Contractor Identity Verification Checklist for Remote Contract Engineers
Twenty-two checks in five groups to run before a remote contract engineer gets a laptop or a login.
Free for a work email. Or read the whole checklist on this page.
Every check ends in one of two states
- Seen and logged
- Still to check
Check five things before a remote contract engineer gets access. Use live video controls, match a government ID to the face, compare device and location, call references on numbers you found, and watch week one.
Last updated: November 15, 2026
The FBI has warned that North Korean IT workers use AI and face-swapping technology in video job interviews, and that US-based helpers receive and reship company laptops. That’s why teams hiring regulated industry software engineers on contract now treat the person on the call and the person on payroll as two separate questions, and they ask the second one before anyone gets a login.
A background check won’t close that gap on its own, because a stolen identity is a real identity with a clean record. So what does close it? A short list of ordinary checks, each owned by a named person and all finished before the first login. This is that list, with a log line beside every item. The argument behind it is in identity checks before a contractor gets repo access, and the buyer’s view of an agency is what to require from a staffing firm.
Download the Contractor Identity Verification Checklist
One work email and the printable PDF and the editable Word file are yours, with the same five groups as the checklist below and a log line beside every check.
Twenty-two checks
Five groups, each check tagged with where it comes from, so a reviewer can see what is FBI or Okta guidance and what is our practice.
A log line you fill in
Write what you saw and when, so the next person knows the check really happened.
A two-signature block
One from the hiring side and one from the security side, before access opens.
Where should we send it?
Work email, please. We use your details to respond to this request. See our privacy policy.
Your checklist is ready
Print the PDF for the interview loop, or paste the Word file into your onboarding ticket.
Next
Hiring remote contract engineers? Tell us the roles, whether the seat is remote or onsite and the start date, and we will send engineers a recruiter has met.
The Contract Engineer Identity Verification Checklist
Five groups, in the order you run them. The hiring side runs most of the first four groups, and the security side runs the lines for the device, the location and the access.
Identity check log · template
Contract engineer identity checks, five groups
How to read a line
- The frameTick it when the check is done and the log line is filled in.
- The source tagWhere the check comes from. Okta and KnowBe4 are tagged the same way.
- Our practiceA check we add that no report or notice asks for.
| Check | What to do | Log this | Run by |
|---|---|---|---|
| V1Camera on, background in view, no filtersFBI and Okta | Make video a condition of the interview. Ask them to drop any virtual background or filter and keep the camera on for the whole call. | Video on for the full call, background visible | Hiring side |
| V2A hand waved across the faceFBI | Ask them to wave a hand slowly in front of their face. The FBI says it may make AI-generated video malfunction, so watch the edges of the face and the hand. | Face stayed intact when the hand crossed it | Hiring side |
| V3The camera pointed out a windowFBI | Ask them to point the camera out a window, then ask about what you can see, the weather or the time of day. It should fit the place they say they are. | The view matches the place they claim | Hiring side |
| V4The same person at every roundFBI and Okta | With their consent, save a still from the first call and compare it with each later call. Okta tells hiring teams to look for a candidate swapped out between rounds. | Still from round one compared with later calls | Hiring side |
| V5A question about where they live or studiedFBI | Ask for a detail a local or a graduate knows without searching, such as a street, a campus habit or a good lunch spot near the school. | Answer fits the place they claim | Hiring side |
| Check | What to do | Log this | Run by |
|---|---|---|---|
| D1A government ID held next to the faceOur practice | Ask them to hold a current photo ID beside their face on camera. Compare the photo, the name and the date of birth with the person you see. | ID type and the date you saw it, no number kept | Hiring side |
| D2The ID authenticated by an accredited serviceOkta | Run the document through an accredited third-party identity service. A good fake passes a human glance. | Service result and date saved | Hiring side |
| D3Name, photo and contact details agree everywhereFBI | Line up the ID, the resume, the professional profile, the portfolio and the payment account. Look for typos and the name spelled two ways. | Sources compared, any difference explained | Hiring side |
| D4Past employers and schools confirmed directlyFBI | Contact the company and the school yourself. Do not rely on a letter or a link the candidate sends. | Who you reached, how, and when | Hiring side |
