TL;DR
- Most organizations have five hiring stages (application, interview, background check, offer, day one), and only verify identity at one stage.
- Allied governments warned this year, real time deepfake video now defeats the interview stage
- One operator, many faces. Unit 42 found one person interviewing repeatedly as different candidates, deepfake built in an hour
- Two federal cases this year, laptop farms placed North Korean IT workers at 300+ and 100+ U.S. companies
- 22 operatives, 166,000+ applications, 76 offers. Interviews don't filter this out
- A background check confirms a record is real, not the person behind it
A hiring process is a sequence of handoffs. Someone submits an application. A different set of eyes reviews it. Someone else conducts the interview. A background check runs against the name on file. An offer goes out. On day one, someone hands over a badge, a laptop, and system credentials. Each handoff assumes the person on the other side of it is the same person who came before. Almost nothing actually confirms that.
Most companies do have a real identity check somewhere in this sequence, usually the background check. It's often thorough. It's also just one point in a chain of several, and it answers a narrower question than most HR teams assume it does.
A Job Interview Can Be Faked
On July 31, 2026, the governments of eleven allied nations, including the United States, Japan, South Korea, France, Germany, Italy, and the Netherlands, issued a coordinated alert warning that real-time AI deepfake video is now defeating the interview stage of hiring specifically, the stage most companies still treat as a reliable way to confirm who they are talking to.
Unit 42, the threat research division at Palo Alto Networks, documented the mechanism behind that warning. A single operator can interview for the same position multiple times, appearing as a different person each time, by swapping deepfake personas between sessions. Researchers with no prior experience built a convincing real-time deepfake in about an hour using consumer hardware and freely available tools. The interview looked, sounded, and behaved like a normal conversation with a real candidate, because from the interviewer's side, it was one.
What Happens When Nobody Checks Who Picks Up the Laptop
Two separate federal cases show what happens at the handoff furthest from the interview: the point where a company actually hands over access.
In one, a woman was sentenced this year to more than eight years in prison for helping North Korean IT workers obtain remote positions at more than three hundred U.S. companies using stolen identities. She ran what investigators called a laptop farm out of her own home, receiving and hosting company-issued laptops so employers would believe the work was happening inside the United States. More than ninety laptops were seized from her house. Forty-nine more had already been shipped overseas, several to a city on the North Korean border.
In a second, more recent case, two New Jersey men were sentenced this year to nine and eight years respectively in prison for running a similar operation that placed North Korean operatives at more than one hundred U.S. companies.
In both cases, someone did the interview. Someone accepted the offer. And then the equipment and access issued on day one went to a completely different person, sitting in an unverified house, with no check in between to catch the substitution.
The scale of this scam is not a handful of incidents. Nisos research tracked a single 22-person cell that submitted more than 166,000 job applications over ten months, securing over 21,000 interviews and 76 actual job offers. Interviews, at scale, is not a stage that filters this fraud out on its own.
What Does a Background Check Actually Verify?
A background check confirms that a record exists and matches a stated history. It was never designed to confirm that the person who submitted the application is the same person who sat for the interview, or that the person who accepted the offer is the same person collecting a badge and a laptop on day one. Each of those is a separate question, and most hiring processes only ever ask the background check's question.
