Um skill do Claude que lê as transcrições de entrevistas e os metadados de processo que seu ATS já guarda, e devolve um relatório de corroboração por candidato: o que o registro confirma, o que ele contradiz e quais perguntas continuam abertas. Candidatos sinalizados vão para uma etapa de verificação ao vivo. Não vão para uma rejeição — o skill não tem nenhum campo de saída capaz de sustentar isso, e a aritmética da próxima seção explica por quê.
Ele nunca toca no arquivo de vídeo. Sem geometria facial, sem impressão vocal, sem taxa de piscadas, sem pontuação de afeto. Essa restrição é o design, não uma limitação dele.
O número que define o design
Um filtro de fraude vive ou morre pela taxa-base. Com uma probabilidade a priori de 2% de candidatos fraudulentos chegando a uma entrevista ao vivo, um filtro que pega 80% deles com taxa de falso positivo de 5% produz 24,6% de chance de qualquer sinalização ser real. Três de cada quatro sinalizações são pessoas inocentes. Suba a priori para 10% e o mesmo filtro chega a 64% — ainda não é um número que rejeite ninguém.
Por isso o skill roteia sinalizações para verificação e para aí. Um follow-up estruturado de 45 minutos resolve a maioria, e o resultado dessa conversa — não a pontuação — é o que chega à decisão de contratação. Isso também mantém o workflow longe do enquadramento de sistema de decisão automatizada sob a NYC Local Law 144 e as regulações ADS da FEHA na Califórnia, e estreita a questão da FCRA: a Circular 2024-06 do CFPB coloca pontuações algorítmicas de terceiros sobre trabalhadores usadas para decisões de emprego dentro da FCRA, com deveres de consentimento, divulgação e notificação prévia à ação adversa. Um filtro interno que dispara uma conversa fica em lugar diferente de uma pontuação comprada que dispara uma oferta. O skill imprime isso como pergunta para o jurídico em vez de respondê-la.
Quando usar
Uma vaga totalmente remota em que a entrevista é a única coisa entre um candidato e as credenciais de produção.
Cargos que enviam equipamento antes do primeiro dia. O endereço da etiqueta de envio divergir do endereço do documento de identidade é o sinal mais barato da lista e ninguém olha para ele.
Um candidato cujo trabalho escrito e cujas respostas ao vivo parecem de duas pessoas diferentes, e o recrutador não sabe dizer por quê.
Vagas de segurança ou TI em empresas dentro da superfície de ameaça dos trabalhadores de TI da RPDC. A estimativa do Painel de Especialistas da ONU coloca a receita anual desse programa em 250-600 milhões de dólares, e a CrowdStrike reportou atores norte-coreanos se passando por funcionários internos em mais de 100 empresas de tecnologia, majoritariamente norte-americanas.
Quando NÃO usar
Para rejeitar alguém. Veja a aritmética acima. Uma probabilidade a posteriori de 24,6% que encerra uma candidatura é um filtro que discrimina contra a maioria inocente das pessoas que ele sinaliza.
Como perícia de mídia. Detectores de deepfake desabam fora da distribuição. Benchmarks entre datasets mostram um detector com 0,998 de AUC na distribuição de treino caindo para 0,674 num dataset não visto e para 0,633 no Celeb-DF. O adversário escolhe o gerador. Um detector que você não consegue avaliar contra o gerador realmente em uso devolve um número, não um controle.
Para inferir emoção, estresse ou honestidade. O Artigo 5(1)(f) do EU AI Act proíbe inferir emoções de uma pessoa natural no ambiente de trabalho a partir de dados biométricos, e as diretrizes da Comissão de fevereiro de 2025 sobre práticas proibidas leem “ambiente de trabalho” de forma a cobrir candidatos durante seleção e contratação. As penalidades chegam a 35 milhões de euros ou 7% do faturamento anual global. Detecção de mentira por comportamento também não tem respaldo, então a proibição não custa nada.
Onde o uso de IA é permitido. Defina a política primeiro e publique. ai_use_policy vem por padrão como prohibited para que desligar a classe de proveniência de respostas seja um ato deliberado — mas se nada foi publicado, o valor honesto é permitted, porque você não pode filtrar contra uma regra que nunca enunciou.
Retroativamente, sobre um pipeline fechado. Rodar isso sobre os candidatos rejeitados do ano passado constrói um arquivo de acusações não julgadas contra pessoas nomeadas, exibível em qualquer reclamação posterior, sem nenhuma etapa de verificação disponível para inocentar ninguém.
Em entrevistas presenciais. Tanto a substituição de identidade quanto a assistência ao vivo precisam do canal remoto. Uma rodada final presencial é o controle mais forte e não precisa de skill nenhum.
Setup
Coloque o bundle que está em apps/web/public/artifacts/ai-interview-fraud-detection-skill/SKILL.md no seu diretório de skills, com references/ ao lado.
Defina os parâmetros em references/1-signal-taxonomy.md §0. base_rate vem dos seus próprios casos confirmados nos últimos 12 meses; sem nenhum, mantenha 0.02 e leia cada probabilidade a posteriori como limite superior. O arquivo carrega uma data checked: e uma cadência de revisão de 90 dias.
Preencha a intake em references/2-interview-record-intake.md. A seção A pede timestamps por fala — escreva NO_TIMESTAMPS onde você não tiver, para que o skill reporte a classe de proveniência de respostas como indisponível em vez de pontuá-la sobre nada.
