You have a fake North Korean IT worker problem – here's how to stop it

By now, the North Korean fake IT worker problem is so ubiquitous that if you think you don't have any phony resumes or imposters in your interview queue, you're asleep at the wheel. "Almost every CISO of a Fortune 500 company that I've spoken to — I'll just characterize as dozens that I've spoken to — have admitted that they …

[The Man Who Fell To Earth]

How fat is Kim Jong Un essay question.

Just extend Adam Meyers (CrowdStrike) suggestion to requiring a one-page essay with each application requiring a discussion of just how fat Kim Jong Un is. I'd add a followup and require another one-page essay on how Kim Jong Un had his half-brother, Kim Jong-nam, assassinated at the Kuala Lumpur International Airport in Malaysia on February 13, 2017.

No doubt the lazy HR folks can have an AI generate other "weed 'em out" essay questions to require all candidates to answer that will weed out North Koreans. Non North Korean workers might be a bit harder.

[elsergiovolador]

Re: How fat is Kim Jong Un essay question.

The “Kim Jong Un is fat” essay - because nothing filters out state-sponsored operatives like a Year 7 edgelord writing prompt.

Let’s be serious: anyone trusted by a regime to infiltrate foreign companies is not some random North Korean off the street. They’ll have full access to banned content, VPNs, fabricated identities, and a working knowledge of what Western hiring managers want to hear. If you asked them to write an essay about how they personally defiled Kim Jong Un’s corpse with a USB stick, they'd do it - in flawless English - if it got them the job. And they’d get it.

[Anonymous Coward]

Re: How fat is Kim Jong Un essay question.

The one interview question that will protect you from North Korean fake workers

https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/

[BartyFartsLast]

Re: How fat is Kim Jong Un essay question.

Trusted or not they'll be monitored up the wazoo to make sure they're not using or falling for decadent western propaganda because nothing distrusts like an authoritarian regime which executes people for the slightest aberration or on the whim of its great god like leader.

Plus, the coincidence between highly trusted, vetted intelligence agents and those capable of coding to the level required is going to be small, especially as the use of IT is heavily restricted.

[SVD_NL]

Re: How fat is Kim Jong Un essay question.

What I've read in previous interviews on this topic, is that they usually aren't taking on the job on their own. There might be one person doing the interviews, and a handful of people doing the actual coding for example. That way they have the best quality and volume of work done, which makes rapid promotions more likely, giving them more access.

[Anonymous Coward]

Re: How fat is Kim Jong Un essay question.

I agree about lazy HR people.

They - and esp recruiters - have long abdicated doing proper recruitment to A.I., automation and CV/resume key word processing that is terrible junking as many good people for minor structure violations.

The HR team should be doing the hard work of identify verification long before anyone is allowed in the organisation.

There is no reason why - at the recruiting companies expense - a face to face cannot be afforded at or after offer stage.

LinkedIn is a recruitment cesspit.

[tmTM]

Re: I agree about lazy HR people.

Sometimes one upvote simply isn't enough

[Anonymous Coward]

Re: How fat is Kim Jong Un essay question.

A place I worked in hired a guy who had 10 years of military service on his CV. HR didn't verify. Turned out he'd been in prison all that time, which only came to light when he was arrested for something unrelated.

[TeeCee]

Re: How fat is Kim Jong Un essay question.

Better still:

Summarise the Korean war in 25 bullet points.

If there isn't at least one bare-faced lie in there, I'd be surprised.

Also, if you are hiring people without a face-to-face interview, you deserve to get shafted. It may be cheaper, but you are likely to get what you paid for.

[MachDiamond]

Re: How fat is Kim Jong Un essay question.

"Summarise the Korean war in 25 bullet points."

There are a lot of people that couldn't complete that. Me, for one. I learned about it in school, but that was ages ago. It's knowledge I've never needed since I passed the test.

[Andrew Scott]

Re: How fat is Kim Jong Un essay question.

single bullet point, got MacArthur fired.

