Most bad hires announce themselves early
If you have hired an assistant before and watched it go wrong, the painful part is rarely the day it ended. It is looking back and spotting the signs you talked yourself out of: the camera that never quite worked, the references that took two weeks to arrive, the rate that seemed too good to question. Most bad hires are not sudden. They give notice, quietly, at every stage of the process.
That matters more in 2026 than it did even two years ago. Generative AI has made a polished CV, a confident cover letter and even a convincing video interview cheap to fake. Research firm Gartner predicts that by 2028, one in four candidate profiles worldwide could be fake. In July 2026, the UK joined ten other governments in a joint alert warning businesses about remote workers hired under false identities. This is no longer a problem for large tech firms alone. Any business that hands an inbox, a CRM or a payments login to someone it has never met in person is in scope.
The good news is that the warning signs are well documented, and almost all of them can be checked before you give anyone access to anything. This guide sorts them by the stage where they appear: the application, the interview, the contract and the first 30 days.
Red flags are cheapest to act on before access is granted. Every check in this guide costs minutes at the hiring stage and weeks once your data is in someone else’s hands.
The honest mismatch and the deliberate scam need different checks
Not every bad hire is a fraudster. Most are honest people in the wrong role: an assistant who oversold their English, took on four clients at once, or cannot work without being told what to do next. The damage is slow but real. Missed messages, work done twice, and the hours you spend checking everything yourself.
The second kind is rarer and far more expensive. Here the person is not who they say they are, or is using your access for something you never agreed to. Cifas, the UK fraud prevention service, has reported more employees hiding their background to secure roles, alongside “polygamous working”, where someone holds several jobs without any employer knowing, and the use of fake reference services to cover the gaps. In its 2025 workplace survey, 30% of UK workers said using one of those reference services was justified.
"A skills test tells you whether someone can do the job. An identity check tells you whether they are the person doing it. Skip either one and you have only half hired."Umbrella Connect Editorial
The checks that catch one rarely catch the other. A sound process needs both, and the rest of this guide shows where each one fits.
Red flags in the advert, the CV and the first messages
The application stage feels like the low-risk part, so it is where most owners are least careful. It is also where filtering costs the least. Six signs deserve a second look before anyone gets as far as an interview.
A rate with no explanation
Lower rates are normal offshore. A rate far below what the same skills cost in the candidate’s own country, with no clear reason, is a named warning sign.
A CV that mirrors your advert
If it repeats your job description almost word for word, it was written to match the advert, not drawn from real experience.
References you cannot reach
Mobile numbers only, free email addresses, or referees who reply within minutes and praise everything. Ask for a company landline you can look up.
A brand new online footprint
A profile created last month with a polished photo and a long list of well-known past clients needs verifying, not trusting.
A push to move off the platform
If you met on a marketplace, an early request to switch to private chat or direct payment strips away the protection you signed up for.
Unusual payment requests
Pay in cryptocurrency, or into someone else’s bank account, appears in UK government guidance on fake remote workers. Treat it as a stop sign.
Red flags in the interview and the paid test
The interview is where impersonation now shows up most. UK sanctions officials and cyber security researchers have both urged businesses to bring back live video interviews for remote roles, because a real-time conversation on camera is still one of the hardest things for a fake candidate to pass. The July 2026 joint alert lists refused or manipulated video interviews among its main warning signs.
A short, paid test is the other half. It is the only reliable way to see real work at real speed, and the way a candidate handles it tells you as much as the result does.
