Ein Claude Skill, der Interview-Transkripte und die Prozess-Metadaten liest, die Ihr ATS ohnehin vorhält, und pro Kandidat einen Abgleichsbericht zurückgibt: was der Datensatz bestätigt, was er widerlegt und welche Fragen offen bleiben. Markierte Kandidaten gehen in einen Live-Verifikationsschritt. Sie gehen nicht in eine Absage — der Skill hat kein Ausgabefeld, das eine tragen könnte, und die Arithmetik im nächsten Abschnitt erklärt warum.
Er fasst die Videodatei nie an. Keine Gesichtsgeometrie, kein Stimmabdruck, keine Blinzelrate, kein Affekt-Scoring. Diese Einschränkung ist das Design, nicht ein Mangel daran.
Die Zahl, die das Design bestimmt
Ein Betrugsfilter steht und fällt mit seiner Basisrate. Bei einer A-priori-Rate von 2% betrügerischer Kandidaten, die es in ein Live-Interview schaffen, erzeugt ein Filter mit 80% Trefferquote und 5% Falsch-Positiv-Rate eine Wahrscheinlichkeit von 24,6%, dass eine gegebene Markierung echt ist. Drei von vier Markierungen sind unschuldige Menschen. Heben Sie die A-priori-Rate auf 10%, erreicht derselbe Filter 64% — immer noch keine Zahl, mit der man jemanden ablehnt.
Deshalb leitet der Skill Markierungen an die Verifikation weiter und hört dort auf. Ein strukturiertes 45-Minuten-Nachgespräch klärt die meisten davon, und das Ergebnis dieses Gesprächs — nicht der Score — ist das, was in die Einstellungsentscheidung eingeht. Das hält den Workflow zugleich außerhalb der Einordnung als automatisiertes Entscheidungssystem nach NYC Local Law 144 und den kalifornischen FEHA-ADS-Regelungen, und es verengt die FCRA-Frage: Das CFPB-Rundschreiben 2024-06 ordnet algorithmische Scores Dritter über Beschäftigte, die für Beschäftigungsentscheidungen genutzt werden, der FCRA zu, samt Einwilligungs-, Offenlegungs- und Vorab-Benachrichtigungspflichten. Ein interner Filter, der ein Gespräch auslöst, steht anders da als ein zugekaufter Score, der ein Angebot auslöst. Der Skill druckt das als Frage an die Rechtsabteilung aus, statt sie zu beantworten.
Wann Sie ihn einsetzen
Eine vollständig remote besetzte Stelle, bei der das Interview das Einzige zwischen einem Bewerber und Produktivzugängen ist.
Rollen, bei denen Hardware vor dem ersten Arbeitstag versandt wird. Dass die Lieferadresse von der Adresse im Ausweisdokument abweicht, ist das billigste Signal der Liste, und niemand schaut darauf.
Ein Kandidat, dessen schriftliche Arbeit und dessen Live-Antworten nach zwei verschiedenen Personen klingen, und der Recruiter kann nicht sagen warum.
Security- oder IT-Stellen in Unternehmen innerhalb der Bedrohungsfläche der nordkoreanischen IT-Arbeiter. Die Schätzung des UN-Expertengremiums beziffert die Jahreseinnahmen dieses Programms auf 250-600 Millionen US-Dollar, und CrowdStrike hat nordkoreanische Akteure gemeldet, die sich bei mehr als 100 überwiegend US-amerikanischen Technologieunternehmen als Interne ausgaben.
Wann Sie ihn NICHT einsetzen
Um jemanden abzulehnen. Siehe die Arithmetik oben. Eine A-posteriori-Wahrscheinlichkeit von 24,6%, die eine Bewerbung beendet, ist ein Filter, der die unschuldige Mehrheit der markierten Personen benachteiligt.
Als Medienforensik. Deepfake-Detektoren brechen außerhalb ihrer Verteilung ein. Datensatzübergreifende Benchmarks zeigen einen Detektor mit 0,998 AUC auf seiner Trainingsverteilung, der auf einem ungesehenen Datensatz auf 0,674 und auf Celeb-DF auf 0,633 fällt. Der Angreifer wählt den Generator. Ein Detektor, den Sie nicht gegen den tatsächlich eingesetzten Generator messen können, liefert eine Zahl, keine Kontrolle.
Um Emotion, Stress oder Ehrlichkeit abzuleiten. Artikel 5(1)(f) des EU AI Act verbietet das Ableiten von Emotionen einer natürlichen Person am Arbeitsplatz aus biometrischen Daten, und die Leitlinien der Kommission vom Februar 2025 zu verbotenen Praktiken lesen «Arbeitsplatz» so, dass Bewerber während Auswahl und Einstellung erfasst sind. Die Bußgelder reichen bis 35 Millionen Euro oder 7% des weltweiten Jahresumsatzes. Verhaltensbasierte Lügenerkennung ist ohnehin nicht belegt, das Verbot kostet also nichts.
Wo KI-Nutzung erlaubt ist. Legen Sie die Policy zuerst fest und veröffentlichen Sie sie. ai_use_policy steht standardmäßig auf prohibited, damit das Abschalten der Antwortherkunfts-Klasse ein bewusster Akt ist — aber wenn nichts veröffentlicht ist, lautet die ehrliche Einstellung permitted, denn gegen eine nie ausgesprochene Regel lässt sich nicht filtern.
Rückwirkend über eine geschlossene Pipeline. Das über die abgelehnten Bewerber des Vorjahres laufen zu lassen, erzeugt eine Akte unbeurteilter Vorwürfe gegen namentlich benannte Personen, herausgabepflichtig in jedem späteren Verfahren, ohne dass ein Verifikationsschritt zur Entlastung noch verfügbar wäre.
Bei Präsenz-Interviews. Identitätssubstitution und Live-Assistenz brauchen beide den Remote-Kanal. Eine finale Runde vor Ort ist die stärkere Kontrolle und braucht gar keinen Skill.
