ApplySift

North Korean IT worker schemes: what the FBI tells employers to check

Since 2022 the FBI, the State Department and the Treasury have warned that North Korea places IT workers in remote jobs at US companies under stolen or borrowed identities, and sends the pay home. The warnings have kept coming: public service announcements in January and July 2025, and another on October 13, 2026. Most of the hiring advice in them is not specific to North Korea at all. It is good remote-hiring practice that also catches proxy interviewers and fake applicants of every kind. This guide sums up what the government sources say, sorted by hiring stage, with links to each one at the end.

How the scheme works

The worker applies for a remote role, usually in software or IT, as someone else: a stolen US identity, or a real person paid to lend theirs. A US-based helper, the FBI calls them facilitators, receives the company laptop at home and keeps it online so the worker can control it remotely from abroad. Homes holding many such laptops are what the Justice Department calls "laptop farms."

The cases show the scale. In July 2025 an Arizona woman was sentenced to 102 months in prison for running one: the scheme got workers jobs at 309 US companies, used 68 stolen US identities and brought in more than $17 million. In June 2025 the Justice Department announced coordinated actions that included searches of 29 known or suspected laptop farms in 16 states and the seizure of 29 financial accounts and 21 websites. The FBI's October 2026 announcement says the workers are relying more on facilitators, including people recruited through job-board postings and freelance gigs to interview on someone else's behalf or to host laptops.

What the FBI says to watch for

In the applications

The FBI's January 2025 announcement says the workers "have reused phone numbers (particularly voice-over-IP numbers) and email addresses" on multiple résumés that claim to belong to different applicants. Its advice is to "cross-check HR systems for other applicants with the same resume content and/or contact information," and to check résumés for typos and unusual wording. The July 2025 announcement adds: cross-check the photos and contact details applicants give against their social media, portfolio sites and payment accounts, and verify prior employers and schools directly with them, not through the contacts on the résumé.

In the interviews

The FBI reported back in 2022 that applicants were using deepfakes in remote interviews, with lip movements that did not match the audio. In January 2025 it said the workers "have been observed using artificial intelligence and face-swapping technology" in video interviews. The July 2025 recommendations are practical:

At the offer and onboarding

No single red flag proves anything

The October 2026 announcement is blunt about this: the workers "cannot be identified reliably with a single indicator," and "aggressive controls" risk "false positives." The FBI recommends layered checks across the whole employment lifecycle, which it calls "identity in depth." It also warns that relying on "ban lists" or filtering out names associated with the workers "can be unreliable" and can block qualified applicants, as well as harming the people whose identities were stolen. A VOIP number, a typo or a refusal to turn the camera on is a reason to look more closely, not a finding.

What not to do

None of the government's red flags concerns where a candidate is from or how they look or sound, and screening on any of those is illegal. Under Title VII, the EEOC defines national origin discrimination as treating applicants differently because they are from a particular country or part of the world, because of ethnicity or accent, or because they appear to be of a certain ethnic background. Rejecting applicants because their name, accent or appearance seems Korean, Asian or foreign is exactly that, and it would catch none of these workers, who apply as someone else.

If you think you have hired one

Report it to your local FBI field office and file a complaint at ic3.gov. The FBI asks for whatever identifiers you have: names, the address any laptop was shipped to, phone numbers, email addresses, bank and payment accounts, IP addresses, social media and professional profiles, and screenshots or documents. Keep those records rather than deleting the account first, and bring in counsel early. The 2022 joint advisory says hiring or paying these workers can carry legal consequences, including sanctions designation under US and UN authorities, so this is not only an HR question.

Where ApplySift fits

ApplySift covers one item on the FBI's list, across a whole posting at once: reused contact details and VOIP numbers. Upload the CSV your ATS exports and every row is checked for a phone number from a VOIP wholesaler block or an unassigned one, phones and mailboxes shared with other rows (Gmail dots and plus tags removed), and the email shapes in the email red flags guide. Each row gets a tier with the reasons in words. It does not compare résumé content, look at devices or IP addresses, verify identities, or say anything about who is behind an application. It never rejects or contacts anyone. It tells you which applications to verify first; the checks above, and the applicant verification guide, do the rest.

Sources