Responda a seção E antes da primeira rodada. Cinco pré-requisitos de consentimento e notificação; um NO interrompe a execução. A linha que mais falha é a política escrita de câmera, e sem ela o skill não pontua nada sobre relutância em ligá-la.
Confira a capacidade de verificação na seção F. Sinalizações são um número de capacidade, não um sinal de qualidade: 100 loops por mês com priori de 2% e falso positivo de 5% geram cerca de 6,5 sinalizações, das quais 1,6 são reais. Folga negativa significa apertar a taxonomia antes de rodar, não depois da fila acumular.
O que o skill faz de fato
Seis passos. Duas escolhas estruturais sustentam o design.
Duas passagens, e o extrator nunca vê a taxonomia. A passagem um extrai o registro de afirmações, os números de latência por resposta e as descrições de registro linguístico sem nenhum vocabulário de fraude no contexto. A passagem dois pontua esses fatos contra a taxonomia. Uma única passagem preparada fabrica aquilo que mandaram procurar — cada pausa vira evasão assim que o modelo sabe que está caçando evasão. A separação custa uma chamada extra por candidato.
A lista de exclusão é aplicada na saída. O passo 4 descarta sotaque, fraseado não nativo, origem do nome, fundo da casa, qualidade de webcam e de banda, uso de fundo virtual, fuso horário isolado e lacunas de emprego. Cada um correlaciona com origem nacional, raça, deficiência ou nível socioeconômico, e cada um é a rota exata pela qual um filtro de fraude vira uma reclamação de viés em triagem com IA. Os sinais descartados são impressos no relatório, então a exclusão é auditável em vez de presumida.
Entre as duas, o passo 1 se recusa a rodar sobre material biométrico sujeito a consentimento sem um registro citado: impressões vocais e exportações de geometria facial chegam anexadas às exportações de fornecedores, e a BIPA de Illinois prevê danos estatutários de 1.000 dólares por violação negligente e 5.000 por violação imprudente ou intencional, por pessoa. A SB 2979, sancionada em 2 de agosto de 2024, reduziu isso a uma única recuperação por pessoa e por método de coleta, e o Sétimo Circuito decidiu em 1º de abril de 2026 que a redução se aplica retroativamente. A exposição é menor do que era e não é zero. Remova o material, não o analise.
O passo 5 converte prioridade em probabilidade a posteriori e ordena a fila por posteriori vezes risco do cargo, onde risco do cargo é o acesso do primeiro dia e não a senioridade. O passo 6 imprime contradições com a citação literal da entrevista e a afirmação conflitante, para que quem lê veja evidência em vez de conclusão.
Custo real
Por loop — um loop de quatro rodadas de 45 minutos consome 40-55k tokens de entrada de transcrição mais cerca de 8k de arquivos de referência, e 3-5k de saída entre as duas passagens. Nas tarifas de tabela do Claude Sonnet (3 dólares por milhão de entrada, 15 por milhão de saída) isso dá 0,20-0,35 dólares por candidato. Estimativa, a partir da contagem de tokens de transcrições dessa duração.
Em volume — 100 loops por mês ficam em 20-35 dólares de gasto de modelo. O custo que importa é a etapa de verificação: 6-7 follow-ups estruturados de 45 minutos por mês, mais preparo do entrevistador, são cerca de 8-10 horas de tempo carregado de entrevistador.
Setup — 90 minutos, e esse número só é honesto se seu ATS já exporta transcrições com timestamps. Times que ligam a captura de transcrição pela primeira vez gastam um dia ou mais, e a camada de interview intelligence é o pré-requisito.
O que não economiza — a rodada presencial. Para um cargo de risco ALTO com posteriori acima de 20%, a viagem custa menos que a alternativa e resolve as três classes de fraude de uma vez.
Métrica de sucesso
Volume de sinalizações acompanhando a taxa prevista. Se uma priori de 2% prevê 6,5 sinalizações e você recebe 30, a taxonomia está mal calibrada, não o pipeline comprometido.
Toda sinalização encerrada com resultado registrado. O log de decisão em references/3-verification-playbook.md §4 não tem estado parcial. Uma sinalização aberta sobre um candidato recusado por motivos alheios é o pior registro que você pode guardar.
Proporção de RESOLVED acima de 70%. A maioria das sinalizações deve se resolver na verificação. Uma proporção menor significa que o filtro dispara sobre ruído.
Zero aparições de sinais excluídos nos relatórios. Uma checagem determinística que nunca deveria disparar.
Contra as alternativas
Contra fornecedores de detecção de deepfake em tempo real. Pindrop, Reality Defender e as camadas de detecção já embutidas nas plataformas de videoconferência trabalham sobre o fluxo de mídia, que este skill deliberadamente não toca. São complementares, não redundantes — e vale comprar só de um fornecedor disposto a declarar seu conjunto de avaliação, dados os números entre datasets acima. Eles verificam os pixels. Não verificam que quem responde sabe o que declarou no currículo.
Contra fornecedores de verificação de identidade. Checagens de documento mais prova de vida na etapa de oferta são o controle certo para a classe A, e você provavelmente já roda algo como Checkr ao lado. Eles verificam quem assinou. Não verificam quem faz o trabalho a partir da segunda semana, que é onde vive o padrão das fazendas de laptops.