| D5A clear background check tied to the face you sawKnowBe4 | A check clears a name and a number. Confirm that the name on the report is the name on the document shown on camera. | Report name matches the document shown | Hiring side |
| Check | What to do | Log this | Run by |
|---|---|---|---|
| G1The laptop ships only to the address on the IDFBI | Send equipment to the address on the identification documents. If they ask for a different one, require more documentation first. | Ship-to address matches the ID, or extra documents on file | Security side |
| G2The stated location checked against IP and time zoneOkta | Cross-check where they say they are with the login location, including VPN detection, and with the hours they actually work. | Login location and work hours fit the claim | Security side |
| G3Remote access tools blocked before the laptop shipsFBI | Limit remote desktop software and local admin rights. The FBI also suggests watching for tools that run several audio and video calls at once. | Endpoint shows no remote access software | Security side |
| G4No access until the background check clearsFBI and Okta | Open nothing until the check is complete, then give the least access the work needs. Contract workers start with the smallest set. | Access request shows scope and the date checks finished | Security side |
| Check | What to do | Log this | Run by |
|---|---|---|---|
| R1A reference reached through the main switchboardOkta | Find the company’s main number yourself and ask for the reference by name. Do not use the number on the resume. | Number you found, who answered, when | Hiring side |
| R2A corporate email address, not free webmailOkta | Ask for a reference with a company address and confirm it matches the company’s own domain. A free webmail address is a flag. | Address and domain checked | Hiring side |
| R3A question only a colleague could answerOur practice | Ask what the person worked on, who they reported to and what the team looked like. A real colleague answers without effort. | Answers match the resume | Hiring side |
| R4No reused phone numbers, emails or resume textFBI | Search your applicant records for the same phone number, email address or resume wording. Treat a voice-over-IP number as a reason to look harder. | Search run, no matches or matches explained | Hiring side |
| Check | What to do | Log this | Run by |
|---|---|---|---|
| W1Several IP addresses on one accountFBI and Okta | Watch for many logins to one account in a short time from different IP addresses, and for off-hours logins from places that do not fit. | Login report reviewed on days 1 to 5 | Security side |
| W2A late change of address or payment detailsFBI | Flag a new shipping address, a new bank account or a new payment platform during onboarding. The FBI also warns about pay in virtual currency. | Any change flagged and verified again | Hiring side |
| W3Remote connections or code leaving for personal accountsFBI | Watch network logs and browser sessions for remote connections, remote desktop software and code copied to personal cloud or repository accounts. | Alerts reviewed, none open | Security side |
| W4Day one matches the interviewFBI | Ask for a camera-on check-in on the first morning. Compare it with the still you saved at the interview. | Day one still compared with the interview still | Hiring side |
Ready for access
- Hiring sideI ran the checks on this side and logged what I saw.
- Security sideI checked the device, the location and the access and logged what I saw.
- Access opened byBoth signatures are above, so access can open.
A checklist template, not legal advice or a security audit. Run the same checks on every candidate, keep as little personal data as you can, and ask counsel about state rules on biometric data and ID copies before you store anything.
Order matters. The later groups lean on the earlier ones. Group one happens on the interview call, group two before the offer, group three before the laptop ships, group four while the offer is open and group five in the first week. Run it the same way for every candidate, so it stays a process and never turns into a suspicion. The contractor onboarding checklist picks up on day one, and the contractor access and offboarding checklist covers the exit.
Live Video Controls
Five prompts. The same five for every candidate, in the same order.
I script these. Not because I think a candidate is guilty, but because a script is fair. Every candidate gets the same prompts, so nobody has to decide on the spot who looks suspicious.
Three of the five come straight from the FBI’s July 2025 notice, which tells employers to mandate video with the background unobscured, to ask for a hand wave in front of the face and to ask the person to point the camera out a window. The notice says the hand wave may make AI-generated video malfunction, and the window gives you a real place to ask about.
- “Turn your camera on and take any background off.”V1
- “Wave a hand slowly in front of your face.”V2
- “Point your camera out the window for me.”V3
- “What’s a good lunch spot near where you studied?”V5
- “Is it okay if I save a still from this call, so we can compare it later?”V4
If a candidate won’t turn the camera on or drop the filter, Okta lists that as a red flag by itself, and so do I, because a person with nothing to hide loses nothing by showing the room. That’s the control. Nothing fancier works as well.
