While the conventional wisdom for network security focuses on external threats, a more insidious form of infiltration is on the rise: fake remote workers. These actors exploit the hiring process, gaining what appears to be legitimate access, only to serve malicious ends. In July, the **US Department of State** issued an alert warning of **North Korean IT workers** impersonating foreign nationals to secure remote employment. Once hired, these individuals funnel their salaries back to their state-sponsored agencies. The **FBI** has echoed these warnings, cautioning that such fraudulent workers may leverage their access to exfiltrate proprietary information, including source code repositories, and support broader cybercriminal activities. In some cases, after being discovered or dismissed, these individuals have attempted to extort former employers by threatening to publish stolen data. These operations expose a fundamental flaw in current security protocols: the disconnect between verifying an identity and confirming who is actually using an account. A credible resume and a laptop delivered to a domestic address do not, on their own, prove that the person interviewed is the person receiving the device, nor the ultimate user. The core challenge for IT security and service desk agents is to definitively confirm that the individual requesting access is both a real person and a legitimate new hire. ## How Fake Remote Workers Defeat Recruiting Controls Fake remote workers employ a range of tactics to circumvent standard recruitment and security measures: * **Changing Nationality or Identity:** A primary tactic, especially among **North Korean IT workers**, involves falsifying information during online platform registration. This can include forging identification documents, impersonating others, or using proxies to create accounts. * **Creating Fake Profiles with AI:** To bolster their fabricated identities, these actors often create professional profiles and social media accounts, leveraging AI to mimic the tone and language of genuine IT professionals. * **Unorthodox Payment Methods:** They frequently attempt to avoid direct deposits, preferring money transfers or cryptocurrency. **North Korean** operatives, for example, have been observed using third parties for salary deposits, paying the facilitator for the use of their account. * **Disguising Location:** VPNs and remote desktop software are commonly used to mask the actual geographical location of the worker. * **Using Overseas Facilitators:** Some fake workers utilize proxies for device delivery and operation. Employer-issued computers are shipped to an address in the claimed country, where a facilitator keeps them powered on and connected, enabling remote control by the overseas worker. ## Why Employment Checks Don't Prove Laptop User Identity Traditional background checks, right-to-work verifications, and identity screening are designed to confirm the credibility of candidate-supplied details. However, fake remote-worker operations exploit the gaps between these verification stages. An organization might confirm an identity exists, that the named person is eligible to work, and that equipment was delivered to an approved address. Yet, credentials can still be issued to an account ultimately controlled by someone else. The tactics employed by these operations are specifically crafted to satisfy individual security controls: * Stolen or proxy-supplied documents satisfy identity requests. * Fabricated resumes pass initial recruiter reviews. * Skilled proxies or the workers themselves successfully navigate interview panels. * Facilitator addresses meet equipment delivery requirements. * "Laptop farms" satisfy location and device expectations. * Third-party accounts facilitate the payroll process. ## Warning Signs of a Fake Remote Worker While no single indicator is definitive, the **US Department of State** highlights several warning signs that may suggest an applicant is part of a fake worker operation: * Frequent changes to registered information. * A mismatch between the account holder's name and the name on the registered payment account. * Multiple accounts created using the same ID. * Multiple accounts accessed from the same IP address, or a single account accessed from multiple IP addresses in a short period. * Unusually high hours logged in. ## Securing the Onboarding Process Against Fake Hires To mitigate the risk posed by fake remote workers, organizations must implement robust vetting processes, especially for freelance and remote hires. Solutions like **Specops Secure Onboarding** address this by integrating government-issued identity-document scanning and biometric liveness detection into the onboarding workflow. This process involves a document check to confirm the authenticity of the identity document and a biometric check that compares the person completing onboarding with the photograph on that document. Liveness detection further verifies that a real person is physically present, distinguishing them from a photograph, recording, or deepfake. Even a stolen but valid identity document or a presented face that appears to match an image can be bypassed without these combined measures. Document validation and biometric liveness work in tandem to provide a significantly stronger level of assurance. **Specops Secure Onboarding** supports over 16,000 document types, making it applicable across diverse remote and international hiring scenarios.  ## Turn Identity Proofing into an Access Control The central takeaway from fake remote worker operations is that identity verification should not be a one-time HR record. Organizations need to continuously confirm that the approved identity belongs to the live person receiving access, and they require a reliable method to repeat this check when access is recovered or altered. By combining government-issued document validation with biometric liveness at the initial onboarding stage, and then mandating identity confirmation before service desk agents act, **Specops Secure Onboarding** establishes trusted identity-proofing checkpoints at the most vulnerable moments. Contact **Specops Software** today to explore how their solutions can fortify your service desk against increasingly sophisticated identity attacks.