North Korean IT workers: a checklist for staffing agencies

North Korean IT workers get remote tech jobs at US companies using stolen or fake identities, with help from people in the US who receive company laptops, keep them running in "laptop farms," and let the workers log in from overseas. The FBI says contract IT work "is a common way that North Korean IT workers procure employment," which puts staffing agencies that place remote developers directly in the path. The checklist below turns the FBI's and Justice Department's published guidance into steps an agency can run from sourcing through the first months of a placement.

This article is general information, not legal advice. The scheme involves sanctions and identity fraud, so if you think you have placed one of these workers, talk to your own counsel and report it to the FBI.

How big is the North Korean IT worker scheme?

The Justice Department's 30 June 2025 announcement gives a sense of scale. It describes searches of 29 known or suspected laptop farms across 16 states and the seizure of 29 financial accounts and 21 fraudulent websites. In one case, the defendants "compromised the identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies, including many Fortune 500 companies." Victim companies incurred legal fees, network remediation costs and other losses of at least $3 million, and the scheme generated more than $5 million in revenue.

The same release describes workers who "gained access to, and in some cases stole, sensitive employer information such as export controlled U.S. military technology and virtual currency." The FBI's January 2025 advisory adds data extortion: after being discovered, some workers held "stolen proprietary data and code hostage until the companies meet ransom demands."

How does the scheme work?

Pieced together from the FBI's July 2025 advisory, its January 2025 advisory and the DOJ release, a typical scheme runs like this.

1. The worker applies under a stolen or fake identity. The DOJ describes "false identification documents containing a mix of stolen and fraudulent identity information."
2. US-based facilitators create accounts on job search sites, set up financial accounts, and create "U.S.-based front businesses, including businesses purporting to offer short-term technical contract workers."
3. Facilitators may attend "virtual interviews and meetings on behalf of North Korean IT workers." The FBI has also seen workers use "artificial intelligence and face-swapping technology during video job interviews."
4. The company ships a laptop to a US address. A facilitator receives it and either reships it overseas or keeps it in a laptop farm.
5. Facilitators enable "remote desktop connections to U.S. company laptops," and in the DOJ case used hardware "keyboard-video-mouse" (KVM) switches to give overseas workers remote access.
6. Salaries go to accounts the facilitators control, and much of the money is moved overseas.
7. Some workers copy code repositories, steal data or virtual currency, or extort the company after they are discovered.

Why are staffing agencies exposed?

Agencies sit exactly where the FBI says the gaps are. The July 2025 advisory says "companies that outsource IT work to third-party vendors can face additional vulnerabilities since these companies are removed from the direct hiring process." The January 2025 advisory tells employers to check that third-party staffing firms have sound hiring practices and "routinely audit those practices."

In practice, your clients are relying on your screen as their identity check. If you place a contractor on a remote engagement, the client may never see the person on video again until something goes wrong. And the FBI notes that facilitators have set up front businesses that pose as contract staffing providers themselves, so be careful with subcontracted talent too.

What are the red flags?

A note on fairness. The FBI's January 2025 advisory says these workers "often claim to have attended non-US educational institutions." Lots of honest candidates studied outside the US, and many US-based engineers have accents or were born abroad. None of that is a red flag. Rejecting someone because of where they are from, their ethnicity or their accent is national origin discrimination as the EEOC defines it. The flags above are about identity details that don't match, and they apply the same way to every candidate.

A checklist for staffing agencies placing remote IT contractors

Run this for every remote technical placement, not just the ones that feel suspicious. Applying it to everyone is fairer, and it doesn't depend on a hunch.

Sourcing and intake

• Search your ATS for duplicate resume text, phone numbers and emails before you reach out.
• Cross-reference photos and contact details with the candidate's professional profiles, portfolio and any public code history.
• Be cautious with talent supplied by subcontractors you haven't vetted. Ask how they verify identity.

Screening interview

• Require video with an unobscured background.
• Run a quick live identity check: government ID next to the face, a head turn, and the hand wave the FBI suggests because it "may prompt a malfunction in AI generated video." See deepfake job candidates for the full set.
• Ask "soft" questions about their location and education, as the FBI recommends, and compare the answers with the ID and resume.
• Ask detailed follow-ups on their own past projects. A stand-in or a coached candidate struggles to go three questions deep.
• Keep a record of the person you screened (with notice to the candidate) so you can compare later. Our proxy interview guide covers what to look for.

Offer and onboarding

• Verify prior employment and education directly with the employer or school, as the FBI recommends.
• Complete your normal employment eligibility process. Identity and work authorization checks are separate steps.
• Do at least one step in person or with a trusted in-person verification service for sensitive roles, if you can.
• Do not grant system access until the background check is complete, as the FBI advises.

Equipment and access

• Ship laptops only to the address on the contractor's ID. If they ask for another address, require documentation.
• Ask the client to restrict installation of remote desktop tools, which the FBI's January 2025 advisory recommends.

Payment

• Compare payment details across all contractors and flag matching bank information or shared documents.
• Watch for frequent bank changes and decline requests to be paid in virtual currency.

During the placement

• Check in by video periodically and compare against the images from screening.
• Agree with the client on who watches for unusual logins or remote connections, and how they will tell you.

What should you do if you suspect a placed contractor?

The FBI asks businesses to report suspected activity to IC3, their local FBI field office, or 1-800-CALL-FBI. Its January 2025 advisory also recommends evaluating network activity from the suspected worker's devices. For an agency, that means telling the client quickly, preserving your screening records, pausing payments where your contract allows it, and taking legal advice on your obligations.

Where Simplehire fits in the screen

Simplehire runs AI voice screening interviews that recruiters send before submitting a candidate to a client. One limit first: the Simplehire Enterprise screen does not verify work authorization or visa status, so keep your existing eligibility process.

What it adds to the screening step: you can set the ID check to Required, so the candidate must pass a government ID check and a live face match before the interview begins. You can require a paired second device, where the candidate's own phone gives a side-camera view of them, their laptop and the desk. On supported Windows interviews, Simplehire Proctor has candidates close risky applications such as remote-desktop tools and re-check before the interview starts, and it records high-severity findings in the background. Its checks cover supported system facts and do not capture screen content, keystrokes, files, URLs or audio. We don't claim it detects hardware devices such as the KVM switches in the DOJ case.

Every tier also records full-screen exits, tab switches and copy and paste attempts, with timestamps, recorded audio and screenshots for each alert. A person reviews every finding, and the recruiter makes the decision.

The Advanced tier ($5 per screen, about 30 minutes) suits senior or client-critical technical roles and includes an optional coding round. Adaptive is $3 and Basic is $2, with 25 free Basic screens every month. See proctoring details or pricing. For the wider numbers on candidate fraud, see our candidate fraud statistics.