[RegGuy1]

Re: How fat is Kim Jong Un essay question.

Korea had a war? Wow I never knew that. But then again I've only read history books printed in England.

Edit: oh, who won? And who came second?

[Herby]

Re: Korean War...

"oh, who won? And who came second?"

Nobody won, everyone came in second. Something about the United Nations playing a part.

Two years of arguments, and everything was back to where it started.

[Anonymous Coward]

Re: How fat is Kim Jong Un essay question.

"oh, who won? And who came second?"

Technically it's still on, I think.

Oddly even in AU, the Korean War/UN Police Action wasn't really covered at school and I did history/modern history until matriculation.

WW1 & WW2 in great detail but mostly European/Mediterranean theatres.

[phils]

Re: How fat is Kim Jong Un essay question.

Unless it happened in MASH I'm out.

[goblinski]

Re: How fat is Kim Jong Un essay question.

I honestly don't think this will ever work beyond the first time it was tried with the candidate thrown off and needing further instructions.

It's a bit like the urban legend that when you do something illegal in the US and you ask your partner "Do you work for law enforcement ?" they supposedly have an obligation to reveal themselves. They don't.

This might have worked the first time, OR is a good indicator for the fake candidate that their tricks won't do and it's time to cut bait. But it won't for a second stop a determined operative in an elaborate operation.

[MachDiamond]

Re: How fat is Kim Jong Un essay question.

" they supposedly have an obligation to reveal themselves. They don't."

They aren't under oath so lying isn't an offense. If the lie wanders into slander/libel, that changes a bit.

Here's why: https://www.youtube.com/watch?v=9C_So1BM_Ek

You do have to identify yourself.

[Arboreal Astronaut]

Re: How fat is Kim Jong Un essay question.

Questions like these wouldn't do a thing to weed out an actual operative of the North Korean state participating in an intelligence/espionage operation to infiltrate Western IT infrastructure -- if answering these questions the way their interviewers want to hear is a necessary part of the job, they'll just do it.

On the other hand, if there's anybody these questions *would* potentially weed out, it's an ordinary IT worker totally unaffiliated with the North Korean state, but who merely happens to be from North Korea and is simply trying to find a way to make a living, just like an IT worker from any other country on Earth.

Westerners who fail to draw any conceptual distinction between these two categories of people, lumping them equally into the category of "North Koreans", are doing de facto unpaid volunteer propaganda work (extremely effective propaganda at that!) for the North Korean state.

[Henry Wertz 1]

Re: How fat is Kim Jong Un essay question.

Apparently this question DOES weed them out, they terminate the interview. Kim is such a narcissist, i do not think he would permit someone to answer this question even to maintain their cover.

[Arboreal Astronaut]

Re: How fat is Kim Jong Un essay question.

Doesn't this seem a bit like "undercover cops can't lie to you about whether or not they're a cop" logic? How exactly is a state supposed to be able to have any kind of functioning espionage system at all (let alone a super-effective 1984-style authoritarian secret police network) if its own operatives are strictly forbidden from criticizing the regime or its leaders, even when doing so is strictly necessary to establish their cover?

The only logical explanation for why this sort of interview question would weed out applicants from North Korea is if the people being weeded out were are IT workers who happen to be from North Korea and are acting without the approval of the North Korean state, in which case they might very well have reason to be afraid of going on record criticizing their own regime to an untrusted third party -- which would also mean that the North Korean applicants being weeded out are precisely the ones who are *least* likely to pose any kind of actual security/espionage threat.

Even people who can't fathom the idea of poking holes in Western ideological tropes about North Korea, should at least still be able to perceive the constructive criticism of silly and ineffective counterintelligence tactics that only succeed in providing Western institutions with a false sense of security.

[rcxb]

Re: How fat is Kim Jong Un essay question.

an ordinary IT worker totally unaffiliated with the North Korean state, but who merely happens to be from North Korea and is simply trying to find a way to make a living

Ordinary North Korean citizens don't have any internet access. Only a select few have any access.

