-dataset benchmarks show detectors near-perfect on their training distribution falling to chance-adjacent on unseen generators — one widely-benchmarked detector drops from 0.998 AUC in-dataset to 0.674 cross-dataset, and to 0.633 on Celeb-DF. The adversary chooses the generator. A detector you cannot benchmark against the generator actually in use gives you a number, not a control.
**Law.** Face-geometry and voiceprint analysis of candidates is biometric collection under BIPA and its successors, with the consent and retention duties and per-person statutory damages in step 1. Affect inference from that same data in a hiring context is prohibited outright in the EU under Article 5(1)(f), with penalties up to €35 million or 7% of worldwide annual turnover. Text-and-process analysis of records you already lawfully hold carries neither exposure.
Real-time media detection has a place — at the stream layer, from a vendor who can attest to their benchmark set. It is a different control at a different layer, and it does not replace corroboration.
## Output format
```markdown
## Verification queue — req ENG-2291, loop closed 2026-07-24
### 1. Candidate C-4471 — posterior 31% — role risk HIGH — VERIFY
Inputs: base_rate 0.02 · recall 0.80 · class-weighted FPR 0.036
| Class | Signal | Status | Evidence |
|---|---|---|---|
| D | Postgres migration year | contradiction | Round 2 14:02 "we cut over in early 2023"; resume lists the role ending Nov 2022 |
| C | Latency inversion | unresolved | Factual recall 9.4s mean lead-in; open-ended design 1.8s mean |
| A | Equipment address | unresolved | Shipping ZIP 07102 vs identity-document ZIP 94103 |
| B | Live video | corroborated | Two unscheduled calls accepted, 2026-07-11 and 2026-07-18 |
Questions for verification (see references/3-verification-playbook.md §2):
1. Walk through the cutover timeline against the employment dates on the application.
2. Unscripted depth probe on the migration's rollback plan.
3. Confirm the shipping address against the identity document at offer stage.
Excluded and not reported: 2 signals (bandwidth quality, phrasing register vs. first language).
### 2. Candidate C-4468 — posterior 6% — role risk LOW — NO ACTION
All four classes corroborated or unresolved-immaterial. No verification step.
---
Loop total: 11 candidates · 1 verification · 0 contradictions unresolved after verification
Counsel review queue: 1 item — FCRA characterization of the corroboration report if the
verification outcome contributes to a no-hire. See references/3-verification-playbook.md §5.
```
## Watch-outs
- **A flag gets treated as a finding.** *Guard:* every flag prints its posterior with inputs beside it, and no output field is a rejection ground. The verification outcome is the only decision input.
- **Confirmation bias from a primed extractor.** *Guard:* pass one runs with no fraud vocabulary in context; the taxonomy loads only in pass two.
- **Proxy discrimination through demeanor signals.** *Guard:* the section-4 blocklist is enforced at output, and dropped signals print in the report so the exclusion is auditable.
- **Camera reluctance scored against a candidate with an accommodation need.** *Guard:* the signal scores only where a written uniform policy and an offered accommodation path both exist; otherwise the skill reports the policy gap.
- **Biometric material arriving with the record.** *Guard:* step 1 refuses to run on consent-gated artifacts without a cited consent record, and instructs stripping rather than analysis.
- **The screen runs where AI use is allowed.** *Guard:* `ai_use_policy` gates signal class C, and the default is `prohibited` so the setting is a deliberate act.
- **Verification capacity is overrun and flags age out silently.** *Guard:* step 5 prints expected monthly flag volume from `base_rate` and the taxonomy FPR before the first run, and the queue is ordered by posterior times role risk so the tail is the part that waits.
- **The report becomes discovery material.** *Guard:* the playbook's decision log records verification outcomes and closes each flag explicitly. An open flag with no recorded outcome is the artifact that hurts you later.
# Signal taxonomy
checked: 2026-07-29
maintainer: <your name>
review cadence: every 90 days, or on any change to the hiring AI-use policy
The skill reads weights, false-positive estimates, and the exclusion blocklist from this file. Edit the numbers to match your pipeline; do not edit them to make a candidate fit.