Contra proctoring e navegadores bloqueados. Mais baratos de comprar, piores de operar. Empurram a entrevista para a vigilância, penalizam candidatos com conexões compartilhadas e tecnologia assistiva, e resolvem menos do que um único follow-up de profundidade bem conduzido.
Contra uma plataforma de avaliação técnica.Karat e similares rodam entrevistas humanas ao vivo que resistem estruturalmente tanto ao proxy quanto ao copiloto. Onde o orçamento permite, essa é uma resposta mais forte que qualquer filtro — o skill é para as rodadas que você mesmo conduz.
Contra o status quo. Humanos sem treino detectam mídia sintética perto do acaso. O status quo real não é “os recrutadores percebem”, e sim “ninguém olha”, e o custo marginal de olhar é 0,30 dólares por candidato.
Pontos de atenção
Uma sinalização lida como achado.Guarda: toda sinalização imprime sua probabilidade a posteriori com os insumos ao lado, e nenhum campo de saída serve como fundamento de rejeição.
Viés de confirmação por um extrator preparado.Guarda: a passagem um roda sem vocabulário de fraude no contexto; a taxonomia carrega apenas na passagem dois.
Discriminação indireta via comportamento.Guarda: a lista de exclusão da §4 é aplicada na saída e os sinais descartados são impressos.
Relutância com a câmera pontuada contra uma necessidade de acomodação.Guarda: o sinal só pontua onde existem uma política escrita aplicada uniformemente e uma via de acomodação oferecida; caso contrário o skill reporta a lacuna de política em vez do candidato.
Artefatos biométricos chegando com a exportação.Guarda: o passo 1 interrompe diante de material sujeito a consentimento sem registro citado.
Capacidade de verificação estourada.Guarda: o volume mensal esperado de sinalizações é impresso antes da primeira rodada, e a fila é ordenada por posteriori vezes risco do cargo, de modo que o que espera é a cauda.
O relatório vira material de discovery.Guarda: o log de decisão do playbook encerra cada sinalização explicitamente, e a §6 publica a notificação ao candidato antes da primeira rodada em vez de depois da primeira sinalização.
Stack
O bundle fica em apps/web/public/artifacts/ai-interview-fraud-detection-skill/ e contém:
SKILL.md — a definição do skill
references/1-signal-taxonomy.md — quatro classes de sinais com pesos e estimativas de falso positivo, a lista de sinais excluídos e os parâmetros de taxa-base
references/2-interview-record-intake.md — intake preenchível com uma coluna de base legal por campo
references/3-verification-playbook.md — métodos de verificação, o protocolo de reverificação ao vivo, o log de decisão e o modelo de notificação ao candidato
Assume Claude para a execução, um ATS como Greenhouse para os fatos de processo, e uma fonte de transcrição — Metaview ou equivalente — para a seção A.
---
name: ai-interview-fraud-detection
description: Screen an interview record — transcripts plus loop metadata you already hold — for identity-substitution, proxy-interview, and real-time answer-assistance signals, and emit a corroboration report that routes named candidates to a live verification step. Works on text and process facts, never on biometric or affect analysis. Produces a verification queue, never a fraud verdict and never a rejection.
---
# AI interview fraud detection
## When to invoke
Use this skill when a remote hiring loop has finished or is mid-flight and someone needs to know which candidates carry unresolved corroboration gaps before an offer goes out. It reads the interview transcripts and the process record around them, and returns a per-candidate report separating what the record corroborates from what it contradicts.
The output is an input to a verification step — a live structured re-interview, a document check, a reference call. It is not an input to a hiring decision. That separation is load-bearing and section *Method* explains why.
Typical triggers: a fully-remote engineering or IT req, a role with production-system or customer-data access, a candidate whose written work and live answers read as different people, a req where equipment ships before day one.
Do NOT invoke this skill for:
- **Rejecting a candidate.** No output field is a rejection ground. Section *Base rates* shows why: at a 2% prior and a 5% false-positive rate, roughly 3 in 4 flags are innocent candidates. A flag that rejects is a screen that discriminates against the innocent majority of the flagged set.
- **Media forensics.** The skill does not analyze video frames, face geometry, voiceprints, blink rate, or micro-expressions. It never touches the media file. Section *Why text and process, not media* gives the accuracy reason and the legal reason.
- **Inferring emotion, confidence, honesty, or stress.** EU AI Act Article 5(1)(f) prohibits AI systems that infer emotions of a natural person in the workplace from biometric data, and the Commission's February 2025 guidelines on prohibited practices read "workplace" to cover candidates during selection and hiring. Deception detection from demeanor is out of scope regardless of jurisdiction — it does not work, and it converts an interview into a polygraph.
- **Screening for AI use where AI use is permitted.** Decide the policy first. If candidates are told they can use an assistant, answer-provenance signals are noise. Set `ai_use_policy` and the skill drops signal class C.
- **Retroactive sweeps of a closed pipeline.** Running this across last year's rejected candidates manufactures a dataset of unadjudicated accusations against named people, discoverable in any later charge, with no verification step available to clear anyone. Run it forward-looking only.
- **In-person loops.** Identity substitution and real-time assistance both require the remote channel. An onsite final round is the stronger and cheaper control; see `references/3-verification-playbook.md` section 1.
## Inputs
- Required: `interview_record` — per candidate, the transcripts of each round with speaker labels and utterance timestamps, plus the round type and the interviewer. Timestamps are what make answer-latency analysis possible; without them signal class C is unavailable and the skill says so rather than guessing. Template in `references/2-interview-record-intake.md`.
