Virtual Camera & Voice Detection in Remote Interviews
The most direct way to misrepresent who is in an interview is to fake the feed itself. Virtual cameras can present a pre-recorded clip or a different person's face as if it were a live webcam, and voice-altering software can reshape audio in real time. The interview application treats both as ordinary devices, because to the application there is nothing to tell apart.
Short answer
Do not try to detect a fake feed from the pixels. Detect the device delivering it. A virtual camera registers with the operating system as a capture device, so it is enumerable like any webcam: it has a name, a driver, a signing authority and a registration time. Compare the active device against real hardware, check the driver family, and record whether it appeared only for this session.
This works without analysing a single video frame, it does not degrade as generators improve, and it collects far less sensitive data than any form of facial analysis.
On this page
- How a synthetic feed is assembled
- Detect the pipeline, not the pixels
- Virtual device signals worth watching
- Virtual audio and the coached relay
- Legitimate uses to handle carefully
- Device verification versus identity verification
- What to ask when the device path looks unusual
- What the report should say
- Frequently asked questions
How a synthetic feed is assembled
A virtual camera is software that registers itself with the operating system as a webcam. Anything it outputs, whether a recorded loop, a filtered face or a swapped identity, appears in the camera picker alongside the real hardware. Voice tools work the same way as a virtual microphone. The interview platform cannot tell the difference, because from its perspective there is no difference: it is just another input device.
Detect the pipeline, not the pixels
Judging authenticity from the video is a losing race against ever-improving generators, and it is made worse by the conferencing platform, which compresses and re-encodes the stream before anyone sees it. Compression artefacts and generator artefacts look alike at low bitrates, which is why frame analysis produces both misses and false alarms.
The reliable tell is upstream of the picture. You do not have to prove a face is fake if you can show the feed is coming from a synthetic device that registered itself four minutes before the interview began.
| Approach | What it inspects | Ages well? | Data collected |
|---|---|---|---|
| Frame-level deepfake analysis | Pixels, lighting, blink rate, lip sync. | No. Degrades as generators improve. | Full video of the candidate's face. |
| Interviewer observation | Subjective impression of realism. | No. Inconsistent and easy to rationalise. | None, but also no evidence. |
| Device enumeration | Capture device name, driver, signature, timing. | Yes. Independent of picture quality. | Device metadata only. |
| Device timeline | When devices appeared, changed or activated. | Yes. Strongest single indicator. | Timestamps only. |
Virtual device signals worth watching
These are ordered roughly by evidential weight, weakest first. As everywhere in integrity monitoring, the top of the list is context and the bottom is the finding.
| Signal | What it observes | Weight |
|---|---|---|
| Virtual device installed | A software capture device exists on the machine. | Low. Extremely common. |
| Virtual device selected | The interview is using the software device, not hardware. | Moderate. Often noise suppression or blur. |
| Driver provenance | The driver belongs to a known synthetic-media or face-swap family. | Moderate to high. |
| Session-scoped registration | The device registered shortly before the session and disappears after. | High. Very hard to explain innocently. |
| Mid-session device switch | Capture source changes during the interview. | High, especially near identity questions. |
| Switch at a sensitive moment | Device changes exactly when identity or a hard technical question arrives. | High. This is the finding. |
Virtual audio and the coached relay
Virtual audio devices get less attention than virtual cameras and are arguably more useful to a bad actor. A virtual audio cable or mixer presents itself as a microphone so sound can be routed, combined or transformed on the way through. Legitimate uses are everywhere: noise suppression, streaming, multi-application audio.
In an interview they matter for two distinct reasons, and it is worth separating them because they call for different follow-ups.
Channel mixing is the more common of the two and the more damaging, because it does not require any synthetic media at all. The candidate is genuinely themselves, genuinely on camera, and genuinely speaking. They are simply repeating what they are hearing.
Legitimate uses to handle carefully
Virtual devices are not inherently suspicious, and a detector that treats them that way will fire on a large fraction of ordinary candidates. Background-blur tools, noise suppressors, streaming software, camera-routing utilities, accessibility audio tools and many corporate laptop images all install them, frequently as permanent fixtures.
Weak evidence
- Virtual device installed months ago and always present.
- Active from before the session and never changing.
- Driver belongs to a mainstream conferencing or noise-suppression vendor.
- Candidate mentions their setup unprompted.
Strong evidence
- Device registered minutes before the session.
- Capture source switches mid-interview.
- Driver belongs to a face-swap or voice-cloning family.
- Change coincides with an identity or high-difficulty question.
For high-risk roles the safest workflow is never to auto-reject. Preserve the device timeline, ask for clarification, and consider a second verification step. That keeps the process serious without penalising candidates whose employer-issued laptop simply routes audio through standard software.
Key takeaways
- Virtual cameras and microphones look like ordinary devices to the interview application.