Einrichtung
Legen Sie das Bundle aus apps/web/public/artifacts/ai-interview-fraud-detection-skill/SKILL.md in Ihr Skills-Verzeichnis, mit references/ daneben.
Setzen Sie die Parameter in references/1-signal-taxonomy.md §0. base_rate stammt aus Ihren eigenen bestätigten Fällen der letzten 12 Monate; ohne solche belassen Sie 0.02 und lesen jede A-posteriori-Wahrscheinlichkeit als Obergrenze. Die Datei trägt ein checked:-Datum und einen 90-Tage-Prüfrhythmus.
Füllen Sie die Erfassung in references/2-interview-record-intake.md. Abschnitt A verlangt Zeitstempel pro Redebeitrag — schreiben Sie NO_TIMESTAMPS, wo Sie keine haben, damit der Skill die Antwortherkunfts-Klasse als nicht verfügbar meldet, statt sie auf nichts zu scoren.
Beantworten Sie Abschnitt E vor dem ersten Lauf. Fünf Einwilligungs- und Hinweisvoraussetzungen; ein NO stoppt den Lauf. Die Zeile, die am häufigsten scheitert, ist die schriftliche Kamera-Policy, und ohne sie scort der Skill nichts zur Kamera-Zurückhaltung.
Prüfen Sie die Verifikationskapazität in Abschnitt F. Markierungen sind eine Kapazitätszahl, kein Qualitätssignal: 100 Loops pro Monat bei 2% A-priori-Rate und 5% Falsch-Positiv-Rate ergeben rund 6,5 Markierungen, davon 1,6 echte. Negativer Puffer heißt, die Taxonomie vor dem Lauf zu straffen, nicht nachdem sich die Warteschlange staut.
Was der Skill tatsächlich tut
Sechs Schritte. Zwei strukturelle Entscheidungen tragen das Design.
Zwei Durchläufe, und der Extraktor sieht die Taxonomie nie. Durchlauf eins zieht das Aussagenregister, die Latenzwerte pro Antwort und die Beschreibungen der Sprachebene, ohne jedes Betrugsvokabular im Kontext. Durchlauf zwei scort diese Fakten gegen die Taxonomie. Ein einzelner vorgeprägter Durchlauf fabriziert, wonach zu suchen ihm aufgetragen wurde — jede Pause wird zum Ausweichen, sobald das Modell weiß, dass es Ausweichen jagt. Die Trennung kostet einen zusätzlichen Aufruf pro Kandidat.
Die Ausschlussliste greift an der Ausgabe. Schritt 4 verwirft Akzent, nicht-muttersprachliche Formulierung, Namensherkunft, Wohnumfeld im Bild, Webcam- und Bandbreitenqualität, Nutzung virtueller Hintergründe, Zeitzone für sich allein und Lücken im Lebenslauf. Jedes davon korreliert mit nationaler Herkunft, ethnischer Zugehörigkeit, Behinderung oder sozioökonomischem Status, und jedes ist genau der Weg, auf dem ein Betrugsfilter zu einem Anspruch wegen Bias im KI-Screening wird. Verworfene Signale werden im Bericht ausgedruckt, der Ausschluss ist damit prüfbar statt unterstellt.
Dazwischen verweigert Schritt 1 den Lauf über einwilligungspflichtiges biometrisches Material ohne zitierten Einwilligungsnachweis: Stimmabdrücke und Gesichtsgeometrie-Exporte kommen an Anbieter-Exporten hängend an, und der Illinois BIPA sieht gesetzliche Schadenersatzbeträge von 1.000 US-Dollar bei fahrlässigen und 5.000 bei leichtfertigen oder vorsätzlichen Verstößen pro Person vor. SB 2979, unterzeichnet am 2. August 2024, hat das auf eine einzige Erstattung pro Person und Erhebungsmethode verengt, und der Seventh Circuit entschied am 1. April 2026, dass diese Verengung rückwirkend gilt. Das Risiko ist kleiner als früher und nicht null. Entfernen, nicht analysieren.
Schritt 5 wandelt Priorität in eine A-posteriori-Wahrscheinlichkeit um und ordnet die Warteschlange nach A-posteriori mal Rollenrisiko, wobei Rollenrisiko der Zugriff am ersten Tag ist und nicht die Seniorität. Schritt 6 druckt Widersprüche mit dem wörtlichen Interviewzitat und der widersprechenden Angabe, damit der Lesende Belege sieht statt einer Schlussfolgerung.
Kostenrealität
Pro Loop — ein Loop aus vier 45-Minuten-Runden verbraucht 40-55k Input-Token Transkript plus rund 8k aus den Referenzdateien und 3-5k Output über beide Durchläufe. Zu Claude-Sonnet-Listenpreisen (3 US-Dollar je Million Input, 15 je Million Output) sind das 0,20-0,35 US-Dollar pro Kandidat. Schätzung, aus den Token-Zahlen von Transkripten dieser Länge.
Im Volumen — 100 Loops pro Monat landen bei 20-35 US-Dollar Modellkosten. Der Kostenpunkt, der zählt, ist der Verifikationsschritt: 6-7 strukturierte 45-Minuten-Nachgespräche pro Monat plus Vorbereitung sind rund 8-10 Stunden Interviewer-Vollkostenzeit.
Einrichtung — 90 Minuten, und diese Zahl ist nur ehrlich, wenn Ihr ATS Transkripte bereits mit Zeitstempeln exportiert. Teams, die die Transkript-Erfassung erstmals verkabeln, brauchen einen Tag oder mehr, und die Interview-Intelligence-Schicht ist die Voraussetzung.
Was er nicht spart — die Präsenzrunde. Für eine Rolle mit HOHEM Risiko und einer A-posteriori-Wahrscheinlichkeit über 20% kostet die Anreise weniger als die Alternative und klärt alle drei Betrugsklassen auf einmal.
