Fake IT Workers Pass Background Checks
Remote contractor identity verification asks what a background check can’t. Does this person own that name?
Fake remote IT workers are real. Okta tied North Korean operatives to more than 6,500 job interviews at over 5,000 companies through mid-2025, and KnowBe4 hired one who passed four video interviews and a clear background check.
Last updated: October 31, 2026
Now the part that should bother anyone buying contract labor. In its July 2025 notice, the FBI singled out the way you probably hire. Read it twice.
“Contract IT work is a common way that North Korean IT workers procure employment.”
FBI public service announcement I-072325-4, July 2025
So your staffing firm’s screen is part of your security perimeter, whether or not anyone wrote that down. Fake IT workers get in through that gap. This page is for the CISO, IT director or hiring manager buying remote contractors through IT staffing services, from us or from anyone else, and it sticks to what you can ask a supplier to show you before anyone gets a laptop or a login.
- On this page
- What to require from a staffing supplier, and what KORE1 does before a contractor starts.
- Somewhere else
- Running the interviews yourself? Start with how to vet remote contractors for identity fraud.
How Big Is the Fake Remote IT Worker Problem?
Bigger than the headlines suggest. Okta Threat Intelligence tracked over 130 identities tied to the scheme and linked them to those 6,500 interviews, and it calls those identities a small sample of the whole. A small sample. Only about half the targets were IT companies, so this isn’t a tech-only worry.
The Justice Department showed what the other end looks like. Between June 10 and June 17, 2025, the FBI searched 21 premises across 14 states and seized about 137 laptops, and the DOJ announcement says one scheme alone reached more than 100 US companies using the identities of more than 80 Americans.
Picture a spare bedroom. That’s a laptop farm.
It also stopped being only a payroll problem. The FBI’s January 2025 notice, I-012325, describes workers copying company code repositories to their own accounts, then holding stolen data and code hostage until the company pays, and in some cases releasing it publicly. Ransom, from your contractor.
Why a Background Check Is Not Enough
A stolen identity is a real identity, so a background check on it comes back clean. Here is one specimen card, read two ways.
In daylight
What a background check reads
- Name
- Sample Specimen
- Status
- Valid
- Do the name and Social Security number match?Yes
- Any criminal record under that name?None
- Do past employers show up on record?Yes
- Is the degree on record?Yes
Comes back clear.
Under the lamp
What only a person can check
- Name
- Sample Specimen
- Person on the call
- Unconfirmed
- Is the person on the call the person on the card?Not on the report
- Are they where the card says they live?Not on the report
- Did the old manager, reached directly, know them?Not on the report
- Where does the company laptop actually go?Not on the report
Still open on day one.
The lamp is a way of picturing it. Nobody is holding a UV light to a remote hire, and the right-hand checks happen on calls and in shipping records. What a standard check does cover is in our background check guide.
KnowBe4 is the case everyone cites, for a good reason. It sells security awareness training. Think about that. In 2024 its HR team ran four video interviews on separate occasions, confirmed the person matched the application photo, ran the background check and verified references, and every one of those came back clear because the identity was valid and stolen, and the photo was an AI-altered stock image.
The company laptop started loading malware the moment it arrived. Instantly. KnowBe4’s security team contained the device fast, and the company says no data was lost. Most buyers don’t have that team. Would yours catch it?
Fake IT Worker Tactics to Watch For
Four that come straight from the FBI’s 2025 notices. None of them shows up on a report.
Face-swap video
The FBI has seen AI and face-swapping used in live job interviews to hide who is talking.
Proxy interviewers
One person gets hired to pass the interview, and someone else does the work afterward.
Laptop farms
A US facilitator signs for the company laptop, then gives remote access to a worker overseas.
Late address changes
The shipping address or the payment platform changes during onboarding, which the FBI tells HR teams to watch.
Facilitators have also set up US front businesses that claim to offer short-term technical contract workers, according to the FBI’s July notice. Check your supplier too. Our list of questions for vetting a staffing agency is a fair place to begin.
What KORE1 Checks Before Day One
The steps below are the published version of how we vet candidates. The order stays the same from req to req.
- Scoring against the req. Skills, experience, industry and title get graded separately. That’s a fit check, and it won’t catch a stolen name.
- Then a recruiter spends 30 to 45 minutes on the phone asking who they reported to and what actually shipped. Memorized stories get thin around the third follow-up.
- A skills assessment follows on about 35% of reqs, built from the real first-week work and graded by someone who has done it.
- On a W-2 contract seat KORE1 is the employer of record, so Form I-9 and payroll sit with us. Treat that as a floor. Paperwork is exactly what a stolen identity beats.
For a remote seat with systems access, we add the checks from the FBI’s guidance to the req itself, which means video with the background showing, employers and schools contacted directly, a location question nobody can look up, and a laptop that goes only to the address on the ID.
Will that catch everyone? No. No screening process catches every fraud, and we’d distrust any firm that says otherwise. It does make the scheme a lot more work. That’s the job.
A Recruiter Who Knows the Candidate Is a Security Control
“A recruiter who actually knows the candidate is now a security control, not overhead.”
Devin Hornick, Partner, KORE1
Yes, a recruiting firm would say that. Test the logic anyway. Fraud of this kind is built for one-shot checks, the single database pull or the single panel interview, and it gets harder to sustain each time the same person has to talk to someone who remembers the last conversation. Memory is the control.
