TLDR
- The FBI says North Korean IT workers now pay Americans to do tasks that include sitting job interviews, completing urinalysis tests, and submitting fingerprints for them.
- They also test stolen identities against employment background checks before they apply, so a clean result proves the data is real (and nothing more.)
- There is no single check that catches these bad actors. The FBI recommends "identity in depth," and the place to start is the offer stage. Verify the person before credentials issue or a laptop ships, then get IT, HR, and security watching for warning signs together.
How North Korean IT workers use paid stand-ins
In an October 13 alert, the FBI says North Korean IT workers are now paying Americans to sit job interviews for them.
The list of paid services goes further. Americans appear on camera for the workers, verify fraudulent identities, share personal social media and professional networking accounts, ship packages, and keep company laptops online from home. Some complete urinalysis tests and submit fingerprints on the fraudulent workers' behalf.
Now read that list as a hiring process. A candidate appears on camera, interviews, verifies an identity, takes a urinalysis test, and submits fingerprints. Someone is being paid to do each of those for a fraudulent worker overseas.
The people standing in for these workers aren't all in the United States. The FBI says the fraudulent workers also pay freelancers in South Asia and West Africa to apply for jobs and to take interviews on their behalf.
On October 13, the Justice Department also charged 14 people and made two arrests. Agents searched more than 40 suspected laptop farms in Texas and seized about 187 devices. A laptop farm is one of the homes on the FBI's list. Someone keeps company-issued laptops online there, and a worker overseas logs in as if they were local.
The scheme reached more than 70 US employers, in sectors that include manufacturing. TechCrunch covered the announcement that day.
Can a background check catch a North Korean IT worker?
Most of the names and addresses these workers give employers come from legit, albeit stolen, identities. Before they use one to apply, the FBI says, they often buy accounts or licenses from identity verification providers and use them to confirm the data will pass employment background checks.
So the background check comes back clean, and it should. The data is real. It just belongs to someone else.
KnowBe4 saw it happen in 2024. The company held four video interviews, a background check, and reference checks before it hired a North Korean operative. Everything came back clear, according to its own incident report.
Why is onboarding the last chance to verify a new hire's identity?
Once the checks pass, onboarding takes over. The new hire gets a login, a laptop, and a payroll account. Several steps in between, including the identity check, the urinalysis test, and the fingerprints, are the ones the FBI says now have paid stand-ins.
KnowBe4 shipped its new hire a Mac, and the device was flagged on July 15 for loading malware, according to CyberScoop. Onboarding is built to get a new hire working quickly, and it treats the hiring decision as settled. That makes it the last chance to confirm the person before credentials and a laptop go out.
How the scheme has adapted since 2024
In 2025, prosecutors said one scheme stole 68 US identities and defrauded 309 US businesses, including an aerospace manufacturer and an American car maker. Then employers got better at spotting it, and the workers changed tactics.
The Justice Department says the workers now turn to American facilitators to get around those improvements. Facilitators host laptops and take on other tasks for the workers. The FBI describes dozens of North Korean teams hiring Americans and others for a wider range of tasks, and some handing entire jobs to freelancers abroad.
The scheme has also turned threatening. The FBI reports that some workers extort victims, and some have threatened former managers with violence after being fired.
Law enforcement and industry are pushing back. CrowdStrike, which tracks the group behind the Texas laptop farms as Famous Chollima, helped the FBI disrupt it. On October 23, Australia sanctioned two North Korean individuals and companies over the scheme, three months after the US and its allies warned that the workers were using AI to hide their identities.
What the FBI's “identity in depth” approach means for hiring
The FBI suggests employers defend against a scheme that keeps adapting with “identity in depth.” It borrows from defense in depth, the security practice of stacking protections so one failure doesn't open the door. Applied to people, it means no single check decides who gets in. Verification, access controls, and monitoring run for as long as someone works for you.
In hiring, that means asking who is behind the identity at each stage.
- Application. Verify the person behind the identity, not just the record.
- Interview. Confirm that the person on screen is the person who applied.
- Offer. Confirm the person again before credentials, a laptop, or payroll details go out.
- Onboarding. Confirm that the person who starts is the person you hired, before credentials issue and devices are enrolled.
- After that. Confirm the person again at the helpdesk and before sensitive access.
The FBI names live verification among the controls that raise friction for these workers.
Warning signs after the hire
No single sign gives these workers away. The FBI says many of their behaviors look like ordinary remote work, so what matters is when several show up together.
- Remote desktop software, such as AnyDesk or TeamViewer, connecting to a work device.
- KVM-over-IP hardware, such as TinyPilot or PiKVM, which lets someone control a laptop from far away.
- Applications on a work device that have nothing to do with the job.
- Bank accounts, street addresses, or social media accounts that change at an unusually high rate.
The FBI also warns against shortcuts. Ban lists and name filters are unreliable. They block qualified applicants, including people whose identities were stolen. Controls set too aggressively flag legitimate employees too, so the FBI recommends careful calibration and a real review before anyone acts.
What can teams do right now?
The workers will keep adapting. They have since 2024, and every new check will meet a new workaround. One question holds up against all of them. Is the person in front of you the person behind the identity?
Three steps put that question to work right now.
- Add live verification at the offer stage and again during onboarding, before credentials issue or a laptop ships.
- Bring IT, HR, security, and hiring managers together to review remote access and device activity on recent remote hires, because each team sees signals the others miss.
- Report suspected activity to your local FBI field office and file a complaint at ic3.gov.
The FBI's July 2025 guidance for HR professionals is a good place to start building your checklist.
A record can be bought and tested in advance. A person has to show up and be confirmed.