Erfolgskennzahl
Markierungsvolumen folgt der vorhergesagten Rate. Wenn eine A-priori-Rate von 2% 6,5 Markierungen vorhersagt und Sie 30 bekommen, ist die Taxonomie fehljustiert, nicht die Pipeline kompromittiert.
Jede Markierung mit dokumentiertem Ergebnis geschlossen. Das Entscheidungsprotokoll in references/3-verification-playbook.md §4 kennt keinen Teilzustand. Eine offene Markierung zu einem aus anderen Gründen abgelehnten Kandidaten ist der denkbar schlechteste Datensatz.
RESOLVED-Anteil über 70%. Die meisten Markierungen sollten sich in der Verifikation auflösen. Ein niedrigerer Anteil heißt, der Filter feuert auf Rauschen.
Null Auftreten ausgeschlossener Signale in Berichten. Eine deterministische Prüfung, die nie auslösen sollte.
Gegenüber den Alternativen
Gegenüber Anbietern für Echtzeit-Deepfake-Erkennung. Pindrop, Reality Defender und die inzwischen in Konferenzplattformen eingebauten Erkennungsschichten arbeiten am Medienstrom, den dieser Skill bewusst nicht anfasst. Ergänzend, nicht redundant — und angesichts der datensatzübergreifenden Zahlen oben nur bei einem Anbieter zu kaufen, der sein Benchmark-Set offenlegt. Sie verifizieren die Pixel. Sie verifizieren nicht, dass die antwortende Person weiß, was im Lebenslauf steht.
Gegenüber Anbietern für Identitätsprüfung. Dokument-plus-Lebenderkennung zum Angebotszeitpunkt ist die richtige Kontrolle für Klasse A, und Sie betreiben daneben vermutlich bereits etwas wie Checkr. Sie verifizieren, wer unterschrieben hat. Sie verifizieren nicht, wer ab Woche zwei die Arbeit macht — und genau dort lebt das Laptop-Farm-Muster.
Gegenüber Proctoring und Lockdown-Browsern. Billiger im Einkauf, schlechter im Betrieb. Sie schieben das Interview Richtung Überwachung, benachteiligen Kandidaten mit geteilten Verbindungen und Hilfstechnologien und klären weniger als ein einziges gut geführtes Tiefen-Nachgespräch.
Gegenüber einer technischen Assessment-Plattform.Karat und Vergleichbare führen Live-Interviews mit Menschen, die sowohl Stellvertreter als auch Copilot strukturell erschweren. Wo das Budget reicht, ist das die stärkere Antwort als jeder Filter — der Skill ist für die Runden, die Sie selbst führen.
Gegenüber dem Status quo. Ungeschulte Menschen erkennen synthetische Medien nahe der Zufallsrate. Der reale Status quo heißt nicht «Recruiter merken es», sondern «niemand schaut hin», und die Grenzkosten des Hinschauens liegen bei 0,30 US-Dollar pro Kandidat.
Fallstricke
Eine Markierung wird als Befund gelesen.Schutz: Jede Markierung druckt ihre A-posteriori-Wahrscheinlichkeit samt Eingangsgrößen daneben, und kein Ausgabefeld taugt als Ablehnungsgrund.
Bestätigungsfehler durch einen vorgeprägten Extraktor.Schutz: Durchlauf eins läuft ohne Betrugsvokabular im Kontext; die Taxonomie lädt erst in Durchlauf zwei.
Mittelbare Diskriminierung über Auftreten.Schutz: Die Ausschlussliste aus §4 greift an der Ausgabe, und verworfene Signale werden ausgedruckt.
Kamera-Zurückhaltung wird gegen einen Anpassungsbedarf gewertet.Schutz: Das Signal scort nur dort, wo eine schriftliche, einheitlich angewandte Policy und ein angebotener Anpassungsweg beide vorliegen; sonst meldet der Skill die Policy-Lücke statt des Kandidaten.
Biometrische Artefakte kommen mit dem Export mit.Schutz: Schritt 1 stoppt bei einwilligungspflichtigem Material ohne zitierten Nachweis.
Verifikationskapazität wird überrannt.Schutz: Das erwartete Monatsvolumen an Markierungen wird vor dem ersten Lauf ausgedruckt, und die Warteschlange ordnet nach A-posteriori mal Rollenrisiko, sodass der Rest wartet.
Der Bericht wird zu Beweismaterial.Schutz: Das Entscheidungsprotokoll des Playbooks schließt jede Markierung ausdrücklich, und §6 veröffentlicht den Kandidatenhinweis vor dem ersten Lauf statt nach der ersten Markierung.
Stack
Das Bundle liegt unter apps/web/public/artifacts/ai-interview-fraud-detection-skill/ und enthält:
SKILL.md — die Skill-Definition
references/1-signal-taxonomy.md — vier Signalklassen mit Gewichten und Falsch-Positiv-Schätzungen, die Liste ausgeschlossener Signale und die Basisraten-Parameter
references/2-interview-record-intake.md — ausfüllbare Erfassung mit einer Rechtsgrundlagen-Spalte je Feld
references/3-verification-playbook.md — Verifikationsmethoden, das Live-Nachprüfungsprotokoll, das Entscheidungsprotokoll und die Vorlage für den Kandidatenhinweis
Setzt Claude für den Lauf voraus, ein ATS wie Greenhouse für die Prozessfakten und eine Transkriptquelle — Metaview oder gleichwertig — für Abschnitt A.
---
name: ai-interview-fraud-detection
description: Screen an interview record — transcripts plus loop metadata you already hold — for identity-substitution, proxy-interview, and real-time answer-assistance signals, and emit a corroboration report that routes named candidates to a live verification step. Works on text and process facts, never on biometric or affect analysis. Produces a verification queue, never a fraud verdict and never a rejection.
