Ilia Zavialov reviews remote hiring fraud: how to check a candidate, their documents and the video interview before access

01

Ilia Zavialov reviews remote hiring fraud: who this is for

Ilia Zavialov writes for owners and managers of companies with 5 to 50 people, where there is no security team and the person who hires, the person who pays and the person who sets up laptops may be the same person. Hiring in those firms moves fast, often through a job board or a friend's referral, and identity checking can stop at a scan of a driver's license.

The goal here is modest. Nobody needs to treat every applicant as a suspect. The aim is a hiring routine where a stranger using someone else's name cannot reach money or data before anyone notices, while an honest candidate barely feels the extra steps.

Remote work removed checks that used to happen on their own: a handshake in the lobby, an original document on the HR desk, coworkers who see the new person every day. Each of those has to be put back on purpose, as a written step.

Ilia Zavialov looks at hiring the way he looks at any other handover of keys. The wider the access a new person gets in the first month, the tighter the check before day one and the longer the period with reduced rights. A two-page procedure that everyone follows beats a long policy nobody reads.

02

How a fake candidate gets hired

The FBI's Internet Crime Complaint Center warned back in June 2022 about a rise in complaints involving deepfakes and stolen personal data used to apply for remote jobs in IT, programming, databases and software. Some of those roles came with access to customer data, financial data and corporate databases.

The same alert said pre-employment background checks had found that personal data supplied by some applicants belonged to other people. The résumé, the name and the Social Security number can all be real, just not the applicant's.

By May 2024 the FBI was describing a support network inside the United States: people who receive company laptops at their homes, set up remote access to them, ship them overseas, open financial accounts and job-board profiles, sit in on video interviews for the real worker and create front businesses that look like small staffing firms.

Ilia Zavialov reads the pattern as an access play. The paycheck is welcome, but the prize sits inside the company: code, client lists, credentials and anything that can be copied out.

The October 2026 alert describes how the helpers are found. These workers post fake openings on well-known job boards, often framed as easy freelance gigs such as sitting an interview for someone or keeping laptops at home, and they deliberately look for people under financial stress.

03

What the FBI and the Justice Department have found

On June 30, 2025, the Justice Department announced coordinated actions that included searches of 29 known or suspected laptop farms across 16 states and the seizure of 29 financial accounts, 21 fraudulent websites and about 200 computers.

According to the court documents described in that release, North Korean workers using stolen and fake identities got jobs at more than 100 US companies. One indictment alleged the identities of more than 80 US persons were used, and victim companies lost at least $3 million.

On October 13, 2026, the FBI updated its guidance again. It estimates North Korea's government receives 85-90% of the revenue these workers generate and says they cannot be identified reliably by any single indicator. The FBI's answer is what it calls identity in depth: layered checks, access controls and identity verification that continues for the whole time a person is employed.

The short video below sums this up in half a minute: a fake candidate is after access, so the company verifies identity through Form I-9 and E-Verify, holds two live video calls, ships the laptop only to the address on the documents and keeps access minimal. The FBI estimates North Korea takes 85-90% of what these workers earn.

04

Ilia Zavialov reviews the video interview

The 2022 IC3 alert described interviews where the on-camera person's lip movements did not fully match the audio, and coughs or sneezes did not line up with the picture. In January 2025 the FBI added that North Korean IT workers had used AI and face-swapping during video interviews.

Ilia Zavialov suggests interview requests that a face-swap handles badly: turn your head to the side, pass a hand in front of your face, hold your ID next to your face. Then ask about the neighborhood where the candidate lives and a work detail that is not on the résumé.

The FBI's own tips point the same way. Use soft questions about location and education, listen for background noise that sounds like a room full of people doing similar work, and complete as much of hiring and onboarding as possible in person.

Two interviewers on two different days help too. If the voice, accent or manner changes between calls, pause the hire and ask for an in-person meeting before an offer goes out.

Check the professional profile as well as the person. The FBI says these workers claim ownership of social media and professional networking accounts that belong to others. A simple test is to ask the candidate to send you a message from that profile during the call.

05

Form I-9, E-Verify and remote document checks

Remote hiring changes how Form I-9 documents get examined, and the rules here are specific. USCIS allows remote examination only for employers enrolled in E-Verify and in good standing. The employee sends copies of the documents, front and back, then shows the same documents during a live video call, and the employer keeps clear copies.

The FBI's October 2026 alert says that E-Verify, requiring a US passport, several forms of ID or live verification all raise friction for these workers. It also warns that relying only on ban lists or filtering out names linked to past cases is unreliable and can hurt real identity-theft victims.

Ilia Zavialov's advice is to treat the live video step as a real identity check. The person on the call should match the photo, hold the physical document and answer a follow-up question without looking away to someone off screen.

