Fraud detection helps your team spot potentially fraudulent activity in incoming applications by identifying unusual patterns and highlighting them for review. These signals can include hidden text in resumes, reused devices or IP addresses, and unusual application behavior.
You can review the findings, assess whether an application needs further investigation, and mark a candidate as suspicious, uncertain, or cleared. Candidates won't be asked to provide additional information or complete any extra steps.
A signal doesn't confirm fraud, and no action is taken automatically. Your team reviews the findings and decides whether further action is needed.
A Company Admin user needs to activate this feature in the Add-on feature center to get started
Configuration
Once fraud detection is activated in your account, it will start checking all new incoming applications for potential fraud based on the default signal families.
To configure which signals fraud detection checks for, go to Settings → Security → Fraud detection. Here, you can enable or disable the following signal families:
Signal family | Description |
Document integrity | Detects text in a resume that is invisible or difficult for readers to see but can still be read by software, such as text matching the background color, text that is too small to read, or text hidden behind an image. |
Application behaviour | Looks at how an application form is completed and how frequently applications are submitted. Signals may include unusually fast submissions, no pointer movement, answers pasted without typing, or multiple applications submitted within a short period. |
Device fingerprint | Identifies patterns related to the device used to submit an application. Signals may include the same device being used by multiple candidates, automated browser activity, or a mismatch between the device's timezone and other application details. |
Network | Identifies when multiple candidates submit applications from the same IP address, which may indicate a connection between applications that warrants further review. |
Fraudulent activity checks
Fraud detection checks different types of applications depending on the signal family.
Application behavior, Device fingerprint, and Network
These signals only apply to applications submitted through the career site's application form, including embedded forms (iframes) and existing candidates who confirm their application through an email link.
The following are not checked:
Candidates added manually or sourced
Imported candidates
Candidates created through the API
Applications submitted through job board integrations
Only applications submitted after fraud detection is activated are checked. Previous applications are not checked retroactively.
Document integrity
This signal checks the candidate's resume rather than the application itself, so it can also cover candidates who didn't apply through the career site (excluding imported candidates).
Review fraudulent activity
When potential fraudulent activity is detected, an indication will appear on the candidate in both the candidate bank and the job they have been added to.
When opening the candidate card, there will be a banner at the top indicating that potential fraud has been identified.
You can then review the fraud status, read a summary of the findings, and explore the individual signals to understand what was flagged.
Signals and severity
Each signal is assigned a severity: Low, Medium, or High, depending on the type of activity detected.
Signal | Family | Severity |
Hidden text | Document integrity | Medium |
Fast submission | Application behavior | Low |
No pointer movement | Application behavior | Low |
Pasted without typing | Application behavior | Low |
Rapid applications | Application behavior | Low |
Automated browser | Device fingerprint | Medium |
Reused device | Device fingerprint | Medium / High |
Timezone mismatch | Device fingerprint | Medium / High |
Shared IP address | Network | Low |
Set fraud status
Until your team makes a manual decision, the candidate's fraud status reflects the highest severity among their detected signals: Low risk, Medium risk, or High risk.
To set the fraud status, open the review window from the candidate card and select one of the following options:
Mark as suspicious if you believe the application shows signs of fraudulent activity.
Mark as uncertain if you need to acknowledge the signals but cannot determine whether the activity is fraudulent.
Mark as cleared if you have reviewed the signals and don't consider the application suspicious.
Important to keep in mind
Always review the available information before making a decision. A signal does not confirm fraud. Shared IP addresses, reused devices, or unusual application patterns can have legitimate explanations. For example, candidates may use public Wi-Fi, assistive technology, or browser autofill.
Decisions are linked to the candidate, not individual applications, so they remain if the candidate applies for another job. If candidate profiles are merged, their signals and decisions are merged too.
Once a decision has been made by a user, it replaces the automatic risk status. The review window will show a Change status button instead, along with the name of the person who made the decision and the date it was recorded.
Anyone who has permission to edit the candidate can set and update the fraud status under Change status. To remove a decision entirely, select Remove decision and confirm. This removes the decision and the information about who made it, but the fraud signals remain.
You can set a fraud status even if no signals have been detected or the candidate has been cleared.
To do this, open the candidate card, select the three-dot menu (...) in the action menu, and choose Set fraud status.
Filter by fraud status
You can use filters in the Candidates tab to find candidates based on their fraud status. Select Fraud status and one of the following options:
No fraud signal
Low risk
Medium risk
High risk
Marked suspicious
Marked uncertain
Marked cleared
This helps you find applications that may need further review.
Data & privacy
Data storage
Different types of data will be stored by the fraud detection depending on which signal families are enabled:
Network: IP addresses
Device fingerprint: Device details and device fingerprints
Application behavior: Application form timing, paste and typing counts, and pointer movement
Device fingerprints are unique to each company and are not compared across different Teamtailor accounts.
Data retention
Fraud detection checks for reused IP addresses and devices using data from the previous 90 days. If a candidate is deleted, their fraud data, including IP addresses, device fingerprints, and decisions, is permanently deleted after 90 days.
Disabling a signal family
When you turn off a signal family:
Checks stop for new applications. For Document integrity, checks also stop for resumes added after the family is turned off. Signals already detected remain visible on the candidate.
Data collection stops for that family. For example, turning off Network stops IP address storage, turning off Device fingerprint stops collecting device details, and turning off Application behavior stops tracking pastes, typing, and pointer movement.
The change is recorded in the Audit log if your company uses this add-on. An entry is created each time a signal family is enabled or disabled.
Prefer reading in your own language? Check out our other support centers available at the top of the page 🌍