Reference check fraud is easier than most hiring managers think. The candidate gives you a name and a phone number, a friend answers, and you hear exactly what you hoped to hear. In a 2020 Checkster survey of 400 applicants, 43.75% of applicants said they had faked or would fake a reference. That's one vendor survey reported through a press release, so don't treat it as a precise rate. But even a fraction of that is a problem when the reference is your last check before giving someone access to production.
Here's how fake references get through, and the handful of habits that stop most of them.
Key Takeaways
- Most reference check fraud uses the contact details the candidate supplies. Fix that and you've fixed most of it.
- US government guidance on remote IT hiring says to verify employers through contact information you find yourself, such as through a search engine.
- Ask questions that only a real manager can answer: specific projects, specific weaknesses, who else was on the team.
- A good reference doesn't prove the person you interviewed is the person who did the work. Pair references with identity checks.
How fake references get through
The friend on the phone. The most common version. A former colleague or a friend poses as a manager. They're warm, specific in the wrong ways, and available within the hour.
The paid reference service. Companies have sold fake employers and references for years. In 2015 Vice profiled a service whose founder said he acted as HR manager for about 200 nonexistent companies, offering "verifiable references from nonexistent companies". I can't confirm that particular service still operates. The model clearly still exists.
The real person, wrong role. The reference worked with the candidate but never managed them, and describes the team's work as the candidate's.
The coached reference. Real manager, real relationship, prepared script. Not fraud exactly, but it hides what you need to know.
How to stop reference check fraud
Find the reference yourself. The 2022 State, Treasury and FBI guidance on North Korean IT workers advises verifying employment "using contact information identified through a search engine," not information obtained from the candidate. In practice: look up the company, call its main line, ask for the person by name. If you must use the given number, cross-check it.
Check the reference exists. Their LinkedIn should show the same company at the same time, with history before the candidate got there. A profile created last month with 12 connections is a flag. LinkedIn's verification badges help a little: they confirm a government ID (via CLEAR in the US) and a current workplace (LinkedIn Help), but nothing about past employers.
Ask for a reference you choose. "Can you connect me with the engineering manager on the payments project you described?" A candidate with real history usually can. One with a scripted list often can't.
Ask questions a stand-in can't answer.
| Question | Why it works |
|---|---|
| "Who else was on the team, and what did they work on?" | A fake reference doesn't know the org chart |
| "What did they ship in their last quarter with you?" | Should match what the candidate told you, with different details |
| "What feedback did you give them that they struggled with?" | Coached references go vague here |
| "Would you hire them again for the same role? Why or why not?" | Hesitation is information |
More on running the call well is in how to check a developer's references.
Where references fit in remote engineering hiring
References tell you about the past. They can't tell you that the person you interviewed is the person who did that past work, or that the person on your payroll next month is the same one. That's why I'd put references alongside identity verification and interview continuity, not in place of them. Our posts on resume fraud detection and candidate identity verification cover the other two.
At Ruzora, engineers reach our bench after two separate evaluations: a graded coding challenge and an AI interview answered on camera. You see blind profiles first; after the service agreement, you meet the engineers with their full identity and can run your own reference checks on top.
A Concrete Version
A 25-person martech company is about to hire a senior iOS contractor. Two references provided, both glowing.
- Reference 1: a "former VP Engineering" at a fintech in Mexico City. The hiring manager looks up the fintech, finds its main line, and asks for him. Reception says nobody by that name has worked there. The number the candidate gave goes to a mobile phone.
- Reference 2: a real engineering manager at a real company, LinkedIn history going back 8 years. Called through the company switchboard. Confirms the candidate worked on her team for 14 months, as a mid-level engineer, not senior. Describes the app work accurately.
Total time: about 40 minutes. Outcome: the company pauses. In a follow-up call the candidate says reference 1 was "a mentor, not technically my boss." The company passes. Reference 2 alone would have been fine for a mid-level role at a mid-level rate.
The Honest Counterpoint
Calling main lines takes time, and in Latin America many companies don't route reference calls anywhere useful. Small startups close, managers move on, and HR departments often only confirm dates. You'll sometimes fail to reach a real reference for a real candidate. Don't treat that as fraud.
And honest candidates do give friends as references when they've only worked at tiny companies or freelanced. The problem is a reference who lies about their role, not a reference who's also a friend.
Frequently Asked Questions
What is reference check fraud?
When a candidate supplies a fake or misrepresented reference: a friend posing as a manager, a paid reference service, or a real colleague who overstates their role. It works because most employers call the number the candidate gives them.
How do you spot a fake reference?
Find the reference's company and phone number yourself, confirm their role and dates on LinkedIn, and ask questions only a real manager would know, like who else was on the team and what the candidate shipped last.
Are reference checks still worth doing for remote engineers?
Yes, if you do them independently. They're cheap and catch inflated seniority. They don't prove identity, so pair them with ID verification and continuity checks. See how to identify fake candidates.
The Bottom Line
Reference check fraud mostly lives in the phone number the candidate gave you. Find the reference yourself, ask specific questions, and treat references as one layer of several. To start from engineers who already passed two separate evaluations, see our bench or request a shortlist.
Roberto Espinoza is CEO of Ruzora, which helps US startups hire pre-vetted senior LATAM engineers, with a vetted shortlist in 72 hours. See available engineers.