The FBI's 2024 tips also put weight on people: train HR staff, hiring managers and development teams on this threat, require staffing firms to run strict hiring and audit it regularly, and flag any change of address or payment platform during onboarding.

Order matters as much as content. Ilia Zavialov's sequence is identity check, then the signed offer, then accounts. Swap the last two for a faster start and the check turns into paperwork that arrives after the stranger is already inside.

06

Ilia Zavialov reviews the paper trail: résumé, phone and references

In January 2025 the FBI advised cross-checking HR systems for other applicants with the same résumé content or contact details, because the same voice-over-IP numbers and email addresses had turned up on résumés supposedly belonging to different people. It also suggested checking résumés for typos and unusual wording.

Call the phone number on the résumé at an agreed time. If that number never answers and the candidate always replies from a messaging app on another account, write it down.

References are checked through the company itself. Ilia Zavialov recommends taking the employer's main number from its official website, asking for HR and confirming only dates and job title. A number the candidate supplied proves only that the candidate has a friend.

A résumé that lists a long career while the email account and phone number behind it look brand new deserves a direct question. Real people change numbers all the time, so the aim is simply to ask and to listen to how the answer comes.

Ask staffing firms how they verify the people they send you. The FBI has said companies that outsource IT work can be more exposed because they are removed from the direct hiring process.

07

The laptop, the shipping address and remote access

The FBI's May 2024 alert advised watching for address changes after hiring but before a laptop is delivered. A request to send the device to a friend, a different city or a reshipping address is the point to stop and call the candidate on the number from the résumé.

The October 2026 alert lists what happens next when the scheme works: remote desktop software on the work laptop, keyboard-video-mouse devices plugged into it, apps unrelated to the job, and frequent changes of bank accounts, street addresses and online accounts.

Ilia Zavialov suggests recording the laptop's serial number and checking which device actually logs in to company systems. A company laptop that stays online around the clock while the user signs in from somewhere else rarely has an innocent explanation.

Sessions deserve the same care as devices. The FBI warned in January 2025 that these workers could harvest company credentials and session cookies to start work sessions from non-company devices, so limiting sign-in to managed laptops closes a quiet back door.

08

Ilia Zavialov reviews first-month access for a new hire

A new hire gets what the first task needs and nothing more: a personal account without admin rights, multi-factor sign-in, one project and one chat channel. The FBI recommends least privilege, disabling local administrator accounts and limiting who can install remote desktop tools.

Logs matter in the first weeks. The FBI notes these workers often sign in to one account several times in a short period from IP addresses tied to different countries, and copy company code to personal repositories and cloud accounts.

Payments wait. Ilia Zavialov suggests that nobody in their first three months can create payments, change vendor bank details or approve transfers, and that any change to bank details is confirmed by a second person by phone.

Extra rights go through a ticket that a second person signs off. Six months later the company can see who opened the customer database to whom and why, and temporary access does not quietly become permanent.

The FBI's latest alert adds a caution worth taking seriously: controls that are too aggressive produce false alarms that hurt honest employees and drive off good applicants. Its fix is to have IT, HR, security and management compare notes, since each sees a different part of the picture.

09

Extortion, threats and stolen code

In January 2025 the FBI reported that North Korean IT workers, once discovered, had held stolen code and data hostage until companies paid, and in some cases published the code. The October 2026 alert goes further: after being fired, some made death threats against former managers and their families to collect more money.

Ilia Zavialov's practical takeaway is to plan the exit before the hire. Know which systems the new person can reach, how fast all of it can be switched off, and who in the company talks to law enforcement if a demand arrives.

The FBI also says almost all of these workers record their screens as part of their daily routine, which means data leaves the company even when nothing is copied on purpose.

Money is the other target. In one case described by the Justice Department in June 2025, workers hired under stolen and fake identities were given access to their employers' virtual currency and took about $175,000 and about $740,000. Ilia Zavialov's rule is that no new hire touches wallets, keys or payment rights during probation.

10

Already hired one? Ilia Zavialov's order of steps

Cut access in one move: account, email, cloud storage, code repositories, chat and any service where the person could have created their own keys. Change every shared password they saw the same day.

Preserve evidence before it disappears: sign-in logs, lists of downloaded files, messages, document copies, phone numbers and payment details. The FBI recommends reviewing network activity from the suspected employee and their assigned device.

Report it to your local FBI field office and file a complaint at ic3.gov. The FBI asks for the address that received the work device, names, accounts, phone numbers, emails, bank accounts, IP addresses, screenshots and anything about facilitators.

Then think about the person whose identity was used. The FBI tells anyone who receives a W-4 or 1099-NEC for a job they never held to contact the business and the FBI, and suggests a Self Lock through E-Verify.gov.