The Risk From a Fake Candidate Starts After the Offer

On 13 October the US Department of Justice announced charges against 14 people over an alleged scheme that put North Korean IT workers into remote jobs at more than 70 US companies. According to the indictment, the workers used stolen or fabricated identities. Helpers in the US kept the company laptops at home and installed remote-access software on them, so the person each employer thought it had hired was not the person at the keyboard. In a separate operation announced the same day, the FBI searched more than 40 suspected "laptop farms" in Texas and seized about 187 laptops and KVM devices.

Most companies will never meet a state-run scheme. Candidate fraud on a smaller scale is far more common. In September Checkr, a background check company, surveyed 3,000 US hiring managers. 40% said they had personally interviewed a candidate who later turned out to be using a fake identity, up from 31% a year earlier. 67% had confirmed or strongly suspected that someone else was standing in for a candidate in an interview. Only 23% were extremely confident their own process would catch a fraudulent candidate. It is a self-reported survey run by a company that sells identity checks, so read it as what managers believe they saw.

Many of the engineers we place are people we have worked with before. When a client's stack needs someone new, we search outside, so we see the smaller versions of this before our clients do. On one such search this autumn we looked closely at 105 candidates. For 32 of them, nearly one in three, their own trail contradicted their CV in a way we could show. Others looked wrong without proof, and we left them out of that count. Three suspicions fell apart once the candidate explained, and two of those people went forward in the process.

The FBI published a public service announcement on the same day. It says these workers "cannot be identified reliably with a single indicator", because what they do overlaps heavily with legitimate remote work. Its advice is what it calls identity in depth: layered detections, access controls and continuous identity verification throughout employment, so that signals that are weak on their own add up to a reason for a closer look.

A strong interview shows that a capable person was on the call that day. Whether the same person is writing your code three months later is a separate question, and someone has to check it.

In the Checkr survey, 63% of companies focus their fraud prevention before the hire, and only 6% put the most weight after it. 44% have no formal written process for verifying identity once someone has started.

For a product company of 20 people, most of the exposure comes later. A new engineer usually gets the repository and the staging environment in the first week, and often production data soon after, because that is how a small team works. The interview decided who gets that access, and in many teams nothing after it checks that the decision still holds.

We now see these regularly.

CVs rewritten around the exact stack in the job post, some with hidden text telling AI screening tools to call the candidate a 100% fit.

Career agents who write the CV, apply in the candidate's name, answer the screening questions and take a share of the first salary. By the time you speak to the engineer, much of what you have read about them came from someone else, and nobody has checked it.

Profiles and code histories put together after the fact to support a CV.

Work histories that the listed employer does not recognize.

In August we wrote about the four signals that told us a written stage had been faked, and why written work stopped being evidence on its own. The newer signals we use we are keeping to ourselves. The people we screen read blogs too, and a public checklist is the first thing a career agent would train against.

Give access in stages. In the first week, a new engineer needs the repository and a staging environment. Production data, customer records and secrets can wait until their first real work has been reviewed.

Read the work closely. The first weeks of pull requests tell you more about who is doing the work than any call. A senior who reads them carefully will notice when the code does not match the conversation. In many teams that reading already waits for one senior, and coding agents have made that queue longer.

Check identity more than once. The person on your final interview should be the person at the first standup and on a video call a month later. The FBI lists continuous identity verification throughout employment as part of identity in depth.

Watch the devices you issue. The FBI lists remote desktop tools such as AnyDesk and TeamViewer, and KVM-over-IP hardware, among the things to look for on company laptops. If you hand out laptops, your device management should flag them.

Keep it calibrated. The same announcement warns that aggressive controls carry an unusually high risk of false positives, which could harm legitimate employees and filter out qualified applicants. What matters is whether anyone has checked the person who has access, and that applies to an engineer in your office as much as to one working from home.

Everything in this section is general information drawn from the FBI announcement. It is no substitute for legal or security advice. Rules on monitoring company devices and on re-checking identity after hiring differ by country and by US state. In Germany and the Netherlands, for example, a works council, where a company has one, usually has a say in how company devices are monitored. Check any change with your counsel.

Whether that is your own recruiter, a platform or a company like ours, put these to them.

Who checked that this person is who they say they are, and at which stages?

Is the person I interview the person who will do the work?

Can the engineer hand the work to someone else, and how would you know?

Who reads this engineer's code in the first month?

Ask us the same questions. We check every engineer before their CV reaches you. You interview the engineer yourself before anything is signed, and that is the engineer who starts on your team. Our contracts, with the engineer and with you, do not allow anyone else to be brought onto the work without written approval. In your first month with us, our CTO reads our engineer's code every week.

We place vetted mid and senior engineers inside product teams, working on your codebase and inside your review process. 70,000+ hours of work, clients in 6 countries, 50+ specialists.

The engagement runs month to month with the rate fixed for the length of the contract, and if the fit is wrong in the first 7 days we replace the engineer at no cost.

We work mainly in Ruby on Rails, React, Next.js, JavaScript, Java, Golang, iOS, Flutter, Python and Rust, and we also place engineers who build AI features into products.

Talk to us about an engineer for your team