Guide
North Korean IT Worker Hiring Fraud: How the Scheme Works and How to Screen for It
9 minute read - Updated: November 2026
Since at least 2018, North Korean operatives have taken remote IT jobs at Western companies under stolen or fabricated identities, with salaries routed back to the regime; UN investigators have put the proceeds at $250 million to $600 million a year. The scheme is not exotic: it is candidate fraud at industrial scale, run through the same proxy interviews, deepfakes and day-one substitutions that this guide series covers, plus one piece of physical infrastructure, the laptop farm.
How the scheme works, step by step
- A stolen or synthetic US identity, often with a real person's name and SSN.
- A polished resume and profile, sometimes hundreds applied in parallel (a 2026 WSJ documentary followed one cell that applied to more than 1,000 companies in about three months).
- A remote interview passed by the operative or a proxy, sometimes with a deepfaked face.
- An offer and a company laptop shipped to a US address.
- A "laptop farm", a US resident paid to keep the machines powered and connected while the operative works through remote-access software from abroad.
- Payroll to a US bank account that forwards the money.
Read next: Proxy Interviews and Interview Impersonation - Deepfake Job Interviews
The cases that made it public
- In 2024 the security-training company KnowBe4 disclosed that it had hired a North Korean operative who began loading malware once the company laptop was delivered, and published the account as a warning to other employers.
- In July 2025 Christina Chapman, an Arizona woman, was sentenced to 102 months for running a laptop farm that served operatives placed at 309 US companies, with about $17.1 million in wages involved, according to the US Department of Justice.
- In September 2025 Okta's threat intelligence team reported more than 130 identities linked to over 6,500 interviews across a single cluster of operatives.
What changed in 2025 and 2026
The interview-question tricks that circulated in early 2025 (ask about Kim Jong Un, ask them to name a local restaurant) are known to the operatives and no longer work. Recruiters and suppliers, not the hiring company, are now the weak point, because the company often never interviews the worker. The detection has moved off camera: to the device the worker uses and to the address the laptop ships to. Enforcement has increased, with laptop-farm prosecutions and device seizures in 2025 and 2026, but prosecutions follow the fraud by years.
Read next: Staffing and contingent workforce
Screening that holds up
- Require a government ID shown on camera and matched to the person, at the final interview and again at onboarding.
- Ship equipment only to the address on the I-9 and treat a request to redirect it as a stop.
- Confirm the person on day one is the person who interviewed (identity continuity).
- Run the interview and the first day of work with device-level monitoring that flags remote-access sessions, a second operator and VPN or location mismatches.
- Hold suppliers and recruiters to the same identity standard in the contract, with audit rights.
- Brief hiring managers on what a flag looks like and who to call.
Read next: How to Spot a Fake Job Candidate
Where ScreenComply fits
The agent on the candidate's device during the interview and the first day captures the remote-desktop session the laptop-farm model depends on, flags a second operator and a virtual camera, and ties the person at the interview to the person who logs in. Flags are evidence for your security team, not an automatic rejection, which matters when a legitimate candidate happens to work from abroad.
Read next: Candidate fraud detection - Remote access detection
Frequently asked questions
How do I know if my company has been targeted?
Signs are a remote hire whose equipment went to a third-party address, a worker who is never available on camera, access from unexpected locations, and work quality that does not match the interview.
Does this only affect tech companies?
No. The Chapman case covered 309 companies across industries, and staffing and contingent programs are a common entry point.
What should we do if we find one?
Preserve logs, cut access, involve security and legal, report to the FBI, and check every other hire that came through the same supplier.
Is the risk only lost salary?
No. The operative holds system access, and Gartner's Jamie Kohn has said candidate fraud creates cybersecurity risks that can be far more serious than a bad hire.
See a session, a detection, and a report
A short walkthrough of a live exam, a flagged moment, and the finding your integrity office would receive.