| Red flag | What it can mean | What to do |
|---|---|---|
| Camera “broken” or always off | Someone else may be speaking, or the face on the profile is not theirs | Make a live video call a condition of the next stage, with no exceptions |
| Video slightly out of sync, or the face blurs when they move | A real-time face filter or deepfake | Ask them to turn their head, pass a hand across their face and hold their ID beside it |
| A long pause before every answer, then a fluent paragraph | Answers read from a screen or fed by someone off camera | Ask follow-up questions about specific details in their own CV |
| A different voice or manner on the second call | More than one person sharing one identity | Keep the same interviewer for every round and note voice, accent and setting |
| Flawless test work, then weaker live work | The test was done by someone else, or entirely by a tool | Run part of the test live on a shared screen |
| A fee for equipment, software or training before starting | A classic advance-fee scam | Decline. A genuine assistant or provider does not charge you to begin |
| Pressure to decide today | Urgency is the oldest way to skip checks | Slow down. A good candidate will still be there tomorrow |
Red flags when you hire through an agency or provider
Hiring through a company rather than direct removes some risks and adds a few of its own. The question shifts from “is this person real?” to “what exactly does the money buy, and who carries the risk when it goes wrong?”
Watch for a provider that will not tell you who your assistant is until you have paid, or that introduces one person at interview and quietly swaps in another later. Be wary of vague answers to “where will they work?”, because “remote team” can mean a supervised office or a kitchen table shared with three other clients. Long minimum terms with no replacement promise put every risk of a poor fit on you. And if the assistant will handle personal data for you, UK GDPR requires a written contract setting out how that data is processed. A provider who looks blank when you ask for one has told you how seriously it takes your clients’ data.
For contrast, this is what the green-flag version looks like in practice. At Umbrella Connect, candidates go through skills tests, a personality profile, CV and reference checks before the client’s own final interview. Each assistant works for one client only, from a managed office in Sri Lanka with company equipment, supervisors on the floor, daily attendance and output checks, and weekly reporting. If the fit is wrong, the replacement is free, and everything is agreed in writing before recruitment starts. You do not need to use Umbrella Connect to apply this standard. You should expect every provider to answer the same questions just as clearly.
Six questions to put to any provider, in writing
Red flags after they start, and how to limit the damage
Some problems only surface once the work begins. The first month is when you have the most leverage and the least to lose, so it is worth watching closely rather than hoping for the best.
Most of the risk sits in access. Cifas found in 2026 that 13% of UK workers had sold company login details, or knew someone who had, in the previous year. A shared password cannot be traced to one person, cannot be withdrawn from one person, and usually unlocks far more than the job needs. Set up access as if the arrangement might end next week. If it does, you will be glad you did.
Watch output, not activity. An assistant who is online for eight hours and produces two hours of work is a bigger warning than one who logs off early with everything done.
Which red flags matter most for your kind of business
Every business should watch for all of the signs above, but the cost of missing one varies by sector. These are the groups that most often hand an assistant sensitive data in the first week.
Estate and lettings agencies
Tenant records, deposit details and landlord bank information. Prioritise identity checks and individual logins on your property software, and never share the master account.
Hospitality and travel businesses
Guest passports, card details and booking platforms. Watch for sign-ins from unexpected locations and keep payment access separate from guest messaging.
Accountants, bookkeepers and brokers
Client financial records, often under regulatory duties of their own. Insist on a named assistant, supervised working and a signed data processing agreement before any access.
Founder-led SMEs
The founder’s own inbox, bank and calendar. The biggest risk is convenience: one shared password to save time. Set up separate accounts on day one, even if it takes an extra hour.
Good assistants are not found by luck. They are filtered in.
It is tempting to read a list like this and decide that hiring remotely is too risky to try. The opposite is true. Every red flag here has a simple check that catches it, and the owners who get burned are almost always the ones who skipped the checks, not the ones who hired offshore.
The real change is where you put your effort. Most owners spend their energy finding candidates and very little filtering them. Reverse it. A short list of honest, verified, supervised people is worth more than a hundred applications, and the hour spent on a live video call, a paid test and proper logins is the cheapest insurance your business will ever buy.
If you are at The Business Show at ExCeL London on 11 and 12 November, bring this list to stand B1600. The Umbrella Connect team will walk you through how each check is handled for its own assistants, and answer the six provider questions in writing.
Meet on live video, every time. Pay for a short test and watch part of it live. Call references you found yourself. Give every assistant their own logins, never yours. Ask any provider who does the work, where, and what happens if it fails, and get the answers in writing.
