How do you build a legally defensible case to rescind a job offer for AI cheating?
By Pinal Dave | Last updated: 2026-08-01
TL;DR: A defensible rescission needs three things: a clear, disclosed policy the candidate agreed to, timestamped evidence showing the specific violation, and consistent application across similar cases. A trust report generated during the interview, showing identity, behavior, and audio flags with timestamps, is the core evidence most companies rely on.
The short answer
Rescinding an offer is a legally sensitive action, and doing it based on a vague suspicion invites risk. The exposure is lower when the company can point to a written policy the candidate was told about before the assessment, specific and timestamped evidence of a violation, not just a gut feeling, and proof that similar violations from other candidates were handled the same way. Without those three elements, a rescission looks arbitrary even when the underlying suspicion was correct.
This matters more now because AI-assisted cheating has become common enough that candidates increasingly push back or dispute a flag, sometimes publicly. Greenhouse's survey of 4,136 respondents found 91% of hiring professionals encountered suspected AI-generated answers, so this is not a rare edge case a company can handle informally when it comes up.
The evidence
- Fabric (19,368 interviews, Jul 2025 to Jan 2026): 38.5% of candidates flagged for AI-cheating behavior, indicating companies need a repeatable, not ad hoc, process for handling flags.
- Greenhouse survey (4,136 respondents): 91% encountered suspected AI-generated answers, and 31% suspected deepfake use, both situations where documentation matters if a candidate disputes the outcome.
- DOJ and Microsoft laptop farm case: shows regulators and courts increasingly recognize interview and identity fraud as a real, prosecutable pattern, which supports the legitimacy of company-level policies addressing it.
Weak case vs. strong case for rescinding an offer
| Element | Weak case | Strong case |
|---|---|---|
| Policy disclosure | Not mentioned to the candidate beforehand | Stated in the assessment instructions or interview invite |
| Evidence | Interviewer's impression after the call | Timestamped trust report with specific flags |
| Consistency | Applied only to this one candidate | Applied the same way to every flagged candidate for the role |
| Documentation | Verbal notes only | Written record retained with the hiring file |
Step-by-step: building the case properly
- Publish the policy before the assessment, not after a flag appears. State clearly that identity verification and behavior monitoring apply, and what counts as a violation.
- Capture evidence at the time of the interview, not reconstructed from memory afterward. A trust report generated during the session, with timestamps, is far stronger than a summary written days later.
- Give the candidate a chance to respond, where policy and jurisdiction allow. A documented opportunity to explain strengthens the record either way.
- Apply the same standard to every candidate for that role. Selective enforcement is the fastest way to turn a legitimate flag into a legal or reputational problem.
- Retain the full record, not just the final decision. If the rescission is ever challenged, the underlying evidence, not just the conclusion, is what matters.
FAQ
What counts as sufficient evidence to rescind an offer? Specific, timestamped signals, such as identity mismatch, a detected virtual camera, or a second voice during the session, carry far more weight than a general impression that something felt off.
Does the candidate need to be told about proctoring in advance? Yes, this is both a fairness and a legal-defensibility issue. Disclosure before the assessment is standard practice and strengthens the company's position if the decision is later reviewed.
Should HR or legal be involved before an offer is rescinded? Yes, for any offer already extended. Rescinding after an offer carries more legal weight than declining to extend one in the first place, so involving HR or legal early is standard practice.
What if the flag is a false positive? This is exactly why a documented process matters. A candidate given a chance to respond to a specific, named flag can often clear up a false positive before any action is taken.
Is a single flag enough, or should companies wait for a pattern? It depends on the severity of the flag. An identity mismatch is usually treated as significant on its own; a single ambiguous behavior signal may warrant a closer look before any decision is made.