---
## 0. Parameters
| Parameter | Default | Set it from |
|---|---|---|
| `base_rate` | 0.02 | Your own confirmed cases over loops run in the last 12 months. If you have none, keep 0.02 and treat every posterior as an upper bound. |
| `recall` | 0.80 | Assumption, not a measurement. Lower it to 0.6 if your loops are under 45 minutes — short loops give class C almost nothing to work with. |
| `role_risk` | see §5 | The access the role gets on day one, not seniority. |
| `ai_use_policy` | `prohibited` | Your published candidate-facing policy. If nothing is published, the answer is `permitted` — you cannot screen against an unstated rule. |
Class-weighted false-positive rate is computed from the per-signal `fpr` column below across the classes that are enabled.
---
## 1. Class A — Identity continuity
Whether the person in round 3 is the person in round 1, and whether that person is the applicant.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Interviewer noted in writing that appearance or voice differed from a prior round | 0.30 | 0.02 | Only counts from a contemporaneous written note, never from a later recollection. |
| Equipment-shipping address diverges from the identity-document address | 0.20 | 0.08 | High innocent base — sublets, family addresses, mid-move candidates. |
| Same phone or email on an unrelated application under a different name | 0.30 | 0.01 | Strong when it is exact-match, worthless when it is fuzzy. |
| Application-source record inconsistent with the candidate's account of how they applied | 0.10 | 0.15 | Weak. Included because it is cheap, excluded from the queue on its own. |
| Reference contact details resolve to a domain registered inside 90 days | 0.20 | 0.03 | Check the domain, not the person. |
## 2. Class B — Channel and infrastructure
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Declined 2+ unscheduled live video requests under a written uniform policy | 0.20 | 0.10 | Scores ONLY with the policy and the accommodation path in place. See §4. |
| Multiple concurrent candidates presenting from one IP | 0.35 | 0.01 | Ask IT for the join records; do not infer from the recording. |
| Remote-desktop or screen-relay artifacts visible during a shared screen | 0.25 | 0.05 | Chrome Remote Desktop, AnyDesk, TeamViewer, RustDesk banners. Legitimate on a work-issued machine — check whose machine it is before scoring. |
| Second voice audible or a second person's cursor visible | 0.35 | 0.02 | Also fires on a noisy household. Requires the interviewer's written note. |
## 3. Class C — Answer provenance
Disabled entirely unless `ai_use_policy` is `prohibited`. All four need utterance timestamps; without them the class returns `unavailable`, not `corroborated`.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Latency inversion — longer lead-in on factual recall than on open synthesis | 0.25 | 0.12 | The characteristic shape of retrieval-then-read. Also the shape of an anxious candidate warming up; treat 0.12 as optimistic. |
| Register discontinuity between spontaneous exchange and set-piece answer | 0.20 | 0.15 | Highest innocent rate in the taxonomy. Prepared answers are prepared. |
| Interviewer's question restated near-verbatim before the answer begins | 0.15 | 0.10 | Artifact of transcription-then-generation. Also a normal stalling habit. |
| Specificity collapses on an unscripted follow-up to a detailed answer | 0.30 | 0.06 | The strongest signal in the class, and the one that needs an interviewer trained to ask the follow-up. |
If your interviewers do not routinely ask one unscripted depth follow-up per detailed answer, fix that before running this skill. It costs nothing and it outperforms every other signal here.
## 4. Excluded signals — never reported, enforced at output
Each of these correlates with a protected characteristic and produces a disparate-impact vector rather than a fraud signal. The skill drops them and prints that it dropped them.
