North Korean IT Workers and Remote Developer Hiring Fraud
US authorities, including the FBI and the Departments of State, Treasury, and Justice, have warned that North Korean IT workers use stolen or fabricated identities to obtain remote software jobs, sending wages to the North Korean government and sometimes stealing data. Companies reduce the risk with identity verification, live video interviews, consistent background checks, controlled equipment shipping, and access monitoring.
What the schemes look like
US government agencies have published advisories and brought enforcement actions describing how North Korean IT workers obtain remote positions, particularly in software development, at companies in the United States and elsewhere.
False identities. Workers use stolen identities, identities borrowed from facilitators, or fabricated personas with polished profiles, portfolios, and references.
Facilitators and laptop farms. People in the hiring country receive company laptops at their homes and keep them online so the worker can connect remotely, making activity appear to originate domestically. Facilitators may also help pass background checks or receive payments.
Payment routing. Wages are routed through accounts that ultimately send funds to the North Korean regime, which US authorities say helps finance weapons programmes. Some workers request payment in cryptocurrency or to accounts that do not match the employee's identity.
Multiple jobs. A single worker or team may hold several remote roles at different companies simultaneously.
Data theft and extortion. Advisories and prosecutions have described cases where workers accessed sensitive data or source code, and in some cases threatened to leak it after being discovered.
The details change as schemes adapt, so treat published government guidance as the current reference.
Why it matters beyond security
Paying individuals acting on behalf of a sanctioned government can expose a company to sanctions violations, even without knowing it. US Treasury guidance on sanctions compliance applies, and companies that discover such a hire should get legal advice on reporting obligations.
Warning signs during hiring
No single sign proves fraud, and many have innocent explanations. Patterns matter.
Identity inconsistencies. Names, photos, locations, time zones, and employment histories that do not align across the CV, professional profiles, documents, and conversation.
Camera reluctance. Repeated refusal to appear on video, cameras that fail at key moments, or apparent use of filters or altered video.
Scripted or delayed answers. Interview responses that seem read out, or delays suggesting someone else is answering.
References that cannot be verified independently. Referees reachable only through contact details the candidate provided.
Unusual shipping requests. Asking to send equipment to an address different from the stated home address, or to a third party.
Payment irregularities. Requests to pay a different person, split payments, change bank details soon after hiring, or pay in cryptocurrency without a clear reason.
Profile patterns. Recently created or sparse online presence paired with an unusually strong claimed history, or similar portfolios appearing under different names.
Controls that reduce the risk
Verify identity properly. Use identity verification that checks government documents against a live person, and confirm the documents match the name used for payroll, tax, and bank accounts.
Hold live video interviews with cameras on, including at least one unscheduled or follow-up conversation, and ask detailed questions about claimed past work.
Check references independently. Find contact details for former employers yourself rather than using those provided.
Apply background checks consistently to all remote technical hires, within the law of each jurisdiction.
Ship equipment only to verified addresses, and require identity confirmation at delivery for high-access roles.
Pay only verified accounts in the employee's own name, and review changes to payment details carefully.
Limit and monitor access. Grant least-privilege access, watch for remote desktop tools, unusual login locations, and connections through anonymising services, and review source code access.
Use employer of record or staffing partners carefully. Confirm what verification they perform rather than assuming it.
Have a response plan. If you suspect a fraudulent hire, restrict access, preserve logs, and involve legal counsel and, where appropriate, law enforcement.
These controls also protect against more ordinary identity fraud and proxy interviewing, which are more common than state-sponsored schemes.
Train the people involved
Recruiters, interviewers, IT staff who ship equipment, and payroll teams each see a different part of the picture. Brief them on warning signs and give them a clear way to raise concerns, so a mismatch spotted by one team is not dismissed because another team already approved the hire.
This page is general information, not legal or tax advice. Employment and tax rules vary by country; get local advice for a specific situation.
Frequently asked questions
- How do North Korean IT workers get remote jobs?
- According to US government advisories, they use stolen or fabricated identities, polished online profiles, and facilitators in the hiring country who host company laptops and help with background checks or payments. This makes remote work appear to originate domestically while wages are routed to the North Korean regime.
- What are warning signs of a fraudulent remote developer?
- Inconsistent identity details across documents and profiles, reluctance to appear on camera, scripted or delayed answers, references reachable only through candidate-provided contacts, requests to ship equipment elsewhere, and requests to pay different accounts or use cryptocurrency without a clear reason.
- Is it illegal to accidentally hire a North Korean IT worker?
- Paying people acting for a sanctioned government can expose a company to sanctions violations even if unintentional, and authorities expect reasonable due diligence. Companies that discover such a hire should restrict access, preserve evidence, and seek legal advice promptly about reporting and remediation.
- How can companies prevent remote hiring fraud?
- Verify identity against government documents and a live person, interview on camera, check references independently, apply consistent background checks, ship equipment only to verified addresses, pay only accounts in the employee's name, and restrict and monitor system access for new remote hires.