North Korean remote IT worker schemes: warning signs for hiring teams

In May 2022 the US Department of State, the Treasury and the FBI warned that the Democratic People's Republic of Korea (DPRK) sends thousands of skilled IT workers abroad to earn money for its weapons programs, often while presenting themselves as US based or as nationals of other countries1. The work itself is usually ordinary software, web and mobile development. The deception is about who is doing it and where the pay ends up.

The pattern described by the FBI and the Justice Department has a few moving parts. A worker applies for a remote role using a stolen identity or one borrowed from a real person. Once hired, the company laptop is shipped to a US address run by a facilitator, sometimes called a laptop farm, where the device is kept switched on and reached remotely so it appears to be in the right country2. Pay goes to accounts the facilitator controls and is then moved overseas.

A July 2026 alert from several governments adds that these workers increasingly use third party proxies to create accounts and sit job interviews, and that they use AI to hide their identities3. Microsoft reports the use of AI to replace images in stolen identity documents and to make profile photos look more professional, and says the actors are experimenting with voice changing software4.

The scale is documented in court filings and official announcements. A few cases give a sense of it.

• 309 companies. An Arizona woman who ran a laptop farm helped North Korean workers get remote jobs at 309 US businesses, generating more than $17 million. She used 68 identities stolen from people in the United States and was sentenced to 102 months in prison5.
• More than 100 companies. In June 2025 the Justice Department said North Korean actors had obtained employment with more than 100 US companies, announced searches of 29 known or suspected laptop farms across 16 states, and said one scheme compromised the identities of more than 80 US persons2.
• More than 70 companies. In October 2026 the Justice Department charged 14 people in a scheme it says affected more than 70 US employers and generated about $3 million. The FBI searched over 40 residences in Texas known or suspected to be laptop farms and seized about 187 devices6. These are charges, and the defendants are presumed innocent.
• 320 companies in a year. CrowdStrike says the DPRK linked group it tracks as FAMOUS CHOLLIMA infiltrated over 320 companies in 12 months, a 220% year over year increase, and reportedly uses real time deepfake technology in video interviews7.

Microsoft also reports suspending 3,000 consumer email accounts created by North Korean IT workers4.

The first risk is legal. The 2022 advisory warns of reputational risk and possible legal consequences, including sanctions designation, for anyone engaged in or supporting DPRK IT worker activity1. It notes that people who violate the North Korea Sanctions Regulations may face civil penalties of up to the greater of the statutory maximum or twice the value of the transaction. An employer that pays such a worker without knowing it is still exposed, which is why sanctions and compliance teams belong in this conversation alongside recruiting.

The second risk is security. The FBI has warned that North Korean IT workers have stolen proprietary data and code and then held it hostage for payment8. The 2022 advisory describes workers using the privileged access they gained as contractors to help DPRK cyber intrusions1.

The third is ordinary business harm: paying for work that is subcontracted, done by a rotating team or not done at all, and losing time to a hire who has to be removed.

The FBI is clear that these workers cannot be identified reliably with a single indicator9. Treat each item below as a reason to look more closely and ask questions, and weigh them together.

At application

• The same phone number, especially a voice over IP number, or the same email address appearing on more than one applicant8.
• Names, locations, contact details, education and work history that do not match across a résumé, professional profiles and portfolio sites, or a portfolio that is unusually thin1.
• Identity documents that look edited or forged9.

During interviews

• Refusing video calls3, or repeated camera and microphone problems that never get resolved4.
• A photo ID that does not match the person on screen, or video that appears manipulated or generated3.
• Signs that more than one person is behind the candidate, such as a different person showing up depending on the time of day3.

At onboarding

• A request to ship the laptop to an address other than the one on the person's identity document, or a claim that they cannot receive items at that address1.
• Changes to address or payment details during onboarding8, or requests to be paid in cryptocurrency3.

After the start date

• Remote desktop software or external remote control hardware on a company device, and applications that have nothing to do with the role9.
• Logins to one account from several IP addresses in a short time8, or being unreachable during agreed working hours1.
• Frequent rotation of bank accounts, addresses or other identifiers9.

Several of these also describe genuine people. A candidate in a rural area may have a poor connection. A real person may move house during onboarding. So the right response to a warning sign is a consistent, documented follow up that gives the person a chance to explain.

Nationality, accent, name, ethnicity and appearance are never warning signs. Do not treat candidates of Korean or Asian descent with extra suspicion, and do not single anyone out because of where they were born or grew up. The schemes rely on stolen identities of real people, often Americans, so the people they impersonate do not look or sound like any one group.

The FBI makes the same point from a practical angle. It warns that relying on ban lists or filtering out names associated with these workers can be unreliable, can block qualified applicants and can harm people whose identities were stolen9. It also cautions that aggressive countermeasures carry an unusually high risk of false positives. The people who are victims of these schemes include the Americans whose identities were used.

A fair process applies the same checks to everyone at the same stage, writes down the reason when someone is looked at more closely, and gives the candidate a way to clear up a mismatch. A person makes the decision. When a check cannot be completed, offer an alternative such as a document review by a person or an in person meeting.

The FBI recommends an approach it calls identity in depth: layered controls across the whole employment lifecycle, with identity checked continuously during employment as well as at hiring9. In practice that looks like this.

1. Verify identity at the shortlist. Check a government ID against a live person for every finalist in remote roles. The FBI lists live verification and multiple forms of identification as ways to add friction for these workers9. Our guide to identity verification in hiring covers the options.
2. Confirm it is the same person later. A check at application does not prove who joins the interview or who logs in on day one. Repeat a short check at those points. See deepfake and proxy interviews for why this matters.
3. Do as much as you can in person. The FBI advises completing as much hiring and onboarding in person as possible8.
4. Verify history independently. Contact past employers and schools using details you find yourself1, and speak to references by phone or video4.
5. Ship equipment only to the verified address. Ask for more documentation before sending a laptop anywhere else1.
6. Watch devices after hire. Apply least privilege8 and look into remote access tools and hardware that are not standard in your company9.
7. Share signals across teams. HR, IT, security and managers each see different pieces, and the FBI recommends they share information9. Hold staffing firms and contractors to the same standard4.
8. Report it. The FBI encourages companies to report suspected DPRK IT worker activity to a local field office1.

For a wider checklist that also covers ordinary candidate fraud, read how to spot a fake job candidate.

No single tool stops these schemes, and none should replace the steps above. Identity checks help with two of them: confirming a real, unique person at the shortlist and confirming the same person returns.

Elsin is built for that part. At application it reads passive signals such as VPN or hosting network IPs, disposable email, impossibly fast form fills, and the same device, phone or near identical résumé shared with other applicants. Shortlisted candidates check their ID and face on their own phone, with face images, video and ID numbers kept on the phone, and a quick re-check before the interview and on day one confirms it is the same person. Nobody is rejected automatically: a signal sends the candidate to a human review queue with the reason written out. See how the product works.