Fake candidates, real access

Most security advice assumes the attacker is outside, trying to get in. A fake job candidate skips that step. If they get hired, your company ships them a laptop, gives them accounts and pays them every month.

This is no longer a hypothetical. U.S. authorities have spent more than four years warning about applicants who use stolen identities and, increasingly, AI to get through remote interviews. The good news is that the defenses are practical, and most of them belong to hiring teams and managers rather than security specialists.

What the FBI and DOJ have found

In June 2022, the FBI's Internet Crime Complaint Center published a public service announcement about a rise in complaints involving deepfakes and stolen personal information used to apply for remote jobs. The roles were mostly in IT, programming, databases and software, some with access to customer data, financial data or company databases. Interviewers reported lip movements that didn't fully match the audio, and coughs or sneezes that didn't line up with what was on screen. Some background checks revealed that the applicant's details belonged to someone else.

A separate and larger problem is North Korean remote IT workers. In January 2025, the FBI warned that these workers had used AI and face-swapping tools during video interviews to hide their identities. It also said some had started stealing source code and holding company data for ransom after being discovered.

The scale is significant. In June 2025, the Justice Department announced coordinated actions including searches of 29 known or suspected "laptop farms" across 16 states. According to court documents, North Korean workers using stolen and fake identities had obtained jobs at more than 100 U.S. companies. In one scheme, they accessed export-controlled data at a California defense contractor. Laptop farms are homes where U.S.-based helpers keep company-issued laptops plugged in so overseas workers can log in remotely and appear to be in the U.S.

In July 2025, Arizona resident Christina Chapman was sentenced to 102 months in prison for running one such operation. The Record reported that the scheme placed workers at 309 companies and generated about $17 million for the North Korean government. Prosecutions have continued into 2026: in May, the Justice Department described two new sentences as the seventh and eighth of U.S.-based laptop farmers in five months.

How one security company hired one

The best-documented first-hand account comes from KnowBe4, a security awareness training company. In July 2024, founder Stu Sjouwerman wrote on the company blog that it had hired a principal software engineer who turned out to be a North Korean fake IT worker.

The candidate passed four video interviews, a background check and reference checks. The identity was real but stolen, so the background check came back clean, and the application photo was an AI-enhanced stock image. When the company's Mac arrived, the new hire started loading malware. KnowBe4's endpoint detection flagged it the same evening, July 15, 2024, and the security team contained the device within about 25 minutes. The company says no data was accessed or lost, and it shared its findings with Mandiant and the FBI.

KnowBe4's decision to publish shows what good security culture looks like. Instead of hiding a near miss, it explained what slipped through so others could learn. Its post lists warning signs such as a laptop shipping address that doesn't match the candidate's location, VoIP-only phone numbers, a thin online footprint and inconsistent personal details.

Checks for interviews

Spotting a deepfake by eye is unreliable, and the FBI's 2022 signals may not hold as the tools improve. Focus on checks that don't depend on spotting a glitch:

• Keep cameras on for every live interview, and ask at least one interviewer to watch for audio that doesn't match lip movement or reactions.

• Ask candidates to talk through real work they claim to have done, with follow-up questions about specific decisions. KnowBe4 recommends this kind of conversation.

• Ask natural "soft" questions about where the candidate lives and studied. The FBI suggests these because fake workers often struggle with them.

• Compare the person across rounds. If the voice, face, accent or skill level shifts between interviews, pause the process and ask why.

• Check whether the resume text, phone number or email shows up on other applications in your system. The FBI flags reused VoIP numbers and identical resumes as indicators.

• Call references on numbers you find independently, and don't rely on email-only references.

Checks for offer and onboarding

Many of the strongest signals appear after the offer, when money and equipment start moving.

1. Verify identity again at onboarding with an official document check, ideally in person or through a trusted identity-verification process.

2. Ship equipment only to the address on the candidate's verified identity documents. Treat a late request to send the laptop somewhere else as a red flag.

3. Watch for unexplained changes to bank details or payment platforms during onboarding, a warning sign the FBI names.

4. Grant the minimum access the role needs for the first weeks and expand it as trust builds.

5. Block unapproved remote-access tools on company devices, and ask your IT team to alert on new remote desktop software or logins from unexpected countries.

6. If you use staffing agencies, ask how they verify identity and check that they actually do it.

7. Agree in advance who HR or a manager should call if something feels off, and make sure that call never feels like an accusation.

Keep your tone fair. Most candidates with a thin online presence, an accent or a foreign degree are exactly who they say they are. The goal is consistent verification for everyone, not suspicion of anyone who seems different.

If you think you hired one

Act calmly and quickly. Involve your security team before confronting the person, restrict their access and preserve logs from their devices and accounts. The FBI asks companies to report suspected cases to IC3 as quickly as possible. Afterward, do what KnowBe4 did: review the hiring steps that missed it and share what you learned, without blaming the recruiter or manager who made the hire.

Sources

• FBI Internet Crime Complaint Center, "Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions," June 28, 2022: IC3 PSA I-062822-PSA

• FBI Internet Crime Complaint Center, "North Korean IT Workers Conducting Data Extortion," Jan. 23, 2025: IC3 PSA I-012325-PSA

• U.S. Department of Justice, "Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers' Illicit Revenue Generation Schemes," June 30, 2025: DOJ press release

• The Record, "Arizona woman sentenced to 8.5 years for running North Korean laptop farm," July 24, 2025: The Record report

• U.S. Department of Justice, "Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Schemes to Generate Revenue for the Democratic People's Republic of Korea," May 6, 2026: DOJ press release

• KnowBe4, "How a North Korean Fake IT Worker Tried to Infiltrate Us," July 23, 2024: KnowBe4 blog post

Or let NimBot handle it

Hiring teams catch more when they know what to look for. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.