---
# AI interview fraud detection
## When to invoke
Use this skill when a remote hiring loop has finished or is mid-flight and someone needs to know which candidates carry unresolved corroboration gaps before an offer goes out. It reads the interview transcripts and the process record around them, and returns a per-candidate report separating what the record corroborates from what it contradicts.
The output is an input to a verification step — a live structured re-interview, a document check, a reference call. It is not an input to a hiring decision. That separation is load-bearing and section *Method* explains why.
Typical triggers: a fully-remote engineering or IT req, a role with production-system or customer-data access, a candidate whose written work and live answers read as different people, a req where equipment ships before day one.
Do NOT invoke this skill for:
- **Rejecting a candidate.** No output field is a rejection ground. Section *Base rates* shows why: at a 2% prior and a 5% false-positive rate, roughly 3 in 4 flags are innocent candidates. A flag that rejects is a screen that discriminates against the innocent majority of the flagged set.
- **Media forensics.** The skill does not analyze video frames, face geometry, voiceprints, blink rate, or micro-expressions. It never touches the media file. Section *Why text and process, not media* gives the accuracy reason and the legal reason.
- **Inferring emotion, confidence, honesty, or stress.** EU AI Act Article 5(1)(f) prohibits AI systems that infer emotions of a natural person in the workplace from biometric data, and the Commission's February 2025 guidelines on prohibited practices read "workplace" to cover candidates during selection and hiring. Deception detection from demeanor is out of scope regardless of jurisdiction — it does not work, and it converts an interview into a polygraph.
- **Screening for AI use where AI use is permitted.** Decide the policy first. If candidates are told they can use an assistant, answer-provenance signals are noise. Set `ai_use_policy` and the skill drops signal class C.
- **Retroactive sweeps of a closed pipeline.** Running this across last year's rejected candidates manufactures a dataset of unadjudicated accusations against named people, discoverable in any later charge, with no verification step available to clear anyone. Run it forward-looking only.
- **In-person loops.** Identity substitution and real-time assistance both require the remote channel. An onsite final round is the stronger and cheaper control; see `references/3-verification-playbook.md` section 1.
## Inputs
- Required: `interview_record` — per candidate, the transcripts of each round with speaker labels and utterance timestamps, plus the round type and the interviewer. Timestamps are what make answer-latency analysis possible; without them signal class C is unavailable and the skill says so rather than guessing. Template in `references/2-interview-record-intake.md`.
- Required: `claim_set` — the candidate's own assertions available to you before the loop: resume, application answers, portfolio or repository links, and any written take-home. This is the corroboration baseline. A contradiction is only meaningful against a recorded claim.
- Required: `process_facts` — the loop metadata your ATS and IT already hold: scheduling history, reschedule and no-show events, the address on file for equipment, the application-source record, and whether the same contact details appear on other applications. Section B of the intake template.
- Optional: `ai_use_policy` — `prohibited`, `permitted`, or `permitted_with_disclosure`. Default `prohibited`. Anything other than `prohibited` disables signal class C.
- Optional: `base_rate` — your estimated prior for fraudulent candidates reaching a live loop, as a decimal. Default 0.02. The skill uses it to compute expected flag volume and posterior probability; see *Base rates*.
- Optional: `jurisdictions` — work locations in scope. Controls which notice and consent prerequisites the preflight checks.
## Reference files
- `references/1-signal-taxonomy.md` — the four signal classes, per-signal weights, the excluded-signals blocklist, and the base-rate parameters. The skill reads weights from this file and never from model memory.
- `references/2-interview-record-intake.md` — fillable intake template with a lawful-basis column per field, so the collection question is answered before the analysis question.
- `references/3-verification-playbook.md` — what happens after a flag: the live re-verification protocol and script, the decision log, and the candidate-notice scaffolding.
## Method
Six steps, in order. Two structural choices drive the whole design and are worth stating before the steps.
**Two passes, and the extractor never sees the taxonomy.** Pass one extracts claims, timings, and contradictions with no fraud framing in its context at all. Pass two scores those extracted facts against `references/1-signal-taxonomy.md`. A single pass primed with a fraud taxonomy manufactures the signals it was told to look for — every hesitation becomes evasion once the model knows it is hunting for evasion. Splitting the passes costs one extra call per candidate and is the difference between a report about the record and a report about the prompt.
**The output routes to verification, not to a decision.** A flag opens a verification step whose *outcome* is the only thing that reaches the hiring decision. This keeps the skill out of automated-decision-system territory under California's FEHA ADS regulations and NYC Local Law 144, and it keeps the FCRA question narrow — CFPB Circular 2024-06 holds that algorithmic scores about workers obtained from third parties for employment decisions are often governed by the FCRA, with consent, disclosure, and pre-adverse-action duties attached. An in-house screen that gates a verification step rather than a decision sits in a different place than a purchased score that gates an offer. Where the line falls for your setup is a counsel question, and the skill prints it as one.
### 1. Preflight the collection basis
Refuse to run if the record contains material the intake template marks as consent-gated and no consent artifact is cited: voiceprint or face-geometry data under Illinois BIPA, or an Illinois AI Video Interview Act consent where video interviews are AI-analyzed. The skill's own analysis is text-only and does not itself trigger BIPA, but records assembled for it frequently arrive with biometric artifacts attached, and BIPA carries statutory damages of $1,000 for negligent and $5,000 for reckless or intentional violations per person — narrowed to a single recovery per person per collection method by SB 2979 (signed 2 August 2024), which the Seventh Circuit held applies retroactively on 1 April 2026. Strip, do not analyze.
### 2. Extract without framing
Pass one. Produce three artifacts per candidate, with no fraud vocabulary in scope:
- **Claim ledger.** Every checkable assertion made in the loop, with the round and timestamp, normalized against `claim_set`. "Led the migration off Postgres 11 in 2023" is checkable. "I'm a strong collaborator" is not; drop it.