- Required: `claim_set` — the candidate's own assertions available to you before the loop: resume, application answers, portfolio or repository links, and any written take-home. This is the corroboration baseline. A contradiction is only meaningful against a recorded claim.
- Required: `process_facts` — the loop metadata your ATS and IT already hold: scheduling history, reschedule and no-show events, the address on file for equipment, the application-source record, and whether the same contact details appear on other applications. Section B of the intake template.
- Optional: `ai_use_policy` — `prohibited`, `permitted`, or `permitted_with_disclosure`. Default `prohibited`. Anything other than `prohibited` disables signal class C.
- Optional: `base_rate` — your estimated prior for fraudulent candidates reaching a live loop, as a decimal. Default 0.02. The skill uses it to compute expected flag volume and posterior probability; see *Base rates*.
- Optional: `jurisdictions` — work locations in scope. Controls which notice and consent prerequisites the preflight checks.
## Reference files
- `references/1-signal-taxonomy.md` — the four signal classes, per-signal weights, the excluded-signals blocklist, and the base-rate parameters. The skill reads weights from this file and never from model memory.
- `references/2-interview-record-intake.md` — fillable intake template with a lawful-basis column per field, so the collection question is answered before the analysis question.
- `references/3-verification-playbook.md` — what happens after a flag: the live re-verification protocol and script, the decision log, and the candidate-notice scaffolding.
## Method
Six steps, in order. Two structural choices drive the whole design and are worth stating before the steps.
**Two passes, and the extractor never sees the taxonomy.** Pass one extracts claims, timings, and contradictions with no fraud framing in its context at all. Pass two scores those extracted facts against `references/1-signal-taxonomy.md`. A single pass primed with a fraud taxonomy manufactures the signals it was told to look for — every hesitation becomes evasion once the model knows it is hunting for evasion. Splitting the passes costs one extra call per candidate and is the difference between a report about the record and a report about the prompt.
**The output routes to verification, not to a decision.** A flag opens a verification step whose *outcome* is the only thing that reaches the hiring decision. This keeps the skill out of automated-decision-system territory under California's FEHA ADS regulations and NYC Local Law 144, and it keeps the FCRA question narrow — CFPB Circular 2024-06 holds that algorithmic scores about workers obtained from third parties for employment decisions are often governed by the FCRA, with consent, disclosure, and pre-adverse-action duties attached. An in-house screen that gates a verification step rather than a decision sits in a different place than a purchased score that gates an offer. Where the line falls for your setup is a counsel question, and the skill prints it as one.
### 1. Preflight the collection basis
Refuse to run if the record contains material the intake template marks as consent-gated and no consent artifact is cited: voiceprint or face-geometry data under Illinois BIPA, or an Illinois AI Video Interview Act consent where video interviews are AI-analyzed. The skill's own analysis is text-only and does not itself trigger BIPA, but records assembled for it frequently arrive with biometric artifacts attached, and BIPA carries statutory damages of $1,000 for negligent and $5,000 for reckless or intentional violations per person — narrowed to a single recovery per person per collection method by SB 2979 (signed 2 August 2024), which the Seventh Circuit held applies retroactively on 1 April 2026. Strip, do not analyze.
### 2. Extract without framing
Pass one. Produce three artifacts per candidate, with no fraud vocabulary in scope:
- **Claim ledger.** Every checkable assertion made in the loop, with the round and timestamp, normalized against `claim_set`. "Led the migration off Postgres 11 in 2023" is checkable. "I'm a strong collaborator" is not; drop it.
- **Timing profile.** Per answer: elapsed seconds from question end to first substantive word, total answer length, and the position of the longest intra-answer pause. Raw numbers only.
- **Register profile.** Per answer: a description of vocabulary level, sentence structure, and specificity, without comparison across answers.
### 3. Score against the taxonomy
Pass two reads the pass-one artifacts and `references/1-signal-taxonomy.md`. Four classes:
- **A — Identity continuity.** Appearance or voice descriptions that shift across rounds where interviewers noted it in writing; the equipment address diverging from the identity-document address; the same phone or email appearing on unrelated applications.
- **B — Channel and infrastructure.** Repeated declines of unscheduled live video where a policy exists and was applied uniformly; multiple candidates presenting from one IP; remote-desktop artifacts visible in shared screens.
- **C — Answer provenance.** Latency that inverts — long lead-in before easy factual answers, short before hard synthesis ones; register discontinuity between spontaneous exchanges and set-piece answers; answers that restate the interviewer's question near-verbatim before answering; specificity that collapses under an unscripted follow-up. Disabled when `ai_use_policy` is not `prohibited`.
- **D — Record contradiction.** Loop claims contradicted by `claim_set` or by a public artifact the candidate themselves cited.
Each signal returns `corroborated`, `unresolved`, or `contradiction`. There is no `fraudulent` value and no aggregate fraud score. Weights sum to a *verification priority*, which orders a queue and nothing else.
### 4. Apply the excluded-signals blocklist
Before anything is reported, drop every signal on the blocklist in `references/1-signal-taxonomy.md` section 4. Accent, non-native phrasing, name origin, home background, webcam or bandwidth quality, virtual-background use, and timezone alone are excluded. Each correlates with national origin, race, disability, or socioeconomic status, and each is the exact vector by which a fraud screen becomes a disparate-impact claim. The blocklist is enforced at output, so a signal reaching the report has already survived it.