Document Checks
A document check isn’t a glance at a driver’s license. It’s three agreements and one outside opinion.
One face
The live call, the photo on the ID and the profile photo should show one person.
One name
The ID, the resume, the background check and the payment account should spell it the same way.
One address
The ID, the shipping address and the payment account should agree on where this person lives.
The outside opinion is an accredited third-party identity service, which Okta recommends for ID documents, prior employment and degrees. A forged card that fools your eye often won’t fool a scanner. Then confirm employers and schools yourself, the way the FBI says to, and never through a link the candidate sends you or a number they hand you over the phone.
Last, tie the background check to the face. KnowBe4’s came back clear because the identity was real and stolen, so a clear report proves only that the name is clean. Check that the name on the report is on the document you saw on camera. It takes a minute. It’s the step everybody skips.
Device and Geolocation Consistency
A laptop farm is the physical half of the scheme. The FBI describes US-based facilitators who provide a US address for companies to send devices, and the Justice Department’s June 2025 action seized about 137 laptops. The worker is overseas. The laptop looks local.
- Ship to the ID. Equipment goes to the address on the identification documents, and a different address needs more paperwork first.
- Ask where the logins come from. Okta suggests cross-checking the stated location against IP addresses, VPN use and time zone, so a worker who says Denver but keeps another time zone’s hours gets noticed.
- Block remote access tools before the laptop ships. If a remote desktop tool turns up later, that’s an alert, not a convenience.
- Nothing opens until the background check clears, and then only what the work needs. The FBI says it plainly, and Okta wants least privilege as the default for contingent workers.
What a contractor may touch in the first place is set by the contractor access policy template. For the audit trail, see provisioning contract engineers for SOC 2. None of this is clever. It’s plumbing.
Reference Callbacks
A reference is only as good as the number you dialed. Three steps, in this order.
- Find the number yourself.Look up the company’s main line and ask for the reference by name. Skip the number and the email on the resume.
- Insist on a company email.Okta asks for corporate addresses and not free webmail, confirmed by a call to the switchboard.
- Ask what only a colleague knows.What did they build, who did they report to, what did the team look like. A real colleague answers easily.
Then search your own records. The FBI points to reused phone numbers, voice-over-IP numbers in particular, and to reused email addresses and resume wording across applicants. One search in your applicant tracking system takes minutes and finds what no interview will, because the person on the call has no idea what other applicants wrote on their resumes. The questions to ask around these checks are in how to interview contractors.
First-Week Anomalies
Once the laptop arrives, the checks move from the call to the logs, so watch them daily. KnowBe4’s security software caught its hire when the new laptop started loading malware.
Days 1 to 5
Many IP addresses, one account
Several logins to one account in a short time from different addresses, or off-hours logins from places that do not fit.
Onboarding
A late change of details
A new shipping address, bank account or payment platform. The FBI also warns about requests for pay in virtual currency.
Any day
Remote tools and copied code
Remote connections, remote desktop software or code copied to personal accounts show up in network and browser logs.
Day one
A different person on camera
Ask for a camera-on check-in on the first morning and compare it with the still you saved at the interview.
None of these proves fraud. Contractors travel. They change banks. They use VPNs. What each one earns is a second look from a named person within a day, instead of a quiet hope that it was nothing.
130+
identities Okta tracked in the North Korean IT worker scheme
6,500+
initial job interviews Okta linked to those actors through mid-2025
5,000+
distinct companies those interviews reached
137
laptops the FBI seized in the Justice Department’s June 2025 action
Figures come from Okta Threat Intelligence (September 30, 2025) and the Justice Department (June 30, 2025). Okta counts initial interviews and distinct companies. Those are attempts, not hires. Okta also found that at most 10% of those candidates reached a follow-up interview, so most attempts fail, and the FBI published two notices on the scheme in 2025.
Why Identity Is Now an Access Control
Five sources, each one tied to the checks it feeds.