- Accent, prosody, or non-native phrasing
- Name origin, transliteration, or spelling convention
- Home or office background, furnishings, or visible household members
- Webcam resolution, lighting, or bandwidth quality
- Virtual-background or background-blur use
- Timezone, or working hours, in isolation
- Employment gaps
- Typing speed, or written-English fluency, as a standalone signal
- Any inference of emotion, confidence, honesty, nervousness, or engagement from voice or video — prohibited in the EU under AI Act Article 5(1)(f) for workplace and recruitment contexts, and unsupported everywhere else
Camera reluctance is scored under class B only where BOTH a written camera policy applied uniformly across the req AND an offered accommodation path are recorded. Where either is missing, the skill reports the policy gap and scores nothing.
## 5. Role risk
| Level | Definition | Multiplier |
|---|---|---|
| HIGH | Production credentials, customer PII, payments, or source-code write access on day one | 1.5 |
| MEDIUM | Internal systems, no production or customer data | 1.0 |
| LOW | No systems access beyond email and documents in the first 30 days | 0.6 |
Role risk orders the queue. It never changes a posterior — a 6% posterior on a HIGH-risk role is still 6%.
## 6. Biometric and consent-gated material — strip, do not analyze
Presence of any of these in the record halts the run until a consent artifact is cited:
- Voiceprint or speaker-embedding files
- Face-geometry templates or facial-landmark exports
- Third-party AI-video-analysis scores attached to an Illinois-based candidate
- Any vendor "authenticity", "integrity", or "confidence" score derived from the media stream
The skill's analysis is text and metadata only. These arrive attached to exports and are the most common reason a text-only screen acquires biometric exposure it never needed.
# Interview record intake
Fill one copy per requisition. The lawful-basis column is not decoration — answer it before the field is collected, because the cheapest way to fail this workflow is to assemble a record you had no basis to assemble.
req_id: ENG-2291
work_locations: [Remote-US: CA, NY, IL, TX]
ai_use_policy: prohibited
policy_published_at: https://example.com/careers/ai-use-policy
base_rate: 0.02
checked: 2026-07-29
---
## Section A — Per-candidate loop record
One row per round. Timestamps are required for signal class C; mark `NO_TIMESTAMPS` rather than leaving blank, so the skill reports the class as unavailable instead of scoring it silently.
| candidate_id | round | date | interviewer | transcript_path | timestamps | interviewer_written_notes |
|---|---|---|---|---|---|---|
| C-4471 | recruiter screen | 2026-07-08 | R. Ade | records/C-4471/r1.txt | yes | records/C-4471/r1-notes.md |
| C-4471 | technical 1 | 2026-07-14 | M. Osei | records/C-4471/r2.txt | yes | records/C-4471/r2-notes.md |
| C-4471 | system design | 2026-07-21 | M. Osei | records/C-4471/r3.txt | NO_TIMESTAMPS | records/C-4471/r3-notes.md |
| C-4468 | recruiter screen | 2026-07-09 | R. Ade | records/C-4468/r1.txt | yes | records/C-4468/r1-notes.md |
Lawful basis for this section: interview records created by you, in the ordinary course, with candidate notice at scheduling. Recording requires consent in all-party-consent states — confirm the notice text covers analysis, not only recording.
## Section B — Process facts
Pulled from the ATS and IT, not from the candidate. Leave a cell `UNKNOWN` rather than estimating it.
| candidate_id | reschedules | unscheduled_video_declines | equipment_ship_zip | id_document_zip | contact_reuse_hits | application_source | reference_domains_age_days |
|---|---|---|---|---|---|---|---|
| C-4471 | 2 | 0 | 07102 | 94103 | 0 | inbound-careers | 412 |
| C-4468 | 0 | 0 | 30303 | 30303 | 0 | referral | 2100 |
Lawful basis for this section: employment-administration records you already hold. `id_document_zip` is populated at offer stage only, from the right-to-work document — never requested earlier as a screening input, which would invert the order the law expects.
`contact_reuse_hits` counts exact matches of phone or email across applications under a different candidate name, within your own ATS. Do not extend this to purchased identity-graph data; that changes the FCRA analysis in a direction you do not want.