- **Timing profile.** Per answer: elapsed seconds from question end to first substantive word, total answer length, and the position of the longest intra-answer pause. Raw numbers only.
- **Register profile.** Per answer: a description of vocabulary level, sentence structure, and specificity, without comparison across answers.
### 3. Score against the taxonomy
Pass two reads the pass-one artifacts and `references/1-signal-taxonomy.md`. Four classes:
- **A — Identity continuity.** Appearance or voice descriptions that shift across rounds where interviewers noted it in writing; the equipment address diverging from the identity-document address; the same phone or email appearing on unrelated applications.
- **B — Channel and infrastructure.** Repeated declines of unscheduled live video where a policy exists and was applied uniformly; multiple candidates presenting from one IP; remote-desktop artifacts visible in shared screens.
- **C — Answer provenance.** Latency that inverts — long lead-in before easy factual answers, short before hard synthesis ones; register discontinuity between spontaneous exchanges and set-piece answers; answers that restate the interviewer's question near-verbatim before answering; specificity that collapses under an unscripted follow-up. Disabled when `ai_use_policy` is not `prohibited`.
- **D — Record contradiction.** Loop claims contradicted by `claim_set` or by a public artifact the candidate themselves cited.
Each signal returns `corroborated`, `unresolved`, or `contradiction`. There is no `fraudulent` value and no aggregate fraud score. Weights sum to a *verification priority*, which orders a queue and nothing else.
### 4. Apply the excluded-signals blocklist
Before anything is reported, drop every signal on the blocklist in `references/1-signal-taxonomy.md` section 4. Accent, non-native phrasing, name origin, home background, webcam or bandwidth quality, virtual-background use, and timezone alone are excluded. Each correlates with national origin, race, disability, or socioeconomic status, and each is the exact vector by which a fraud screen becomes a disparate-impact claim. The blocklist is enforced at output, so a signal reaching the report has already survived it.
Camera reluctance is a special case and is scored only when a written, uniformly-applied camera policy exists and an accommodation path was offered. Absent both, the skill reports the policy gap instead of the candidate.
### 5. Compute the posterior and the queue
Convert priority to an explicit probability using `base_rate` and the taxonomy's per-class false-positive estimates, and print it next to every flag. See *Base rates*. Then order the verification queue by posterior times role risk, where role risk comes from the intake template's access-level field. A production-credentials role and a marketing-coordinator role with the same posterior are not the same problem.
### 6. Emit the report
Per candidate: the corroboration table, the posterior with its inputs shown, the specific unresolved items phrased as questions for the verification step, and the excluded signals that were dropped and why. Contradictions print with both the loop quote and the conflicting claim verbatim, so a human reads the evidence rather than the conclusion.
## Base rates
The single most common way a fraud screen fails is arithmetic. With prior `p`, recall `r`, and false-positive rate `f`, the probability that a flagged candidate is actually fraudulent is:
```
PPV = (p * r) / (p * r + (1 - p) * f)
```
At `p = 0.02`, `r = 0.80`, `f = 0.05`: PPV = 0.016 / (0.016 + 0.049) = **24.6%**. Three flags in four are innocent people. At `p = 0.10` and the same screen, PPV rises to 64%.
Two consequences the skill enforces rather than mentions. Flags open a verification step, because a 24.6% posterior cannot carry a rejection. And flag volume is a capacity number: 100 loops per month at `p = 0.02` and `f = 0.05` produces about 6.5 flags per month, of which 1.6 are real. If your verification step cannot absorb 6-7 structured re-interviews a month, tune `f` down in the taxonomy before running, not after the queue backs up.
## Why text and process, not media
Two reasons, and either alone would be sufficient.
**Accuracy.** Deepfake detectors collapse out of distribution. Published cross-dataset benchmarks show detectors near-perfect on their training distribution falling to chance-adjacent on unseen generators — one widely-benchmarked detector drops from 0.998 AUC in-dataset to 0.674 cross-dataset, and to 0.633 on Celeb-DF. The adversary chooses the generator. A detector you cannot benchmark against the generator actually in use gives you a number, not a control.
**Law.** Face-geometry and voiceprint analysis of candidates is biometric collection under BIPA and its successors, with the consent and retention duties and per-person statutory damages in step 1. Affect inference from that same data in a hiring context is prohibited outright in the EU under Article 5(1)(f), with penalties up to €35 million or 7% of worldwide annual turnover. Text-and-process analysis of records you already lawfully hold carries neither exposure.
Real-time media detection has a place — at the stream layer, from a vendor who can attest to their benchmark set. It is a different control at a different layer, and it does not replace corroboration.
## Output format
```markdown
## Verification queue — req ENG-2291, loop closed 2026-07-24
### 1. Candidate C-4471 — posterior 31% — role risk HIGH — VERIFY
Inputs: base_rate 0.02 · recall 0.80 · class-weighted FPR 0.036
| Class | Signal | Status | Evidence |
|---|---|---|---|
| D | Postgres migration year | contradiction | Round 2 14:02 "we cut over in early 2023"; resume lists the role ending Nov 2022 |
| C | Latency inversion | unresolved | Factual recall 9.4s mean lead-in; open-ended design 1.8s mean |
| A | Equipment address | unresolved | Shipping ZIP 07102 vs identity-document ZIP 94103 |
| B | Live video | corroborated | Two unscheduled calls accepted, 2026-07-11 and 2026-07-18 |
Questions for verification (see references/3-verification-playbook.md §2):
1. Walk through the cutover timeline against the employment dates on the application.
2. Unscripted depth probe on the migration's rollback plan.
3. Confirm the shipping address against the identity document at offer stage.
Excluded and not reported: 2 signals (bandwidth quality, phrasing register vs. first language).
### 2. Candidate C-4468 — posterior 6% — role risk LOW — NO ACTION
All four classes corroborated or unresolved-immaterial. No verification step.