Camera reluctance is a special case and is scored only when a written, uniformly-applied camera policy exists and an accommodation path was offered. Absent both, the skill reports the policy gap instead of the candidate.
### 5. Compute the posterior and the queue
Convert priority to an explicit probability using `base_rate` and the taxonomy's per-class false-positive estimates, and print it next to every flag. See *Base rates*. Then order the verification queue by posterior times role risk, where role risk comes from the intake template's access-level field. A production-credentials role and a marketing-coordinator role with the same posterior are not the same problem.
### 6. Emit the report
Per candidate: the corroboration table, the posterior with its inputs shown, the specific unresolved items phrased as questions for the verification step, and the excluded signals that were dropped and why. Contradictions print with both the loop quote and the conflicting claim verbatim, so a human reads the evidence rather than the conclusion.
## Base rates
The single most common way a fraud screen fails is arithmetic. With prior `p`, recall `r`, and false-positive rate `f`, the probability that a flagged candidate is actually fraudulent is:
```
PPV = (p * r) / (p * r + (1 - p) * f)
```
At `p = 0.02`, `r = 0.80`, `f = 0.05`: PPV = 0.016 / (0.016 + 0.049) = **24.6%**. Three flags in four are innocent people. At `p = 0.10` and the same screen, PPV rises to 64%.
Two consequences the skill enforces rather than mentions. Flags open a verification step, because a 24.6% posterior cannot carry a rejection. And flag volume is a capacity number: 100 loops per month at `p = 0.02` and `f = 0.05` produces about 6.5 flags per month, of which 1.6 are real. If your verification step cannot absorb 6-7 structured re-interviews a month, tune `f` down in the taxonomy before running, not after the queue backs up.
## Why text and process, not media
Two reasons, and either alone would be sufficient.
**Accuracy.** Deepfake detectors collapse out of distribution. Published cross-dataset benchmarks show detectors near-perfect on their training distribution falling to chance-adjacent on unseen generators — one widely-benchmarked detector drops from 0.998 AUC in-dataset to 0.674 cross-dataset, and to 0.633 on Celeb-DF. The adversary chooses the generator. A detector you cannot benchmark against the generator actually in use gives you a number, not a control.
**Law.** Face-geometry and voiceprint analysis of candidates is biometric collection under BIPA and its successors, with the consent and retention duties and per-person statutory damages in step 1. Affect inference from that same data in a hiring context is prohibited outright in the EU under Article 5(1)(f), with penalties up to €35 million or 7% of worldwide annual turnover. Text-and-process analysis of records you already lawfully hold carries neither exposure.
Real-time media detection has a place — at the stream layer, from a vendor who can attest to their benchmark set. It is a different control at a different layer, and it does not replace corroboration.
## Output format
```markdown
## Verification queue — req ENG-2291, loop closed 2026-07-24
### 1. Candidate C-4471 — posterior 31% — role risk HIGH — VERIFY
Inputs: base_rate 0.02 · recall 0.80 · class-weighted FPR 0.036
| Class | Signal | Status | Evidence |
|---|---|---|---|
| D | Postgres migration year | contradiction | Round 2 14:02 "we cut over in early 2023"; resume lists the role ending Nov 2022 |
| C | Latency inversion | unresolved | Factual recall 9.4s mean lead-in; open-ended design 1.8s mean |
| A | Equipment address | unresolved | Shipping ZIP 07102 vs identity-document ZIP 94103 |
| B | Live video | corroborated | Two unscheduled calls accepted, 2026-07-11 and 2026-07-18 |
Questions for verification (see references/3-verification-playbook.md §2):
1. Walk through the cutover timeline against the employment dates on the application.
2. Unscripted depth probe on the migration's rollback plan.
3. Confirm the shipping address against the identity document at offer stage.
Excluded and not reported: 2 signals (bandwidth quality, phrasing register vs. first language).
### 2. Candidate C-4468 — posterior 6% — role risk LOW — NO ACTION
All four classes corroborated or unresolved-immaterial. No verification step.
---
Loop total: 11 candidates · 1 verification · 0 contradictions unresolved after verification
Counsel review queue: 1 item — FCRA characterization of the corroboration report if the
verification outcome contributes to a no-hire. See references/3-verification-playbook.md §5.
```
## Watch-outs
- **A flag gets treated as a finding.** *Guard:* every flag prints its posterior with inputs beside it, and no output field is a rejection ground. The verification outcome is the only decision input.
- **Confirmation bias from a primed extractor.** *Guard:* pass one runs with no fraud vocabulary in context; the taxonomy loads only in pass two.
- **Proxy discrimination through demeanor signals.** *Guard:* the section-4 blocklist is enforced at output, and dropped signals print in the report so the exclusion is auditable.
- **Camera reluctance scored against a candidate with an accommodation need.** *Guard:* the signal scores only where a written uniform policy and an offered accommodation path both exist; otherwise the skill reports the policy gap.
- **Biometric material arriving with the record.** *Guard:* step 1 refuses to run on consent-gated artifacts without a cited consent record, and instructs stripping rather than analysis.
- **The screen runs where AI use is allowed.** *Guard:* `ai_use_policy` gates signal class C, and the default is `prohibited` so the setting is a deliberate act.
- **Verification capacity is overrun and flags age out silently.** *Guard:* step 5 prints expected monthly flag volume from `base_rate` and the taxonomy FPR before the first run, and the queue is ordered by posterior times role risk so the tail is the part that waits.