## Section C — Claim set
The corroboration baseline. A contradiction only exists against something written down first.
| candidate_id | resume_path | application_answers_path | portfolio_urls | take_home_path |
|---|---|---|---|---|
| C-4471 | claims/C-4471/resume.pdf | claims/C-4471/application.json | github.com/example, example.dev | claims/C-4471/takehome/ |
| C-4468 | claims/C-4468/resume.pdf | claims/C-4468/application.json | — | — |
## Section D — Role risk
| req_id | day_one_access | role_risk | rationale |
|---|---|---|---|
| ENG-2291 | production DB read/write, customer PII | HIGH | On-call rotation from week 3 |
Answer for day one, not for month six. A role that earns production access after a 90-day probation is MEDIUM, and the probation itself is the control.
## Section E — Consent and notice prerequisites
Check before the first run. A `NO` here halts the run.
| Prerequisite | Applies when | Status | Artifact |
|---|---|---|---|
| Candidate notice that interview records are analyzed | always | YES | https://example.com/careers/ai-use-policy |
| All-party recording consent captured | recording in a two-party-consent state | YES | ats://consent/ENG-2291 |
| Illinois AI Video Interview Act consent | AI analysis of video interviews, IL candidates | N/A | text-only analysis, no video analyzed |
| BIPA written release and retention schedule | any voiceprint or face-geometry collection | N/A | none collected — see taxonomy §6 |
| Written camera policy applied uniformly + accommodation path | scoring camera reluctance | NO | not published — class B camera signal disabled |
The last row is the common one. Absent both artifacts, the skill scores nothing on camera reluctance and reports the gap against the process rather than the candidate.
## Section F — Verification capacity
| Loops per month | base_rate | class-weighted FPR | Expected flags/mo | Verification slots/mo | Headroom |
|---|---|---|---|---|---|
| 100 | 0.02 | 0.05 | 6.5 | 8 | +1.5 |
If headroom is negative, raise the taxonomy weights to tighten the screen before running. A queue that outruns capacity does not fail loudly — it ages, and the tail is where the real case sits.
# Verification playbook
What happens after a flag. The screen produces a queue; this file produces an outcome. A flag with no recorded outcome is the artifact that hurts you in a later charge, so section 4 is not optional.
checked: 2026-07-29
---
## 1. Pick the verification method
Ordered by strength. Use the cheapest one that resolves the specific unresolved items, not the strongest one available.
| Method | Resolves | Cost | Use when |
|---|---|---|---|
| Onsite or in-person final round | Identity substitution, proxy, real-time assistance — all three at once | Travel, 3-6 hours | HIGH role risk and a posterior above 20%. The strongest control on this list, and it needs no skill to run. |
| Live structured re-verification (§2) | Answer provenance, record contradictions | 45 min | The default. Most flags resolve here. |
| Right-to-work document check at offer | Identity, address divergence | Built into your existing offer process | Class A signals. Already happening — just sequence it before equipment ships. |
| Direct employer and institution verification | Record contradictions on employment or education | 2-5 business days | Class D contradictions. Contact the institution directly, never the reference number the candidate supplied. |
| Paid work sample, observed live | Real-time assistance, competence substitution | 2-4 hours, paid at market rate | Where class C is the whole flag and the role is hands-on. Pay for it; an unpaid extra round on a flagged candidate is a fairness problem on top of everything else. |
Do not add a proctoring or lockdown-browser layer as the response. It moves the loop toward surveillance, disadvantages candidates on shared connections and assistive technology, and resolves less than a single well-run live follow-up.
## 2. Live structured re-verification — protocol
45 minutes, same interviewer where possible, camera on for both sides, no recording beyond your standard practice.
**Do not tell the candidate they are suspected of fraud.** Say what is true: there are specifics from the earlier round you want to go deeper on. A candidate told they are under suspicion performs worse whether or not they did anything, which corrupts the only measurement you have left.
Structure:
1. **Rapport, 5 min.** Unscripted, unscored. Establishes the spontaneous-register baseline that step 3 compares against.