---
Loop total: 11 candidates · 1 verification · 0 contradictions unresolved after verification
Counsel review queue: 1 item — FCRA characterization of the corroboration report if the
verification outcome contributes to a no-hire. See references/3-verification-playbook.md §5.
```
## Watch-outs
- **A flag gets treated as a finding.** *Guard:* every flag prints its posterior with inputs beside it, and no output field is a rejection ground. The verification outcome is the only decision input.
- **Confirmation bias from a primed extractor.** *Guard:* pass one runs with no fraud vocabulary in context; the taxonomy loads only in pass two.
- **Proxy discrimination through demeanor signals.** *Guard:* the section-4 blocklist is enforced at output, and dropped signals print in the report so the exclusion is auditable.
- **Camera reluctance scored against a candidate with an accommodation need.** *Guard:* the signal scores only where a written uniform policy and an offered accommodation path both exist; otherwise the skill reports the policy gap.
- **Biometric material arriving with the record.** *Guard:* step 1 refuses to run on consent-gated artifacts without a cited consent record, and instructs stripping rather than analysis.
- **The screen runs where AI use is allowed.** *Guard:* `ai_use_policy` gates signal class C, and the default is `prohibited` so the setting is a deliberate act.
- **Verification capacity is overrun and flags age out silently.** *Guard:* step 5 prints expected monthly flag volume from `base_rate` and the taxonomy FPR before the first run, and the queue is ordered by posterior times role risk so the tail is the part that waits.
- **The report becomes discovery material.** *Guard:* the playbook's decision log records verification outcomes and closes each flag explicitly. An open flag with no recorded outcome is the artifact that hurts you later.
# Signal taxonomy
checked: 2026-07-29
maintainer: <your name>
review cadence: every 90 days, or on any change to the hiring AI-use policy
The skill reads weights, false-positive estimates, and the exclusion blocklist from this file. Edit the numbers to match your pipeline; do not edit them to make a candidate fit.
---
## 0. Parameters
| Parameter | Default | Set it from |
|---|---|---|
| `base_rate` | 0.02 | Your own confirmed cases over loops run in the last 12 months. If you have none, keep 0.02 and treat every posterior as an upper bound. |
| `recall` | 0.80 | Assumption, not a measurement. Lower it to 0.6 if your loops are under 45 minutes — short loops give class C almost nothing to work with. |
| `role_risk` | see §5 | The access the role gets on day one, not seniority. |
| `ai_use_policy` | `prohibited` | Your published candidate-facing policy. If nothing is published, the answer is `permitted` — you cannot screen against an unstated rule. |
Class-weighted false-positive rate is computed from the per-signal `fpr` column below across the classes that are enabled.
---
## 1. Class A — Identity continuity
Whether the person in round 3 is the person in round 1, and whether that person is the applicant.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Interviewer noted in writing that appearance or voice differed from a prior round | 0.30 | 0.02 | Only counts from a contemporaneous written note, never from a later recollection. |
| Equipment-shipping address diverges from the identity-document address | 0.20 | 0.08 | High innocent base — sublets, family addresses, mid-move candidates. |
| Same phone or email on an unrelated application under a different name | 0.30 | 0.01 | Strong when it is exact-match, worthless when it is fuzzy. |
| Application-source record inconsistent with the candidate's account of how they applied | 0.10 | 0.15 | Weak. Included because it is cheap, excluded from the queue on its own. |
| Reference contact details resolve to a domain registered inside 90 days | 0.20 | 0.03 | Check the domain, not the person. |
## 2. Class B — Channel and infrastructure
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Declined 2+ unscheduled live video requests under a written uniform policy | 0.20 | 0.10 | Scores ONLY with the policy and the accommodation path in place. See §4. |
| Multiple concurrent candidates presenting from one IP | 0.35 | 0.01 | Ask IT for the join records; do not infer from the recording. |
| Remote-desktop or screen-relay artifacts visible during a shared screen | 0.25 | 0.05 | Chrome Remote Desktop, AnyDesk, TeamViewer, RustDesk banners. Legitimate on a work-issued machine — check whose machine it is before scoring. |
| Second voice audible or a second person's cursor visible | 0.35 | 0.02 | Also fires on a noisy household. Requires the interviewer's written note. |
## 3. Class C — Answer provenance
Disabled entirely unless `ai_use_policy` is `prohibited`. All four need utterance timestamps; without them the class returns `unavailable`, not `corroborated`.
| Signal | Weight | fpr | Notes |
|---|---|---|---|
| Latency inversion — longer lead-in on factual recall than on open synthesis | 0.25 | 0.12 | The characteristic shape of retrieval-then-read. Also the shape of an anxious candidate warming up; treat 0.12 as optimistic. |
| Register discontinuity between spontaneous exchange and set-piece answer | 0.20 | 0.15 | Highest innocent rate in the taxonomy. Prepared answers are prepared. |
| Interviewer's question restated near-verbatim before the answer begins | 0.15 | 0.10 | Artifact of transcription-then-generation. Also a normal stalling habit. |
| Specificity collapses on an unscripted follow-up to a detailed answer | 0.30 | 0.06 | The strongest signal in the class, and the one that needs an interviewer trained to ask the follow-up. |
If your interviewers do not routinely ask one unscripted depth follow-up per detailed answer, fix that before running this skill. It costs nothing and it outperforms every other signal here.
## 4. Excluded signals — never reported, enforced at output
Each of these correlates with a protected characteristic and produces a disparate-impact vector rather than a fraud signal. The skill drops them and prints that it dropped them.
- Accent, prosody, or non-native phrasing
- Name origin, transliteration, or spelling convention
- Home or office background, furnishings, or visible household members
- Webcam resolution, lighting, or bandwidth quality
- Virtual-background or background-blur use
- Timezone, or working hours, in isolation
- Employment gaps
- Typing speed, or written-English fluency, as a standalone signal
- Any inference of emotion, confidence, honesty, nervousness, or engagement from voice or video — prohibited in the EU under AI Act Article 5(1)(f) for workplace and recruitment contexts, and unsupported everywhere else
Camera reluctance is scored under class B only where BOTH a written camera policy applied uniformly across the req AND an offered accommodation path are recorded. Where either is missing, the skill reports the policy gap and scores nothing.