I treat identity the way I treat a key. Whoever holds the credential holds the door, so the question of who they are belongs to the person who owns the door. In January 2025 the FBI warned that North Korean IT workers have used AI and face-swapping technology in video interviews, and that notice is where most of this checklist starts.
| Source | Date | What it found | Checks it feeds |
|---|---|---|---|
| Okta Threat Intelligence | September 30, 2025 | Tracked more than 130 identities tied to more than 6,500 initial job interviews at over 5,000 companies through mid-2025. Recommends ID checks at several stages, IP and VPN cross-checks and reference callbacks through the main switchboard. | V1, V4, D2, G2, G4, R1, R2, W1 |
| FBI notice I-012325-PSA | January 23, 2025 | Says North Korean IT workers have used AI and face-swapping technology in video job interviews. Asks employers to verify identity during interviewing, onboarding and throughout employment. | V5, R4, G3, W1, W2, W3 |
| FBI notice I-072325-4-PSA | July 23, 2025 | Says US-based facilitators provide a location for companies to send devices, and that contract IT work is a common way in. Suggests the hand wave and the window. | V1, V2, V3, V4, D3, D4, G1, G4, W2, W4 |
| Justice Department | June 30, 2025 | Announced coordinated actions against laptop farms, with about 137 laptops seized. One scheme it describes reached jobs at more than 100 US companies. | G1, G3 |
| KnowBe4 | July 23, 2024 | Its HR team ran four video interviews, and the background check came back clear, on a valid but stolen US identity with an AI-enhanced photo. The laptop shipped to an address it calls an IT mule laptop farm. | D5, G1, W3 |
The pattern across all five is the same. Each check on its own is easy to beat. Stacked, with a named person behind each one, they make the scheme a lot more work, and that’s all any screening can promise.
How KORE1 Sources, Vets and Places the Contract Engineers This Checklist Assumes
This part is us. Not Kris. A checklist like this works best on engineers a recruiter has actually met, so here is how we get there.
Sourcing
Searched by your stack
We search on the stack in your req, so the engineers you meet have already worked in it.
Regulated industry software engineersVetting
A recruiter has spoken to them
A KORE1 recruiter spends 30 to 45 minutes on the phone with a candidate before you meet them, asking who they reported to and what actually shipped.
How we vet candidatesPlacing
W2 contractors with dates on paper
KORE1 is the W2 employer of record, so every assignment has a start date and an end date, and the checks can go into the req.
How contract staffing works
“A recruiter who actually knows the candidate is now a security control, not overhead.”
Devin Hornick, Partner, KORE1
Most of this checklist belongs before the offer, inside calls that were happening anyway, which is why a KORE1 contractor still starts a median of 3 days after an accepted offer (n=1,997). For a remote seat with systems access, the checks on this page go on the req. No screen catches everyone, and ours doesn’t pretend to. Across our engineering searches we average 17 days to hire, 92% of KORE1 placements are still in the seat twelve months on, and a contractor can convert to your team at no fee after 1,040 hours. The model behind it is on the contract staffing page, and the contract engineering teams page shows how we staff a team.
Common Questions
What should I check before a remote contract engineer gets access?
Five things. Live video with camera controls, a government ID matched to the face on screen, device and location consistency, reference callbacks to numbers you found yourself, and the first week’s anomalies. Finish the first four before the laptop ships.
Is a background check enough to verify a contractor’s identity?
No. A background check reads the record attached to a name, and a stolen identity has a clean record. KnowBe4’s check came back clear on a valid but stolen US identity, so tie the report to the face you actually saw.
How can I tell if a candidate is using a face swap on a video call?
You may not see it, so give every candidate the same prompts. The FBI suggests asking them to wave a hand in front of the face and to point the camera out a window, and Okta lists a refusal to turn the camera on as a flag by itself.
What is a laptop farm?
A laptop farm is a US address where company laptops are received and kept online, so a worker overseas can use them by remote access. The FBI describes US-based facilitators who provide that location, and the Justice Department seized about 137 laptops in 2025.
Who should run these checks, the staffing firm or us?
Both, and neither should assume the other did it. A staffing firm can run the hiring-side checks before it submits a candidate. The security-side checks on the device, the location and the access belong to whoever owns the access.
Need Contract Engineers Who Start in Days?
Tell us the roles, whether the seat is remote or onsite and the start date. A KORE1 recruiter takes the req from there.
Find Contract Engineers →Not yet? Download the checklist first.