That’s Devin’s other point, and it’s about firm size. A smaller firm whose recruiters personally know each contractor is harder to fool than a high-volume pipeline, because somebody notices when the voice on the third call doesn’t match the first. The FBI suggests the same habit in plainer terms, capturing images so you can compare them with later meetings.
Repeat contractors help too. If we placed someone two years ago, the scorecard and references are already on file, and we know who picks up. Hard to fake that.
Red Flags and What to Require From Your Staffing Supplier
The FBI tells companies to verify that third-party staffing firms run sound hiring practices and audit them routinely. Here is what that looks like in a supplier conversation.
| Red flag | Where it shows up | What to require from your supplier |
|---|---|---|
| Video glitches when a hand crosses the face | Recruiter screen, client interview | Live video with the background showing. A hand wave in front of the face can trip AI video, per the FBI. |
| The person in week one doesn’t match the interview | First calls after the start date | The same recruiter stays on the seat and compares voice and images against the earlier calls. |
| Laptop address changes late | Between offer and start | Equipment ships only to the address on the ID. A different address needs more documentation. |
| Vague answers about where they are right now | Any live call | Questions about the claimed location and school, and the camera pointed out a window if anything feels off. |
| Same resume text, phone or email across applicants | Sourcing and submittal | A cross-check of the supplier’s records for reused contact details, including voice-over-IP numbers. |
| Employers who can only be reached through the candidate | Reference stage | Employment and education verified directly with the company and the school. |
| Bank details change often or match another worker | Payroll setup and first pay runs | Payment accounts compared across workers, and no pay in virtual currency. |
| Remote desktop tools, or logins from several countries | First days on your network | No system access until the background check clears, then least privilege. Agree who watches first logins. |
Requirements are drawn from FBI I-012325 and FBI I-072325-4. For the access side after the start date, see the contractor access policy template. Agencies that can’t answer these aren’t necessarily careless. They just haven’t been asked. If yours still can’t answer, here is how replacing a staffing vendor works. SOC 2 auditors often sample contractors too, and our page on SOC 2 readiness explains what that evidence looks like.
Tell Us What the Seat Can Touch
Access sets the scope. A contract writer and a contract systems administrator with production credentials aren’t the same risk, so tell us the role, the arrangement, the access level and the date. A recruiter will come back to you about the seat.
Want numbers first? The 2026 contract rate card has bill rates by role, and remote contract staffing covers how we run remote seats.
Hire remote contractors with verified identities
Work email, please. We use your details to respond to this request. See our privacy policy.
3 days
median from accepted offer to start (n=1,997)
116 days
median contract assignment (n=1,887)
37.5%
of contract-to-hire placements converted to direct hire (207 of 552)
$102
modeled median hourly bill rate, mid-level contract security role, US national
KORE1 placement data 2019 to 2026, export of October 16, 2026, all roles. The dataset is 79% California, and anomalies and payroll-service deals are excluded. The $102 figure is a modeled cell in the KORE1 Contract Rate Index, 2026-Q4, not an observed placement rate. The method is public.
Can You Verify Identity and Still Start Fast?
Usually, yes. KORE1 contractors start a median of 3 days after an accepted offer, and most of the checks above belong before that offer, inside calls that were happening anyway. The exceptions are the honest ones. An employer who doesn’t call back, or a candidate who won’t turn the camera on, takes as long as it takes, and we’d rather tell you that on day two than ship a laptop on day three. Listen to the delay.
Budget for the seat too. The index models a mid-level contract security role at $90 to $116 an hour nationally, about $53,300 for three months at the median. Full-time assignments, 13 weeks.
Contract commitments are plain. People show up on time, they get paid on Fridays, and they can convert to your payroll at no fee after 1,040 hours, and that is the whole list on our side. There’s no replacement guarantee on a contract seat, and none against fraud either, which is why the checks matter.
Common Questions
How do I make sure a remote contractor is who they say they are?
Use several checks at several stages, because no single one holds. Run live video with the background showing, verify employers and schools directly, ask location questions, and ship equipment only to the address on the ID. Compare the person on later calls with the one you interviewed.
Is a background check enough to catch a fake IT worker?
No. A background check reads the record attached to a name, and a stolen identity has a clean record. KnowBe4’s check came back clear on a valid but stolen US identity. Run it, since the FBI says not to grant system access until it’s done. Then keep going.
How do staffing agencies screen out fake remote IT workers?
The careful ones test the person as well as the file. At KORE1 that means a 30 to 45 minute recruiter conversation about who a candidate reported to and what shipped, plus identity checks from FBI guidance on remote seats with systems access. No firm catches every fraud.
What are the red flags of a fake IT worker?
Three show up most in the FBI’s guidance. Video that glitches when something crosses the face, a laptop address that changes during onboarding, and a person after the start date who doesn’t match the interview. Reused phone numbers and frequent bank changes belong on the list too.
What should a staffing firm verify before a remote contractor starts?
Identity, location, work history and equipment destination, each by a route the candidate doesn’t control. Ask your supplier to show you how it does each one. Show, not tell. If the answer is a background check vendor’s name and nothing else, keep asking.
Talk to a Recruiter About Your Next Remote Seat
Bring the role and the access it needs. We will walk you through the checks we would run on it.
Talk to a Recruiter