North Korean IT Workers Now Pay Others to Pass Your Interviews
The FBI's 13 October 2026 alert says North Korean IT workers rely more on facilitators. Here's what changed and what small US hiring teams should do.
On 13 October 2026, the FBI issued a new public service announcement on North Korean IT workers: North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment. It is the latest in a series of warnings, and it changes the picture for small companies. The scheme now relies more on U.S.-based helpers and outside freelancers, which makes fake candidates harder to spot with a single check.
This guide explains what the FBI said, what changed, the red flags at each hiring stage, and a practical checklist for small hiring teams that don't have a security department.
In this guide
- What the FBI said on 13 October 2026
- What changed in the North Korean IT worker scheme
- Why small companies should pay attention
- Red flags at each hiring stage
- An "identity in depth" checklist for small teams
- What not to do
- How to report a suspected case
- FAQs
What the FBI said on 13 October 2026
The alert (number I-101326-PSA) says North Korea has "thousands" of remote IT workers organized in "dozens" of teams, and that the North Korean government receives an estimated 85–90% of the revenue they generate. The FBI also says these workers "cannot be identified reliably with a single indicator," so employers need to combine several signals.
What changed in the North Korean IT worker scheme
The alert describes three shifts.
1. More reliance on facilitators. People in the U.S. and elsewhere host company laptops at home ("laptop farms"), now spread across more locations with fewer devices at each. Facilitators also lend social media or professional accounts with long histories, take interviews or attend meetings on someone's behalf, and handle identity checks, packages, drug tests or fingerprinting.
2. Subcontracting. Some North Korean IT workers hire freelancers to do the actual job for a fraction of the salary, or to mass-apply and interview for roles. The FBI says these freelancers are typically based in Pakistan, India, Nigeria or neighboring countries.
3. Broader targets. Recruitment now extends to roles that need U.S. security clearances, cleared defense contractors and specialized technical skills. Workers also claim ownership of real tech professionals' online accounts they have no connection to. The FBI reports threats and extortion against former managers in some cases.
Why small companies should pay attention
This is not only an enterprise problem. Identity-verification startup Endorsed found that applications to U.S. remote IT roles showing North Korean IT worker patterns rose from 11% in Q3 2024 to 44% a year later, with an estimated 47% in the most recent quarter (Fortune, 1 September 2026). That figure covers remote IT roles, not all job applications.
Other employers are seeing the effects. In a July 2026 survey of 1,500 U.S. managers and owners by background-screening firm iprospectcheck, 22.9% said they may have unknowingly interviewed a proxy or deepfake candidate, and 29.3% said they had hired someone who later didn't seem to match the person they interviewed (report summary).
Small teams are exposed because they hire remotely, move fast and rarely have IT, HR and security in the same room.
Red flags at each hiring stage
No single item below proves fraud. The FBI's advice is to look for several together.
| Stage | Red flag | What to do |
|---|---|---|
| Application | A professional profile with a long history that doesn't match the person you speak to | Ask about specific past work and check it against the profile |
| Interviews | The person on camera changes between rounds, or the camera fails during key questions | Record rounds and compare; ask questions that build on earlier answers |
| Offer and paperwork | Forged or questionable verification documents | Use live verification and more than one form of ID |
| Equipment | A request to ship the laptop to a different address | Ship only to a verified address |
| First weeks | Remote desktop tools, KVM-over-IP hardware or unrelated recording software on the work device | Have IT check devices for remote-access tools |
| Payroll | Frequent changes to bank account, address or other identifiers | Flag repeated changes for review |
For how stand-ins get through the interview stages, see Proxy Interview: 5 Gaps Where Stand-Ins Slip Through.
An "identity in depth" checklist for small teams
The FBI recommends an "identity in depth" approach: layered checks across the whole employment lifecycle, not one check at the start. For a small team, that can look like this:
- Record every interview round so you can compare the person, voice and level of detail across stages.
- Ask continuity questions that build on what the candidate said in an earlier round.
- Add one live technical round with someone who knows the role, before the offer.
- Verify identity live before the offer, using stronger methods the FBI names, such as E-Verify, passport requirements, multiple forms of ID or live verification.
- Ship equipment only to a verified address.
- Hold a day-one video check, or ask new remote hires to attend in person on day one.
- Have IT check new devices for remote desktop and KVM tools in the first weeks.
- Flag repeated bank or address changes in the first months of employment.
- Share signals across HR, IT and management. The FBI says these teams should coordinate.
- Keep notes and report suspected cases to the FBI.
What not to do
The FBI warns employers not to rely only on ban lists or name filtering. These are unreliable, can exclude qualified applicants and can harm the real victims of identity theft. Judge behavior and evidence, not a candidate's name or nationality, and apply the same checks to every applicant for the same role.
How to report a suspected case
The FBI asks employers to contact their local FBI field office and file a complaint at ic3.gov. Include any real street address linked to the activity, identifiers such as names, emails, phone numbers, bank accounts and IP addresses, any images, messages or documents, and details about facilitators. If someone faces a threat to life, call 911.
Where CloudInterview fits
CloudInterview is not an identity-verification service, but it covers the interview stages where many stand-ins get through. AI Interviews keep scores, transcripts and recordings for every candidate, which gives you a baseline to compare later rounds against. Interview Outsourcing adds a recorded, rubric-based live round with a matched specialist, so a real expert questions the candidate before you make an offer.
AI for scale. Human experts for judgment.
Close the gaps before the offer
The FBI's message is clear: one check is not enough. Record each round, connect the stages, verify identity live and keep checking after day one.
Book a demo to see how CloudInterview records every interview round and adds a live expert stage before you hire. AI-powered hiring. Humanly.