- Do not fight the pixels. Detect the synthetic device feeding them.
- A capture device that registers only for the interview is a strong signal; one installed months ago is not.
- Virtual audio matters as much as virtual video, because channel mixing enables coached relays with no synthetic media at all.
- Describe what changed technically. Do not collapse every media anomaly into an identity-fraud claim.
Device verification versus identity verification
These are related controls that answer different questions, and conflating them produces both unfair outcomes and overstated reports.
| Identity verification | Device verification | |
|---|---|---|
| Question asked | Is this the person they claim to be? | Has the media or input path been manipulated? |
| When it runs | Once, usually at process start. | Continuously through the session. |
| Data collected | Identity documents, sometimes biometrics. | Device names, drivers, timestamps. |
| Blind spot | A candidate can pass, then activate a synthetic camera later. | A legitimate virtual camera user is still the right person. |
Because they are different controls with different blind spots, they belong in a report as separate lines. A virtual camera becoming active is a device event. Whether it means the person is not who they claim is a conclusion a human reviewer draws, with other evidence, and often after asking.
What to ask when the device path looks unusual
If a virtual device appears, a neutral question resolves most cases immediately. The goal is clarification, not accusation.
- "I can see your camera or audio is routed through a virtual device. Is that needed for your setup?"
- "Would you mind switching to your built-in camera for the next section?"
- "Is that noise suppression, or something your work laptop does by default?"
Honest candidates usually have a simple explanation and switch without hesitation. Suspicious setups tend to produce vague answers, sudden further device changes, or reluctance to use a normal input path. That human clarification, paired with the technical timeline, is stronger than either signal alone, and it gives the candidate a fair chance to explain before anything is written down.
What the report should say
Precision protects everyone here. A report that says "synthetic feed detected" is an accusation the evidence usually cannot support. A report that says what was observed is defensible and still actionable.
The second version tells a hiring manager exactly what happened, tells a candidate exactly what they are responding to, and does not claim anything the device layer cannot support.
Frequently asked questions
How do you detect a virtual camera in a video interview?
You detect the device, not the picture. A virtual camera registers itself with the operating system as a capture device, so it is enumerable exactly like a physical webcam: it has a name, a driver, a signing authority and a registration timestamp.
Detection compares the active capture device against known hardware, checks whether its driver belongs to a virtual-device family, and records whether the device appeared only for this session. None of that requires analysing a single video frame.
Can deepfake detection tools spot a fake interview candidate?
Pixel-level deepfake detection is a losing race, because generators improve faster than detectors and the conferencing platform re-encodes the video before anyone sees it, which makes compression artefacts and generator artefacts hard to tell apart.
Detecting the delivery pipeline is far more reliable and far cheaper. You do not need to prove a face is synthetic if you can show the feed is arriving from a software device that registered itself four minutes before the interview started.
What is a virtual audio device and why does it matter in interviews?
A virtual audio device is software that presents itself as a microphone or speaker so audio can be routed, mixed or transformed on the way through. Tools of this kind are widely used for legitimate streaming and noise control.
In an interview they matter for two reasons: they can carry real-time voice alteration, and they can mix a second channel, which is the mechanism behind a coached relay where someone off-camera feeds answers.
Are virtual cameras and virtual audio devices always suspicious?
No. Broadcast software, camera-routing utilities, background-blur tools, noise suppressors, accessibility audio utilities and many corporate laptop images all install virtual devices, often permanently. A device that has existed for months and is active from before the session begins is weak evidence at best.
What matters is whether it appeared only for this session, and whether it became active during identity or technical questioning.
How is device verification different from identity verification?
Identity verification asks whether the candidate is who they claim to be. Device verification asks whether the media and input path have been manipulated. They are related but distinct: a candidate can pass an ID check and later activate a synthetic camera, and a candidate can use a virtual camera for an entirely legitimate reason while being exactly who they say they are.
Reports should describe what changed technically rather than collapsing every media anomaly into an identity-fraud claim.
What should an interviewer say if a virtual camera appears mid-session?
Ask a neutral clarifying question rather than making an accusation: something like, "I can see your camera or audio is routed through a virtual device, is that needed for your setup?" Honest candidates usually have a simple answer about noise suppression or a corporate laptop image.
Evasive answers, sudden device changes, or reluctance to switch to a normal input path are themselves informative, and the clarification paired with the device timeline is stronger evidence than either alone.
References
- Proxy interviews and remote-control fraud, on coached relays and injected input.
- How to detect AI assistance in remote interviews, on the correlation model used throughout.
- Virtual device detection, for how InterviewWatch enumerates capture devices.
- Tamper-evident signed reports, on preserving a device timeline as evidence.
Verify it's really them
InterviewWatch enumerates capture and audio devices from endpoint metadata, with no video analysis and no facial recognition.