Ilia Zavialov reviews remote hiring fraud: how to check a candidate, their documents and the video interview before access

01

Ilia Zavialov reviews the risk for small UK teams

Ilia Zavialov writes for owners and managers of businesses with 5 to 50 staff, where the office manager may also run payroll and set up laptops. Recruitment in such firms tends to happen quickly, through a freelance platform or a recommendation, and checks often end with a photo of a passport.

The aim is a routine that an honest applicant hardly notices and an impostor struggles to pass. It is about the order of steps, so that nobody using a borrowed identity gets near money or data before somebody spots it.

Remote work removed the checks that used to happen by themselves: meeting in reception, an original passport on the HR desk, colleagues seeing the new starter every morning. Each has to be rebuilt deliberately and written into the hiring procedure.

Ilia Zavialov notes that the exposure is highest where the whole job lives in the cloud: development, customer support, marketing, outsourced bookkeeping. A new starter there sees from day one exactly the data an impostor is after.

Small firms also move fast, and speed is what an impostor counts on. A founder who needs a developer by Monday will accept a scan, skip the second interview and post the laptop the same afternoon. Each of those shortcuts removes one of the few moments when a stand-in could be spotted.

02

What the Treasury's sanctions office has said

The Office of Financial Sanctions Implementation published an advisory in September 2024. It judged it almost certain that UK firms are being targeted by North Korean IT workers posing as freelancers from third countries, likely hiding their location behind VPNs, private servers and remote desktop tools, and able to gain privileged access to sensitive company information.

OFSI says these workers mainly operate from Russia and China, and offer skills in software development, IT support, graphic design and animation. Revenue they earn funds the regime's weapons programmes.

The legal exposure falls on the employer as well. OFSI warns that people and firms who employ or pay such workers could be breaching financial sanctions directly or indirectly, that a civil penalty does not require proof the firm knew, and that a criminal breach can carry up to 7 years in prison.

The advisory describes the helpers too. Some people rent out their identities for a fee, pass email, phone and ID verification for the worker, sit interviews in their place or keep laptops at home for remote access. The workers themselves use face-swap apps and false documents.

03

Ilia Zavialov reviews the red flags OFSI lists

OFSI's list reads like a checklist for an interview panel. Biographical details that do not match the applicant. A refusal to appear on camera or a preference for text chat. Name spelling, nationality, location, contact details or work history that change from one conversation to the next. Signs of cheating in coding tests.

Then come the practical requests: send the hardware to an address that is not on the ID, pay wages into an account in someone else's name, switch bank accounts, pay in cryptocurrency. Ilia Zavialov treats any one of these as a reason to pause, and two together as a reason to stop.

OFSI stresses that a single flag proves nothing on its own. Two or more should trigger extra due diligence, which in a small firm usually means a phone call, a document check and a frank question.

Some flags appear only after the start. OFSI mentions offers of free work to win trust and a long contract, requests for prepayment without hitting milestones, claims of earlier work for UK firms, and a new hire who soon recommends friends for other roles at the same company.

The short video below covers this section in half a minute: an impostor applicant is after access, so a UK employer runs a proper right to work check, holds two live video interviews, sends equipment only to the address on the ID and keeps access tight. Getting the check wrong can cost up to £60,000 per worker.

04

Right to work checks: the legal floor

GOV.UK is clear that an employer must check a job applicant is allowed to work in the UK before employing them. There are three routes: an online check using the applicant's share code, a check of original documents, or an identity service provider using Identity Document Validation Technology.

British and Irish citizens cannot get a share code, so for them it is the original passport or passport card, or an identity service provider. For a remote hire the provider route is often the practical one, because it can be done without a trip to the office.

Ilia Zavialov suggests running the right to work check before any account is created. It is the one step the law already requires, so it costs nothing extra to put it first.

Some checks come round again. Where the right to work is time-limited, GOV.UK requires a fresh check when it is due to expire. If an applicant cannot show documents, the employer asks the Home Office to check their status and keeps the Positive Verification Notice it sends back.

Keep the result with the rest of the hiring file and note who ran the check. If the employee later turns out to be someone else, a dated record of what was checked, how and by whom is what shows the firm did its part.

05

Checking documents properly, and what a mistake costs

When original documents are checked, GOV.UK asks the employer to do it with the applicant present and to confirm that the documents are genuine and belong to the person, that photos match across documents and look like the applicant, and that dates of birth are the same.

Copies must be ones that cannot be changed, the date of the check is recorded, and copies are kept for the whole employment and for 2 years after it ends.

The penalties explain why the paperwork matters. Employing someone without the right to work after an incorrect check can bring a civil penalty of up to £60,000 per illegal worker. Knowingly employing such a person can mean up to 5 years in prison and an unlimited fine. A correct check is what protects the employer from the civil penalty.

