Background screening expert reveals seven checks employers should make as North Korean operatives increasingly target remote U.S. jobs.

The friendly software developer interviewing from his spare bedroom in Plano might not be in Plano. He might not even be the person whose name appears on the résumé.

For Texas employers hiring remote IT workers, that is no longer a far-fetched cybersecurity scenario. A recent Fortune investigation revealed a sharp rise in job applications displaying patterns associated with North Korean remote-worker schemes. Among applications for U.S.-based remote IT roles, the proportion carrying these risk signals rose from 11% in the third quarter of 2024 to 44% a year later. The latest estimate puts the figure at 47%.

The data shows just how widespread the characteristics and inconsistencies associated with these schemes have become.

Matthew J. Rodgers, founder and president of employment background screening company iprospectcheck, says that distinction matters.

“Employers shouldn’t read a figure like 47% and suddenly start assuming every remote developer is suspicious,” says Rodgers. “What it tells us is that the warning signs linked to identity fraud are appearing far more frequently, so businesses need to get much better at verifying who is actually on the other side of the screen.”

The FBI has also sounded the alarm. In a July 31 alert, it warned that North Korea continues to use skilled IT workers operating under false identities to gain remote employment and generate money for the regime. The schemes can involve stolen identities, fake professional profiles, false websites, proxy computers and third-party conspirators based inside the United States. Earlier FBI guidance has also warned that artificial intelligence, voice masking, and face-swapping technology have been used during video interviews to disguise applicants’ true identities.

“The days when a video call automatically gave you confidence that somebody was who they claimed to be are gone,” says Rodgers. “Technology has made remote hiring easier for legitimate applicants, but it has also made sophisticated impersonation much easier.”

And getting through the hiring process can be only the beginning.

In one federal case, four North Korean nationals were charged with using false or stolen identities to obtain remote IT jobs before allegedly stealing and laundering nearly a million dollars in cryptocurrency from two companies.

Rodgers says the lesson isn't that Texas employers should start profiling candidates based on apparent identifiers. Quite the opposite.

“The biggest mistake would be turning this into a hunt for a particular type of applicant,” he says. “A name, accent or hometown isn't evidence of potential fraud. Instead, hiring managers and recruiters should look for objective inconsistencies. Facts that don’t match; can’t be independently verified, or suddenly shift during the hiring process.”

The company's research also found that 29.3% of survey respondents say they have hired somebody who later appeared not to be the same person they originally interviewed.

Rodgers offers Texas employers 7 practical checks they can make before allowing a remote employee anywhere near sensitive company systems:

1. Make sure the person matches the identity multiple times

An uploaded passport or driver's license alone does not establish that the applicant is its rightful owner. Instead, employers should verify whether identifying information, such as photographs, addresses, and other details, consistently matches the person going through the interview and onboarding process.

“You’re not just verifying a document,” says Rodgers. “You’re verifying that the document belongs to the human being you are hiring at several stages of onboarding. Biometric identity verifications should be completed during the background screening process, on the first day of employment, and a short time thereafter.”

2. Verify employment history independently

Previous jobs and qualifications should be confirmed through independently established sources wherever possible, rather than relying solely on the contact details for each past employer supplied by the candidate.

“If a candidate provides you a phone number for a former employer and that’s the only resource you use to complete a verification, the value of that verification is very low,” says Rodgers.

3. Look for inconsistencies

Employers should compare résumés, LinkedIn or other professional profiles, application information and answers given during well-documented interviews.

Small differences are normal. Multiple unexplained discrepancies may hide bigger challenges.

“A typo isn't a red flag,” says Rodgers. “But if dates of employment, past employers, locations lived and worked and verification contact information keeps changing or doesn’t line up, that's when it becomes wise to slow the process down to ask clarifying questions and dig deeper.”

4. Be cautious when the laptop suddenly needs to go somewhere else

An unexpected request to send company equipment to an address that is different from the employee's stated location should trigger additional verification.

The FBI has specifically warned about U.S.-based “laptop farms,” where computers are kept physically inside America while being remotely accessed by workers overseas.

“If a candidate says they're working from home in a state where you are hiring, but the laptop suddenly needs to be shipped to a different address, that's worth a deeper investigation. Appealing to the recruiter or HR, fraudulent candidates have claimed that they will be at a family member's house due to a medical emergency. ” says Rodgers. “HR, being sympathetic, ships the laptop to the new address. Which turned out to be a laptop farm running dozens of laptops from several different companies.”

5. Pay attention to last-minute payroll changes

Unexpected changes to bank accounts, payment platforms, addresses, or other financial information after hiring can also justify further checks, particularly when they appear alongside other inconsistencies.

“One change by itself may have a perfectly innocent explanation,” says Rodgers. “What employers should be alert to is a pattern of inconsistencies.”

6. Don't stop verifying when the interview ends

Identity checks shouldn't end the moment a candidate accepts an offer, the employment background check is ordered and the form I-9 is completed.

The person interviewed, the person completing onboarding and the person ultimately accessing company systems should remain consistent throughout the process.

“Companies often put enormous effort into screening before the offer and then relax immediately afterwards,” says Rodgers. “But onboarding is exactly where you want to make sure the same person is still standing in front of you.”

7. Limit access until checks are complete

A newly hired developer should not necessarily gain immediate access to every system, database, or repository.

Employers should wait and allow the background check to be completed before granting sensitive permissions, and then follow least-privilege principles once access is provided.

“You should never have a situation where doubts about somebody's identity emerge after they've already been given the keys to the most sensitive systems,” says Rodgers.

Remote work has transformed the hiring market, giving companies access to talent almost anywhere in the country, and often anywhere in the world.

But Rodgers says that same flexibility has changed one of the most basic assumptions behind traditional background screening.

“You can run the most thorough criminal, employment and education checks in the world,” he says. “But if the person you screened isn't actually the person you hired, the information gained in the background report may be useless. Checking identity using biometric identity verification multiple times tailored to the role and risk of each position in my recommendation, ” said Rodgers.

For Texas employers, the question before the next remote hire may therefore be surprisingly simple.

Have I taken the necessary precautions to know who I am actually hiring?