- **The report becomes discovery material.** *Guard:* the playbook's decision log records verification outcomes and closes each flag explicitly. An open flag with no recorded outcome is the artifact that hurts you later.
# Signal taxonomy
checked: 2026-07-29
maintainer: <your name>
review cadence: every 90 days, or on any change to the hiring AI-use policy
The skill reads weights, false-positive estimates, and the exclusion blocklist from this file. Edit the numbers to match your pipeline; do not edit them to make a candidate fit.
---
## 0. Parameters
| Parameter | Default | Set it from |
|---|---|---|
| `base_rate` | 0.02 | Your own confirmed cases over loops run in the last 12 months. If you have none, keep 0.02 and treat every posterior as an upper bound. |
| `recall` | 0.80 | Assumption, not a measurement. Lower it to 0.6 if your loops are under 45 minutes — short loops give class C almost nothing to work with. |
| `role_risk` | see §5 | The access the role gets on day one, not seniority. |
| `ai_use_policy` | `prohibited` | Your published candidate-facing policy. If nothing is published, the answer is `permitted` — you cannot screen against an unstated rule. |
Class-weighted false-positive rate is computed from the per-signal `fpr` column below across the classes that are enabled.
---
## 1. Class A — Identity continuity
Whether the person in round 3 is the person in round 1, and whether that person is the applicant.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Interviewer noted in writing that appearance or voice differed from a prior round | 0.30 | 0.02 | Only counts from a contemporaneous written note, never from a later recollection. |
| Equipment-shipping address diverges from the identity-document address | 0.20 | 0.08 | High innocent base — sublets, family addresses, mid-move candidates. |
| Same phone or email on an unrelated application under a different name | 0.30 | 0.01 | Strong when it is exact-match, worthless when it is fuzzy. |
| Application-source record inconsistent with the candidate's account of how they applied | 0.10 | 0.15 | Weak. Included because it is cheap, excluded from the queue on its own. |
| Reference contact details resolve to a domain registered inside 90 days | 0.20 | 0.03 | Check the domain, not the person. |
## 2. Class B — Channel and infrastructure
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Declined 2+ unscheduled live video requests under a written uniform policy | 0.20 | 0.10 | Scores ONLY with the policy and the accommodation path in place. See §4. |
| Multiple concurrent candidates presenting from one IP | 0.35 | 0.01 | Ask IT for the join records; do not infer from the recording. |
| Remote-desktop or screen-relay artifacts visible during a shared screen | 0.25 | 0.05 | Chrome Remote Desktop, AnyDesk, TeamViewer, RustDesk banners. Legitimate on a work-issued machine — check whose machine it is before scoring. |
| Second voice audible or a second person's cursor visible | 0.35 | 0.02 | Also fires on a noisy household. Requires the interviewer's written note. |
## 3. Class C — Answer provenance
Disabled entirely unless `ai_use_policy` is `prohibited`. All four need utterance timestamps; without them the class returns `unavailable`, not `corroborated`.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Latency inversion — longer lead-in on factual recall than on open synthesis | 0.25 | 0.12 | The characteristic shape of retrieval-then-read. Also the shape of an anxious candidate warming up; treat 0.12 as optimistic. |
| Register discontinuity between spontaneous exchange and set-piece answer | 0.20 | 0.15 | Highest innocent rate in the taxonomy. Prepared answers are prepared. |
| Interviewer's question restated near-verbatim before the answer begins | 0.15 | 0.10 | Artifact of transcription-then-generation. Also a normal stalling habit. |
| Specificity collapses on an unscripted follow-up to a detailed answer | 0.30 | 0.06 | The strongest signal in the class, and the one that needs an interviewer trained to ask the follow-up. |
If your interviewers do not routinely ask one unscripted depth follow-up per detailed answer, fix that before running this skill. It costs nothing and it outperforms every other signal here.
## 4. Excluded signals — never reported, enforced at output
Each of these correlates with a protected characteristic and produces a disparate-impact vector rather than a fraud signal. The skill drops them and prints that it dropped them.
- Accent, prosody, or non-native phrasing
- Name origin, transliteration, or spelling convention
- Home or office background, furnishings, or visible household members
- Webcam resolution, lighting, or bandwidth quality
- Virtual-background or background-blur use
- Timezone, or working hours, in isolation
- Employment gaps
- Typing speed, or written-English fluency, as a standalone signal
- Any inference of emotion, confidence, honesty, nervousness, or engagement from voice or video — prohibited in the EU under AI Act Article 5(1)(f) for workplace and recruitment contexts, and unsupported everywhere else
Camera reluctance is scored under class B only where BOTH a written camera policy applied uniformly across the req AND an offered accommodation path are recorded. Where either is missing, the skill reports the policy gap and scores nothing.
## 5. Role risk
| Level | Definition | Multiplier |
|---|---|---|
| HIGH | Production credentials, customer PII, payments, or source-code write access on day one | 1.5 |
| MEDIUM | Internal systems, no production or customer data | 1.0 |
| LOW | No systems access beyond email and documents in the first 30 days | 0.6 |
Role risk orders the queue. It never changes a posterior — a 6% posterior on a HIGH-risk role is still 6%.