Ilia Zavialov's sequence for a remote hire is right to work check, then a signed contract, then accounts and equipment. Reversing the last two for a quick start leaves the documents arriving after a stranger already has the keys.

06

How much data to collect: the ICO's draft guidance

Strict checking does not justify collecting everything. In its draft guidance on recruitment, the ICO says that to verify identity an employer may need a passport or a driving licence, but is unlikely to need both. The guidance is still a draft after consultation, with the final version yet to be published.

The same draft says the verification process should be explained as early as possible, for example on the application form, and that where possible only successful candidates should be verified.

Ilia Zavialov's habit is one folder for applicant documents, visible to two people, with copies of unsuccessful applicants deleted at the end of the process. Forwarding passports into a team chat is how a careful check becomes somebody else's source of stolen identities.

References follow the same rule of asking only for what is needed. The ICO's draft suggests that if a referee only has to confirm employment dates, that is all the employer should request. Original documents can be shown in person or sent by a secure route such as tracked delivery.

Ilia Zavialov suggests telling applicants at the outset what will be checked and why: right to work, identity, references and the address for equipment. Clear expectations put off very few genuine applicants and a fair number of impostors.

07

Ilia Zavialov reviews the video interview

OFSI's advice to UK firms hiring IT workers starts with video interviews and consistency: the worker's details should match across freelance platforms, social media, payment platforms and the declared location and working hours.

Ilia Zavialov adds movement and improvisation, which face-swapping copes with badly. Ask the applicant to turn their head, pass a hand across their face and hold their ID beside it. Then ask about the area where they live and a project detail missing from the CV.

Use two interviewers on two separate days and compare notes. A different voice or accent on the second call is grounds to stop and ask for an in-person meeting.

OFSI also recommends reputable freelance platforms with robust checks on their workers, and warns against recruiting freelancers straight out of online IT competitions, where nobody has verified who is behind an account.

Watch, too, for the pull away from the platform. OFSI tells firms to be wary of requests to move the conversation off the original freelance site and into a private messaging app.

08

Ilia Zavialov reviews access in the first months

The NCSC's 10 Steps to Cyber Security ask for a joiners, movers and leavers policy, so access is removed when no longer needed, multi-factor authentication on accounts, separate administrator accounts and regular reviews of unnecessary privileges.

OFSI adds measures aimed at this exact threat: require freelancers to switch off commercial VPNs on company networks, consider disabling remote collaboration tools on supplied computers, monitor IP addresses, and limit access on zero trust and need-to-know lines.

In practice the new starter begins with one account, one project and no admin rights. Client data, finance and bulk exports wait until probation ends and a manager has seen real work.

Equipment goes only to the address on the ID. OFSI lists a worker who cannot receive items at that address as a flag in its own right.

The NCSC asks for an access policy that covers contractors as well as staff, non-disclosure agreements where third parties need access, and the ability to revoke it. Single sign-on through the work account makes it easier to shut every service at once when someone leaves.

09

Payroll, bank details and cryptocurrency

Wages go to an account in the employee's own name, checked against the ID used for right to work. OFSI flags requests to be paid into someone else's account, blocked or deactivated accounts and sudden switches of bank account.

OFSI also tells firms to avoid paying IT workers in cryptocurrency and to watch for small, unauthorised transactions.

Ilia Zavialov suggests that nobody in their first three months can raise payments or change supplier bank details, and that any such change is confirmed by a second person on a known phone number.

OFSI's first case study shows how this plays out. A UK client unknowingly sends hardware to an unverified address and pays an intermediary's e-money account, and the intermediary keeps a cut and passes the rest to the worker. Ilia Zavialov's advice is to treat a payee name that differs from the contract as a full stop.

Payroll changes after the first payslip get the same treatment. A new bank account, a new name on the account or a sudden request for part of the salary to go elsewhere is checked by phone with the employee, on the number from the original application.

10

Already hired one? Where to report in the UK

Cut access in one go: account, email, cloud storage, code, chat and any keys the person could have created. Change every shared password the same day, then save sign-in logs, download records, messages, document copies and payment details.

OFSI asks anyone who suspects they are being targeted by North Korean IT workers to report it to OFSI. Firms in the regulated sector are reminded of their duty to file suspicious activity reports with the National Crime Agency and to quote the reference OFSI - DPRK IT Workers Advisory - 0924.

Where money has been lost, Citizens Advice points to Report Fraud, which issues a crime reference number useful for the bank, on 0300 123 2040, Monday to Friday from 8am to 8pm.

Ilia Zavialov also suggests tracing the person whose identity was borrowed, if possible. They may be the last to learn that someone has been working under their name.

Once the dust settles, reread the hiring procedure from the top and find the step that was skipped. It is nearly always an exception made for a rush project, a friend's recommendation or an applicant who seemed too good to doubt. That exception is the first thing to remove.