## 5. Role risk
| Level | Definition | Multiplier |
|---|---|---|
| HIGH | Production credentials, customer PII, payments, or source-code write access on day one | 1.5 |
| MEDIUM | Internal systems, no production or customer data | 1.0 |
| LOW | No systems access beyond email and documents in the first 30 days | 0.6 |
Role risk orders the queue. It never changes a posterior — a 6% posterior on a HIGH-risk role is still 6%.
## 6. Biometric and consent-gated material — strip, do not analyze
Presence of any of these in the record halts the run until a consent artifact is cited:
- Voiceprint or speaker-embedding files
- Face-geometry templates or facial-landmark exports
- Third-party AI-video-analysis scores attached to an Illinois-based candidate
- Any vendor "authenticity", "integrity", or "confidence" score derived from the media stream
The skill's analysis is text and metadata only. These arrive attached to exports and are the most common reason a text-only screen acquires biometric exposure it never needed.
# Interview record intake
Fill one copy per requisition. The lawful-basis column is not decoration — answer it before the field is collected, because the cheapest way to fail this workflow is to assemble a record you had no basis to assemble.
req_id: ENG-2291
work_locations: [Remote-US: CA, NY, IL, TX]
ai_use_policy: prohibited
policy_published_at: https://example.com/careers/ai-use-policy
base_rate: 0.02
checked: 2026-07-29
---
## Section A — Per-candidate loop record
One row per round. Timestamps are required for signal class C; mark `NO_TIMESTAMPS` rather than leaving blank, so the skill reports the class as unavailable instead of scoring it silently.
| candidate_id | round | date | interviewer | transcript_path | timestamps | interviewer_written_notes |
|---|---|---|---|---|---|---|
| C-4471 | recruiter screen | 2026-07-08 | R. Ade | records/C-4471/r1.txt | yes | records/C-4471/r1-notes.md |
| C-4471 | technical 1 | 2026-07-14 | M. Osei | records/C-4471/r2.txt | yes | records/C-4471/r2-notes.md |
| C-4471 | system design | 2026-07-21 | M. Osei | records/C-4471/r3.txt | NO_TIMESTAMPS | records/C-4471/r3-notes.md |
| C-4468 | recruiter screen | 2026-07-09 | R. Ade | records/C-4468/r1.txt | yes | records/C-4468/r1-notes.md |
Lawful basis for this section: interview records created by you, in the ordinary course, with candidate notice at scheduling. Recording requires consent in all-party-consent states — confirm the notice text covers analysis, not only recording.
## Section B — Process facts
Pulled from the ATS and IT, not from the candidate. Leave a cell `UNKNOWN` rather than estimating it.
| candidate_id | reschedules | unscheduled_video_declines | equipment_ship_zip | id_document_zip | contact_reuse_hits | application_source | reference_domains_age_days |
|---|---|---|---|---|---|---|---|
| C-4471 | 2 | 0 | 07102 | 94103 | 0 | inbound-careers | 412 |
| C-4468 | 0 | 0 | 30303 | 30303 | 0 | referral | 2100 |
Lawful basis for this section: employment-administration records you already hold. `id_document_zip` is populated at offer stage only, from the right-to-work document — never requested earlier as a screening input, which would invert the order the law expects.
`contact_reuse_hits` counts exact matches of phone or email across applications under a different candidate name, within your own ATS. Do not extend this to purchased identity-graph data; that changes the FCRA analysis in a direction you do not want.
## Section C — Claim set
The corroboration baseline. A contradiction only exists against something written down first.
| candidate_id | resume_path | application_answers_path | portfolio_urls | take_home_path |
|---|---|---|---|---|
| C-4471 | claims/C-4471/resume.pdf | claims/C-4471/application.json | github.com/example, example.dev | claims/C-4471/takehome/ |
| C-4468 | claims/C-4468/resume.pdf | claims/C-4468/application.json | — | — |
## Section D — Role risk
| req_id | day_one_access | role_risk | rationale |
|---|---|---|---|
| ENG-2291 | production DB read/write, customer PII | HIGH | On-call rotation from week 3 |
Answer for day one, not for month six. A role that earns production access after a 90-day probation is MEDIUM, and the probation itself is the control.
## Section E — Consent and notice prerequisites
Check before the first run. A `NO` here halts the run.
| Prerequisite | Applies when | Status | Artifact |
|---|---|---|---|
| Candidate notice that interview records are analyzed | always | YES | https://example.com/careers/ai-use-policy |
| All-party recording consent captured | recording in a two-party-consent state | YES | ats://consent/ENG-2291 |
| Illinois AI Video Interview Act consent | AI analysis of video interviews, IL candidates | N/A | text-only analysis, no video analyzed |
| BIPA written release and retention schedule | any voiceprint or face-geometry collection | N/A | none collected — see taxonomy §6 |
| Written camera policy applied uniformly + accommodation path | scoring camera reluctance | NO | not published — class B camera signal disabled |
The last row is the common one. Absent both artifacts, the skill scores nothing on camera reluctance and reports the gap against the process rather than the candidate.
## Section F — Verification capacity
| Loops per month | base_rate | class-weighted FPR | Expected flags/mo | Verification slots/mo | Headroom |
|---|---|---|---|---|---|
| 100 | 0.02 | 0.05 | 6.5 | 8 | +1.5 |
If headroom is negative, raise the taxonomy weights to tighten the screen before running. A queue that outruns capacity does not fail loudly — it ages, and the tail is where the real case sits.