North Korea is a real communist state (not to be confused with China).

[Yet Another Anonymous coward]

Re: How fat is Kim Jong Un essay question.

>No doubt the lazy HR folks can have an AI generate other "weed 'em out" essay questions

You are int he desert. The tortoise lays on its back, its belly baking in the hot sun, beating its legs trying to turn itself over but it can't. Not without your help. But you're not helping.

It has helped us weed out AI applicants, a pity about Holden, but ....

[MachDiamond]

Re: How fat is Kim Jong Un essay question.

"Non North Korean workers might be a bit harder."

It's not just a North Korea problem although they are a big concern. There was that one guy that "worked" for a bunch of different companies by farming out coding to mostly Indian workers. Not exactly the same problem, but the person the company contracted to do the work wasn't what they got.

I'm self-employed so a remote worker in a sense. I could outsource about half of what I do but then I lose control over that work and my skills to do it atrophy. There are enough instances where I need to make adjustments/corrections that I can't wait 24 hours or so for somebody in SE Asia to get it done for me.

I'm surprised there aren't more employment agencies that specialize in remote recruiting in their own country to vet and check up on workers. Somebody who says they are in Sweden would need to interview in person with the agency and have a company rep there virtually and confer with the local interviewer afterwards. ID can be checked, photos taken and questions asked that would verify the person is who they say they are. The photo can be used to make sure a local person isn't sitting the interviews on a professional basis for others such as people have done for driving tests. I know in the US that it's not hard to do that for a driving test. The examiner on the check ride hands the person the slip that says they've passed and then goes on to the next person needing the test. The actual person seeking a license is then handed the slip and can stand for hours in various queues, get their photo taken, etc since there's a disconnect in the process.

[Andrew Scott]

Re: How fat is Kim Jong Un essay question.

never had to stand in a long line to get my first drivers license or get it renewed, and the final step, smile get photoed and the license printed and sealed in plastic took no time. still warm when i got it. i was told once that they didn't use photos in Alaska just a thumb print. not sure i believe that though.

[Andrew Scott]

Re: How fat is Kim Jong Un essay question.

many could probably answer honestly, "don't know, never met him".

[Anonymous Coward]

north korea knows you are a coward

Once again one of these stories. Is North Korea just a metaphor? Why would every other nationality applying for a job not be doing similar things? Just because they are not spiriting away your generic data its still wrong.

Companies employ less people than they ever did but cant seem to just get a candidate to come in and be evaluated without a load of tech in tow.

Globalization seems to mean employ people you are scared of and dont want to ever meet.

[elsergiovolador]

Re: north korea knows you are a coward

Nailed it. North Korea isn’t a threat - it’s a metaphor. A convenient bogeyman conjured up to scare workers into doing what landlords and investment funds desperately need: get back into office buildings no one wants, just to keep commercial property values from collapsing.

None of the earlier guilt-trips landed. “Watercooler cross-pollination” was a joke. “Human connection” sounded creepy. So now we’re down to: you need to come into the office so we know you’re not a North Korean imposter. Because apparently the risk of a skilled remote developer is now national security - but only if they’re working from home.

The reality? If you're commuting in, you're not doing it for team spirit. You're doing unpaid labour for asset managers clinging to empty towers. Your presence is a human placeholder - a warm body justifying square footage on someone else's balance sheet. You’re not working in an office, you are the justification for the office.

And let’s not pretend they care about fraud. No one panics when some LinkedIn-certified chancer talks their way into a six-figure job with ChatGPT answers and buzzword bingo. But heaven forbid someone with an unfamiliar accent and a generic email address dares to know what they’re doing.

This was never about cybersecurity. It's about economics. You're being forced back into the office not because it’s better for work - but because it’s better for landlords.

[Paul Herber]

Re: north korea knows you are a coward

' ... it’s better for landlords.'

You just want us all working at the pub!

[Gene Cash]

Re: north korea knows you are a coward

Nice straw man.