## 6. Biometric and consent-gated material — strip, do not analyze
Presence of any of these in the record halts the run until a consent artifact is cited:
- Voiceprint or speaker-embedding files
- Face-geometry templates or facial-landmark exports
- Third-party AI-video-analysis scores attached to an Illinois-based candidate
- Any vendor "authenticity", "integrity", or "confidence" score derived from the media stream
The skill's analysis is text and metadata only. These arrive attached to exports and are the most common reason a text-only screen acquires biometric exposure it never needed.
# Interview record intake
Fill one copy per requisition. The lawful-basis column is not decoration — answer it before the field is collected, because the cheapest way to fail this workflow is to assemble a record you had no basis to assemble.
req_id: ENG-2291
work_locations: [Remote-US: CA, NY, IL, TX]
ai_use_policy: prohibited
policy_published_at: https://example.com/careers/ai-use-policy
base_rate: 0.02
checked: 2026-07-29
---
## Section A — Per-candidate loop record
One row per round. Timestamps are required for signal class C; mark `NO_TIMESTAMPS` rather than leaving blank, so the skill reports the class as unavailable instead of scoring it silently.
| candidate_id | round | date | interviewer | transcript_path | timestamps | interviewer_written_notes |
|---|---|---|---|---|---|---|
| C-4471 | recruiter screen | 2026-07-08 | R. Ade | records/C-4471/r1.txt | yes | records/C-4471/r1-notes.md |
| C-4471 | technical 1 | 2026-07-14 | M. Osei | records/C-4471/r2.txt | yes | records/C-4471/r2-notes.md |
| C-4471 | system design | 2026-07-21 | M. Osei | records/C-4471/r3.txt | NO_TIMESTAMPS | records/C-4471/r3-notes.md |
| C-4468 | recruiter screen | 2026-07-09 | R. Ade | records/C-4468/r1.txt | yes | records/C-4468/r1-notes.md |
Lawful basis for this section: interview records created by you, in the ordinary course, with candidate notice at scheduling. Recording requires consent in all-party-consent states — confirm the notice text covers analysis, not only recording.
## Section B — Process facts
Pulled from the ATS and IT, not from the candidate. Leave a cell `UNKNOWN` rather than estimating it.
| candidate_id | reschedules | unscheduled_video_declines | equipment_ship_zip | id_document_zip | contact_reuse_hits | application_source | reference_domains_age_days |
|---|---|---|---|---|---|---|---|
| C-4471 | 2 | 0 | 07102 | 94103 | 0 | inbound-careers | 412 |
| C-4468 | 0 | 0 | 30303 | 30303 | 0 | referral | 2100 |
Lawful basis for this section: employment-administration records you already hold. `id_document_zip` is populated at offer stage only, from the right-to-work document — never requested earlier as a screening input, which would invert the order the law expects.
`contact_reuse_hits` counts exact matches of phone or email across applications under a different candidate name, within your own ATS. Do not extend this to purchased identity-graph data; that changes the FCRA analysis in a direction you do not want.
## Section C — Claim set
The corroboration baseline. A contradiction only exists against something written down first.
| candidate_id | resume_path | application_answers_path | portfolio_urls | take_home_path |
|---|---|---|---|---|
| C-4471 | claims/C-4471/resume.pdf | claims/C-4471/application.json | github.com/example, example.dev | claims/C-4471/takehome/ |
| C-4468 | claims/C-4468/resume.pdf | claims/C-4468/application.json | — | — |
## Section D — Role risk
| req_id | day_one_access | role_risk | rationale |
|---|---|---|---|
| ENG-2291 | production DB read/write, customer PII | HIGH | On-call rotation from week 3 |
Answer for day one, not for month six. A role that earns production access after a 90-day probation is MEDIUM, and the probation itself is the control.
## Section E — Consent and notice prerequisites
Check before the first run. A `NO` here halts the run.
| Prerequisite | Applies when | Status | Artifact |
|---|---|---|---|
| Candidate notice that interview records are analyzed | always | YES | https://example.com/careers/ai-use-policy |
| All-party recording consent captured | recording in a two-party-consent state | YES | ats://consent/ENG-2291 |
| Illinois AI Video Interview Act consent | AI analysis of video interviews, IL candidates | N/A | text-only analysis, no video analyzed |
| BIPA written release and retention schedule | any voiceprint or face-geometry collection | N/A | none collected — see taxonomy §6 |
| Written camera policy applied uniformly + accommodation path | scoring camera reluctance | NO | not published — class B camera signal disabled |
The last row is the common one. Absent both artifacts, the skill scores nothing on camera reluctance and reports the gap against the process rather than the candidate.
## Section F — Verification capacity
| Loops per month | base_rate | class-weighted FPR | Expected flags/mo | Verification slots/mo | Headroom |
|---|---|---|---|---|---|
| 100 | 0.02 | 0.05 | 6.5 | 8 | +1.5 |
If headroom is negative, raise the taxonomy weights to tighten the screen before running. A queue that outruns capacity does not fail loudly — it ages, and the tail is where the real case sits.
