Toronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The warning signs.
Social Engineering Examples·2 sources
In early 2026, Toronto podcast-analytics company CoHost spent two months and seven interviews with a job candidate it later came to suspect was a fabricated persona. The answers were polished, the references replied instantly from Gmail accounts, and one reference on a video call seemed to copy the candidate's way of speaking. When CoHost asked for verifiable corporate contacts, the candidate refused. After rejection, the candidate's LinkedIn, references and phone numbers vanished. CEO Fatima Zaidi described it in an April 2026 opinion piece. Status: Company account, unverified.
The candidate was, in Zaidi's words, "sharp, personable, and technically impressive". After seven rounds over about two months, the team was close to an offer. Then came reference checks.
| Stage | What CoHost saw |
|---|---|
| Interviews | Very polished, smooth technical answers |
| References | Instant replies from personal Gmail addresses, explained as "between jobs" |
| Reference profiles were thin, new or nearly inactive | |
| Swap | One reference never answered and was quickly replaced |
| Video call | A reference seemed to mirror the candidate's speech and mannerisms |
| Pushback | The candidate refused corporate emails or HR contacts and pushed to speed up |
| After rejection | Profiles, references and phone numbers disappeared |
Tip: verify references through the company, not the contact details the candidate gives you. Call the employer's main line and ask for HR.
This is CoHost's own account. It doesn't name the person, identify any tool, or prove AI was used. The company read the vanishing profiles as proof of a fake identity network. CoHost rejected the candidate before any offer, so no access was granted. The account doesn't put a cost on the two months of interviewing.
The pattern fits a wider trend of fake candidates, including North Korean operatives. See the KnowBe4 case and Vidoc Security Lab.
See also synthetic identity and recruitment fraud.
No. It suspected fraud during reference checks and rejected the candidate before any offer.
Through odd references: instant Gmail replies, thin LinkedIn profiles, a swapped reference and one who seemed to mirror the candidate on video.
That's CoHost's assessment. No forensic evidence has been published.
Verify references through the company itself, check identity in person or live for sensitive roles, and don't let pressure speed up hiring.
Social Engineering Examples. “CoHost's suspected fake job candidate and fabricated references (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/cohost-fabricated-ai-candidate-references-2026
The primary account does not establish how the candidate selected CoHost or prepared for its hiring process.
Keep remote, video-first hiring while hardening verification. Quill describes using prepared interview questions, including testing them with AI chatbots, and adding in-person final interviews or small in-video verification rituals.
CoHost concluded that the operator(s) may have used AI tools to build the candidate's LinkedIn profile, resume, and employment history, which survived two months and seven interview rounds before doubts surfaced.
Cross-check a candidate's LinkedIn and resume history against independent signals, such as tenure consistency, mutual connections, and posting history predating the job search, rather than treating the existence of a profile as proof of a real work history.
Zaidi reports references using personal Gmail addresses and LinkedIn profiles with little independent history; CoHost interpreted these as part of a fabricated identity network.
Move reference verification earlier in the process and check the age and history of reference contact emails (for example with tools like IPQualityScore), treating personal-email-only references and sparse or brand-new LinkedIn profiles as a flag rather than a formality.
Zaidi describes unusually polished answers across two months and seven interviews and says their structure resembled chatbot output. The account does not establish whether or how a tool was used during the interviews.
Treat answers that are unusually frictionless, with no hesitation on any technical edge case, as worth a second look alongside the opposite pattern of scripted-hesitation phrasing, rather than reading pure polish as pure competence.
When CoHost began verification, references replied instantly from Gmail addresses (explained away as being between jobs), and an unresponsive reference was quickly swapped for another, keeping the fabricated network intact under light scrutiny.
Independently contact the HR departments of employers listed on the candidate's resume rather than relying solely on candidate-supplied references, and treat a same-day reference swap after non-response as a hard flag.
Zaidi reports that a reference mirrored the candidate's speech patterns and mannerisms, which the team interpreted as possible voice and video filtering. The account does not identify or independently verify a tool.
Live voice/video filtering during a video call is genuinely difficult to catch in the moment by eye alone, so the practical control sits in the surrounding steps, requiring an independent, out-of-band callback to a verified corporate number or HR contact rather than trusting the video call itself as verification.
Zaidi reports that the candidate refused requests for verifiable corporate email addresses and HR contacts, and pressed the team to accelerate hiring instead.
Treat any candidate refusal to provide verifiable corporate contacts, or pressure to accelerate hiring once verification is requested, as a hard stop rather than a scheduling inconvenience to be worked around.
After rejection, the candidate's LinkedIn profile, reference profiles, and phone numbers disappeared within about 30 minutes, which CoHost interpreted as evidence that the identity set was centrally controlled rather than independent and organic.
Use employment background screening and criminal record checks, including Certn. Treat this as one verification layer rather than proof that AI-assisted deception has been detected.
Browse by what this case has in common with others in the library.
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…
A Bengaluru retiree lost Rs 6.88 lakh after a deepfake Facebook ad of India's finance minister pitched a fake SBI-linked…
Police say a gang turned photos into AI blinking clips to beat Aadhaar face checks, hijack linked phone numbers and…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
A judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and…
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
In August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset…
Sysdig says an AI agent ran the JADEPUFFER ransomware attack end to end: unpatched Langflow, stolen secrets, 1,342 configs destroyed.…
Fraudsters spoofing the French CEO's "personal" email talked Pathé's Dutch management into wiring €19.2M for a fake secret Dubai acquisition,…
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other…
A judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and…
A long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…
A civil complaint alleges that a retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund…
Anthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to…
FraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it,…
In the first-ever prosecutions under the federal anti-pretexting statute Congress passed after the 2006 HP boardroom spying scandal, Nicholas Shaun…
An Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+…
Fugitive hacker Kevin Mitnick impersonated a vacationing Novell employee on a "top-secret" project, defeated a support analyst's voicemail-based identity check…
Social Engineering Examples