Nobody said anything about coming in to work. As a matter of fact, one of the companies does its best to support remote workers, but they do require you pick up your laptop in person.

Good try at diverting the subject.

[elsergiovolador]

Re: north korea knows you are a coward

Please. If you think pointing out the obvious trajectory of corporate panic theatre is a misrepresentation, you haven’t been paying attention - or you’re pretending not to.

The article parades laptop pickups, in-person ID checks, and face-to-face screenings not as isolated policies, but as examples of what works. That’s not security - that’s a soft rollout of return-to-office logic without the guts to say it outright. The implication is clear: physical presence = trust. Remote = risk.

If you can’t see how that feeds directly into the push to herd workers back into real estate liabilities, you’re either incredibly naïve or defending the façade.

[doublelayer]

Re: north korea knows you are a coward

If you insist on viewing it that way, do you have a suggestion for how to determine that the person you're hiring is who they say they are? Because I do not care about getting people back into the office. It has no importance to me, and the only part of this where I would get involved or want to is determining whether the person being hired is about to commit a crime. The stories of North Koreans working with fraudulent identification documents, laptop farms, and taking destructive action are real. If you choose to deny them based on your affinity for remote working, you're making a logical leap which takes you in a bad direction. If you're afraid that the people using these as excuses will convince people who want to avoid a real risk to adopt the thing you don't like, maybe it would be useful to suggest an alternative they could use.

The rest of us have suggested various ways of finding this information, and physical presence has often been involved even if it's sending a local trusted person to meet the candidate in person. I'd note that this avoids most of your complaints, since the candidate isn't being asked to go out of their way, even in their own city, nor do they come to an office because there isn't one. Not that that approach is foolproof, though. Still, you don't seem to appreciate that either, so maybe you'd like to tell us what should be done instead. It would be more useful to both of us than continuing to tell us that we're playing into the office lobby's nefarious plot by not wanting to hire fraudsters.

[elsergiovolador]

Re: north korea knows you are a coward

The idea that meeting in person somehow verifies identity crumbles the moment you examine what that meeting actually entails. A quick chat with HR? Five minutes of small talk with the hiring manager? That’s not security - that’s theatre. A well-prepared actor will pass those rituals with ease. Smile, nod, make a joke about the weather - job done.

If the concern is infiltration by a state actor or fraud ring, do you really think they’ll trip over a “hello” at reception? They’ll send someone clean-cut, polite, credentialed, with a rehearsed backstory - and they’ll walk out with the laptop and your misplaced sense of assurance.

And even when it’s not fraud - companies still won’t know who that person is after the meeting, and more importantly, they won’t care. Once the box is ticked, that employee joins the faceless churn: underpaid, unsupported, and discarded the moment finance sneezes. And ironically, that's far easier to exploit. You don’t need to plant a state agent when the workforce is demoralised, underpaid, and invisible. Just befriend someone struggling to pay for a boiler repair or dental work and offer them a few grand to copy some internal files. No need for fake passports or cover stories - just a USB stick and a good excuse.

That’s the real vulnerability: not infiltration by mastermind operatives, but systemic neglect that makes regular employees easier to flip than to fake.

As for solutions: the hiring pipeline is broken by design - bloated with middlemen, driven by cost-cutting, and indifferent to long-term trust. If businesses want security, they need to rebuild the foundation. That means paying people fairly, reducing outsourcing sprawl, treating employees as partners - not liabilities - and investing in hiring processes that create connection, not just compliance.

Because identity fraud doesn’t thrive in high-trust environments. It thrives in systems where no one knows - or values - the person on the other end.

[doublelayer]

Re: north korea knows you are a coward

So, to summarize your answer, don't bother. You remind me of a person I once worked with who decided not to do anything related to security using the argument that a Chinese agent would be able to bypass a more secure password (as proven by the "I say so so it's true" principle), so users didn't need to have a more secure password.