# Verification playbook
What happens after a flag. The screen produces a queue; this file produces an outcome. A flag with no recorded outcome is the artifact that hurts you in a later charge, so section 4 is not optional.
checked: 2026-07-29
---
## 1. Pick the verification method
Ordered by strength. Use the cheapest one that resolves the specific unresolved items, not the strongest one available.
| Method | Resolves | Cost | Use when |
|---|---|---|---|
| Onsite or in-person final round | Identity substitution, proxy, real-time assistance — all three at once | Travel, 3-6 hours | HIGH role risk and a posterior above 20%. The strongest control on this list, and it needs no skill to run. |
| Live structured re-verification (§2) | Answer provenance, record contradictions | 45 min | The default. Most flags resolve here. |
| Right-to-work document check at offer | Identity, address divergence | Built into your existing offer process | Class A signals. Already happening — just sequence it before equipment ships. |
| Direct employer and institution verification | Record contradictions on employment or education | 2-5 business days | Class D contradictions. Contact the institution directly, never the reference number the candidate supplied. |
| Paid work sample, observed live | Real-time assistance, competence substitution | 2-4 hours, paid at market rate | Where class C is the whole flag and the role is hands-on. Pay for it; an unpaid extra round on a flagged candidate is a fairness problem on top of everything else. |
Do not add a proctoring or lockdown-browser layer as the response. It moves the loop toward surveillance, disadvantages candidates on shared connections and assistive technology, and resolves less than a single well-run live follow-up.
## 2. Live structured re-verification — protocol
45 minutes, same interviewer where possible, camera on for both sides, no recording beyond your standard practice.
**Do not tell the candidate they are suspected of fraud.** Say what is true: there are specifics from the earlier round you want to go deeper on. A candidate told they are under suspicion performs worse whether or not they did anything, which corrupts the only measurement you have left.
Structure:
1. **Rapport, 5 min.** Unscripted, unscored. Establishes the spontaneous-register baseline that step 3 compares against.
2. **Depth probes on the flagged claims, 25 min.** Take each unresolved item from the report. Ask the candidate to walk the specific decision, then ask one unscripted follow-up they could not have prepared: what broke, who disagreed, what you would do differently. Prepared and retrieved answers both thin out here; lived experience does not.
3. **Register comparison, inline.** The interviewer notes whether depth-probe answers match the section-1 baseline in vocabulary and specificity. Written note, contemporaneous.
4. **Contradiction, direct, 10 min.** Read the contradiction back verbatim — the loop quote and the conflicting claim — and ask them to reconcile it. Most contradictions are resume compression or a date error and resolve in one sentence. Give that sentence room.
5. **Close, 5 min.** Standard candidate questions. Do not signal the outcome.
## 3. Scoring the verification
One of four outcomes per flag. Nothing else.
- `RESOLVED` — the unresolved items are now corroborated. Close the flag, proceed with the loop normally, and record it. The candidate carries no residue into the decision.
- `RESOLVED_WITH_CORRECTION` — a claim was wrong and the candidate corrected it. This is a normal resume-accuracy matter and goes to the hiring manager on the ordinary path, not through this workflow.
- `UNRESOLVED` — the items are still open after a fair attempt. Escalate to §5 before any decision. Do not reject on `UNRESOLVED` without that step.
- `CONTRADICTED` — the candidate's account is inconsistent with a document they themselves supplied, restated and unreconciled. Route to §5 with the artifacts attached.
There is no `FRAUDULENT` outcome. That determination sits with counsel and, where sanctions or identity theft are in play, with law enforcement.
## 4. Decision log — fill one per flag
```
flag_id: F-2291-003
candidate_id: C-4471
opened: 2026-07-24
posterior_at_open: 0.31
role_risk: HIGH
unresolved_items: [D-migration-year, C-latency-inversion, A-address-divergence]
method: live structured re-verification
conducted: 2026-07-29 by M. Osei
outcome: RESOLVED_WITH_CORRECTION
notes: Cutover was Nov 2022 under the prior employer; resume date correct,
round-2 recollection wrong. Rollback plan detail was specific and
matched the public postmortem the candidate had cited.
Address divergence: sublet, lease provided at offer stage.
closed: 2026-07-29
decision_impact: none — candidate proceeded to offer
```
Every field populated, every flag closed. An open flag on a candidate you declined for unrelated reasons is the worst possible record to hold.
## 5. Escalation and counsel review
Send to counsel, with the report and the decision log, when any of these hold:
- Outcome is `UNRESOLVED` or `CONTRADICTED` on a HIGH-risk role.
- Class A signals point at identity substitution rather than answer assistance. Sanctions exposure attaches to who is employed, not to how well they interviewed — DOJ enforcement to date has treated employers as victims, and OFAC has not filed against inadvertent employers, but both have signaled expectations of diligence.
- The candidate is in Illinois and any biometric artifact was collected at any point in the loop.
- The verification outcome will contribute to a no-hire, and any part of the corroboration input came from a third-party vendor. Under CFPB Circular 2024-06, third-party algorithmic scores about workers used for employment decisions are often consumer reports, which pulls in the pre-adverse-action sequence: the report and a summary of rights to the candidate, a waiting period, then the final notice. Whether your setup crosses that line is a counsel call, not a skill output.
## 6. Candidate notice — scaffolding
Publish this before the first run, not after the first flag. Adapt the bracketed parts.
> **How we review interviews.** We review interview transcripts and application records for consistency, and we do this for every candidate in a requisition, not for selected individuals. We do not analyze video, faces, voices, or emotional expression, and no automated output decides whether you are hired.
>
> If our review leaves something unresolved, we ask you about it directly in a follow-up conversation before any decision is made. You can ask what was unresolved and respond to it.
>
> [Our policy on AI assistance during interviews is here.] Records are retained for [N] months and then deleted, except where a longer retention period is required by law.
The second paragraph is the one that does the work. A screen the candidate can answer is defensible; one they cannot is not.