2. **Depth probes on the flagged claims, 25 min.** Take each unresolved item from the report. Ask the candidate to walk the specific decision, then ask one unscripted follow-up they could not have prepared: what broke, who disagreed, what you would do differently. Prepared and retrieved answers both thin out here; lived experience does not.
3. **Register comparison, inline.** The interviewer notes whether depth-probe answers match the section-1 baseline in vocabulary and specificity. Written note, contemporaneous.
4. **Contradiction, direct, 10 min.** Read the contradiction back verbatim — the loop quote and the conflicting claim — and ask them to reconcile it. Most contradictions are resume compression or a date error and resolve in one sentence. Give that sentence room.
5. **Close, 5 min.** Standard candidate questions. Do not signal the outcome.
## 3. Scoring the verification
One of four outcomes per flag. Nothing else.
- `RESOLVED` — the unresolved items are now corroborated. Close the flag, proceed with the loop normally, and record it. The candidate carries no residue into the decision.
- `RESOLVED_WITH_CORRECTION` — a claim was wrong and the candidate corrected it. This is a normal resume-accuracy matter and goes to the hiring manager on the ordinary path, not through this workflow.
- `UNRESOLVED` — the items are still open after a fair attempt. Escalate to §5 before any decision. Do not reject on `UNRESOLVED` without that step.
- `CONTRADICTED` — the candidate's account is inconsistent with a document they themselves supplied, restated and unreconciled. Route to §5 with the artifacts attached.
There is no `FRAUDULENT` outcome. That determination sits with counsel and, where sanctions or identity theft are in play, with law enforcement.
## 4. Decision log — fill one per flag
```
flag_id: F-2291-003
candidate_id: C-4471
opened: 2026-07-24
posterior_at_open: 0.31
role_risk: HIGH
unresolved_items: [D-migration-year, C-latency-inversion, A-address-divergence]
method: live structured re-verification
conducted: 2026-07-29 by M. Osei
outcome: RESOLVED_WITH_CORRECTION
notes: Cutover was Nov 2022 under the prior employer; resume date correct,
round-2 recollection wrong. Rollback plan detail was specific and
matched the public postmortem the candidate had cited.
Address divergence: sublet, lease provided at offer stage.
closed: 2026-07-29
decision_impact: none — candidate proceeded to offer
```
Every field populated, every flag closed. An open flag on a candidate you declined for unrelated reasons is the worst possible record to hold.
## 5. Escalation and counsel review
Send to counsel, with the report and the decision log, when any of these hold:
- Outcome is `UNRESOLVED` or `CONTRADICTED` on a HIGH-risk role.
- Class A signals point at identity substitution rather than answer assistance. Sanctions exposure attaches to who is employed, not to how well they interviewed — DOJ enforcement to date has treated employers as victims, and OFAC has not filed against inadvertent employers, but both have signaled expectations of diligence.
- The candidate is in Illinois and any biometric artifact was collected at any point in the loop.
- The verification outcome will contribute to a no-hire, and any part of the corroboration input came from a third-party vendor. Under CFPB Circular 2024-06, third-party algorithmic scores about workers used for employment decisions are often consumer reports, which pulls in the pre-adverse-action sequence: the report and a summary of rights to the candidate, a waiting period, then the final notice. Whether your setup crosses that line is a counsel call, not a skill output.
## 6. Candidate notice — scaffolding
Publish this before the first run, not after the first flag. Adapt the bracketed parts.
> **How we review interviews.** We review interview transcripts and application records for consistency, and we do this for every candidate in a requisition, not for selected individuals. We do not analyze video, faces, voices, or emotional expression, and no automated output decides whether you are hired.
>
> If our review leaves something unresolved, we ask you about it directly in a follow-up conversation before any decision is made. You can ask what was unresolved and respond to it.
>
> [Our policy on AI assistance during interviews is here.] Records are retained for [N] months and then deleted, except where a longer retention period is required by law.
The second paragraph is the one that does the work. A screen the candidate can answer is defensible; one they cannot is not.
