Having been fooled by 2 "overemployed" people (on a team of 20), these fake candidates are distinct in that they're almost always have an unexplained heavy accent yet they say they're born and raised in the US. They also often have Zoom backgrounds that are just... odd (the room will often look like it has shelving and boxes or whatever that don't look like something you would see in the US).
It's difficult because no single data point is enough to prove they're fake, but when you add all the warning signs together, it's pretty obvious.
In my experience, /r/overemployed people are a lot better at blending in with regular candidates.
Re: overemployment, the best counter-offense I've found is to require LinkedIn profiles and to require background checks that include employment verification. Most "overemployed" people are smart enough to not have a LinkedIn profile. This has a side effect of excluding applicants without a LinkedIn, but it's a tradeoff.
Would you exclude someone for successfully verifying their employment, but having an outdated LinkedIn profile?
The more I think about it the more it sounds like an EEOC violation.
Having your current employer on LinkedIn drastically raises your chance of being spear-phished—something to keep in mind.
Also, did they come out clean at the end? Or did they try to get away with it
I've also heard of situations where one person is hired to do the job, but then after a while their work changes for the worse. They start "forgetting" things you've talked about recently, or they'll "forget" how the code they submitted an hour ago works.
They're either a front person for a dev shop, or they're trying to outsource their work. They don't care about doing a great job because they know most companies will take a long time to fire people. If the company PIPs them, they might suddenly become a great performer again until the heat dies down, then it's back to the same game.
Before the "if they're getting their work done, why does it matter?" comments: Having someone take our codebase and send it to random contractors is a huge security breach. Ignoring that, carefully interviewing and selecting one person to do your work and then receiving deliverables from a cheap contractor is plain fraud.