# Verification playbook
What happens after a flag. The screen produces a queue; this file produces an outcome. A flag with no recorded outcome is the artifact that hurts you in a later charge, so section 4 is not optional.
checked: 2026-07-29
---
## 1. Pick the verification method
Ordered by strength. Use the cheapest one that resolves the specific unresolved items, not the strongest one available.
| Method | Resolves | Cost | Use when |
|---|---|---|---|
| Onsite or in-person final round | Identity substitution, proxy, real-time assistance — all three at once | Travel, 3-6 hours | HIGH role risk and a posterior above 20%. The strongest control on this list, and it needs no skill to run. |
| Live structured re-verification (§2) | Answer provenance, record contradictions | 45 min | The default. Most flags resolve here. |
| Right-to-work document check at offer | Identity, address divergence | Built into your existing offer process | Class A signals. Already happening — just sequence it before equipment ships. |
| Direct employer and institution verification | Record contradictions on employment or education | 2-5 business days | Class D contradictions. Contact the institution directly, never the reference number the candidate supplied. |
| Paid work sample, observed live | Real-time assistance, competence substitution | 2-4 hours, paid at market rate | Where class C is the whole flag and the role is hands-on. Pay for it; an unpaid extra round on a flagged candidate is a fairness problem on top of everything else. |
Do not add a proctoring or lockdown-browser layer as the response. It moves the loop toward surveillance, disadvantages candidates on shared connections and assistive technology, and resolves less than a single well-run live follow-up.
## 2. Live structured re-verification — protocol
45 minutes, same interviewer where possible, camera on for both sides, no recording beyond your standard practice.
**Do not tell the candidate they are suspected of fraud.** Say what is true: there are specifics from the earlier round you want to go deeper on. A candidate told they are under suspicion performs worse whether or not they did anything, which corrupts the only measurement you have left.
Structure:
1. **Rapport, 5 min.** Unscripted, unscored. Establishes the spontaneous-register baseline that step 3 compares against.
2. **Depth probes on the flagged claims, 25 min.** Take each unresolved item from the report. Ask the candidate to walk the specific decision, then ask one unscripted follow-up they could not have prepared: what broke, who disagreed, what you would do differently. Prepared and retrieved answers both thin out here; lived experience does not.
3. **Register comparison, inline.** The interviewer notes whether depth-probe answers match the section-1 baseline in vocabulary and specificity. Written note, contemporaneous.
4. **Contradiction, direct, 10 min.** Read the contradiction back verbatim — the loop quote and the conflicting claim — and ask them to reconcile it. Most contradictions are resume compression or a date error and resolve in one sentence. Give that sentence room.
5. **Close, 5 min.** Standard candidate questions. Do not signal the outcome.
## 3. Scoring the verification
One of four outcomes per flag. Nothing else.
- `RESOLVED` — the unresolved items are now corroborated. Close the flag, proceed with the loop normally, and record it. The candidate carries no residue into the decision.
- `RESOLVED_WITH_CORRECTION` — a claim was wrong and the candidate corrected it. This is a normal resume-accuracy matter and goes to the hiring manager on the ordinary path, not through this workflow.
- `UNRESOLVED` — the items are still open after a fair attempt. Escalate to §5 before any decision. Do not reject on `UNRESOLVED` without that step.
- `CONTRADICTED` — the candidate's account is inconsistent with a document they themselves supplied, restated and unreconciled. Route to §5 with the artifacts attached.
There is no `FRAUDULENT` outcome. That determination sits with counsel and, where sanctions or identity theft are in play, with law enforcement.
## 4. Decision log — fill one per flag
```
flag_id: F-2291-003
candidate_id: C-4471
opened: 2026-07-24
posterior_at_open: 0.31
role_risk: HIGH
unresolved_items: [D-migration-year, C-latency-inversion, A-address-divergence]
method: live structured re-verification
conducted: 2026-07-29 by M. Osei
outcome: RESOLVED_WITH_CORRECTION
notes: Cutover was Nov 2022 under the prior employer; resume date correct,
round-2 recollection wrong. Rollback plan detail was specific and
matched the public postmortem the candidate had cited.
Address divergence: sublet, lease provided at offer stage.
closed: 2026-07-29
decision_impact: none — candidate proceeded to offer
```
Every field populated, every flag closed. An open flag on a candidate you declined for unrelated reasons is the worst possible record to hold.
## 5. Escalation and counsel review
Send to counsel, with the report and the decision log, when any of these hold:
- Outcome is `UNRESOLVED` or `CONTRADICTED` on a HIGH-risk role.
- Class A signals point at identity substitution rather than answer assistance. Sanctions exposure attaches to who is employed, not to how well they interviewed — DOJ enforcement to date has treated employers as victims, and OFAC has not filed against inadvertent employers, but both have signaled expectations of diligence.
- The candidate is in Illinois and any biometric artifact was collected at any point in the loop.
- The verification outcome will contribute to a no-hire, and any part of the corroboration input came from a third-party vendor. Under CFPB Circular 2024-06, third-party algorithmic scores about workers used for employment decisions are often consumer reports, which pulls in the pre-adverse-action sequence: the report and a summary of rights to the candidate, a waiting period, then the final notice. Whether your setup crosses that line is a counsel call, not a skill output.
## 6. Candidate notice — scaffolding
Publish this before the first run, not after the first flag. Adapt the bracketed parts.
> **How we review interviews.** We review interview transcripts and application records for consistency, and we do this for every candidate in a requisition, not for selected individuals. We do not analyze video, faces, voices, or emotional expression, and no automated output decides whether you are hired.
>
> If our review leaves something unresolved, we ask you about it directly in a follow-up conversation before any decision is made. You can ask what was unresolved and respond to it.
>
> [Our policy on AI assistance during interviews is here.] Records are retained for [N] months and then deleted, except where a longer retention period is required by law.
The second paragraph is the one that does the work. A screen the candidate can answer is defensible; one they cannot is not.