The logical extension of the idea that almost completely solves your objection to its function is doing the interview in person, because then the attacking country can't just send someone, they have to send someone who can pass the interview, which is harder to do. You're talking yourself into the option you hated most. Of course, you're also doing that by incorrectly stating what the attacker would have to do in order to pass the simple ID check, because they can't send just anyone to pick up a laptop, but a person who looks enough like the person who was in the remote interviews with valid-looking enough identification identifying themselves as the person the interviewee claimed to be, which is, counter to your allegations, a little trickier. Not so tricky that they can't do it, but tricky enough that they will find it hard to scale to the level of fraud at which North Korea's IT worker system is operating.

The rest of your comments hitting the "everyone working in IT in particular and anything other than management in general is living at sub-subsistence level" drum is entirely irrelevant to any of this, whether or not it is in any way accurate. If North Korea starts a ransomware operation and uses that tactic, it might matter. So far, the only known ransomware operations by North Korea have used vulnerabilities and network scans, and the IT worker scheme is intended to steal money or useful code or tech. If bribing underpaid employees is so easy, they haven't recognized it yet.

[elsergiovolador]

Re: north korea knows you are a coward

That’s a creative take - but no, I didn’t say “don’t bother.” I said: don’t mistake performative rituals for actual security.

Suggesting that an in-person meeting meaningfully deters a well-resourced adversary because it’s “trickier” ignores how state actors operate - not at scale through brute force, but selectively, with tailored effort. If it’s worth it, they’ll find someone who looks the part, carry forged documents, and match the face on the screen. That’s not science fiction - that’s standard tradecraft. “A little harder” isn’t meaningful friction when the payoff is millions or source code.

And your claim that my point somehow supports in-person interviews? That’s a neat pivot, but no - I’m pointing out that in-person meetings offer the illusion of certainty, not actual verification. Security decisions shouldn’t rest on whether someone seems plausible in a conference room.

Saying “North Korea hasn’t used that tactic” assumes we’d even know if they had. That’s the real delusion.

They might be doing it already - quietly, effectively, and without raising red flags. All this noise about fake résumés could be the decoy, while the real access point is some overlooked, underpaid employee who already has their hands on the data.

If companies actually cared about security, they’d stop pretending it’s a passport issue and admit it’s a priorities issue. But that would mean spending money, taking responsibility, and admitting the real threat isn’t foreign - it’s baked into the business model, engineered through neglect, and protected by the same people cashing bonuses for cutting corners.

[doublelayer]

Re: north korea knows you are a coward

And, although this was the original comment posted in the thread, you have still yet to suggest a single thing you could do. Instead, you point out theoretical problems to the physical meeting idea that, from my perspective, are a lot like my former colleague's unrealistic objections. Yes, if it's worth it, maybe North Korea will train their knowledgeable agent, create a complete, verifiable fake identity, send them to a country where they could be arrested immediately if there's a single mistake, and send them to an in-person interview. You are entirely correct that this is not science fiction. Several people went through that process during the cold war. It was extremely expensive in time, money, and effort from the sending party. That was done when there was an expectation of a major return.

It is not done when there's an expectation of three months of salary from a software engineering position and a chance of a ransom payoff. Doing that, which is what most of the North Korean IT worker scam involves, is not a high enough return to justify the serious costs involved in a piece of spycraft of that size. The article demonstrates the level of investment involved in some of this:

After stringing one suspected scammer along throughout the interview process, Little told the fake IT worker,  "'We're going to do a document verification with you. So the next time we meet, please be ready, it's very simple, we'll send you a bar code, and you can do it from your device.' He never showed up."

And, if they were all like that, then that's all companies would have to do. This, incidentally, is a good argument for one of your other points, that this is mostly the fault of lazy businesses. A lot of the discussion here has considered what can be done to respond to something a little more difficult than that where a simple sentence isn't enough to make the fraudster give up of their own accord, for example when they do want that specific victim a little more. If you hate the idea of a physical meeting to review documents so much, this is your opportunity to tell us something that will work. If you once again don't, I'll conclude that you don't have one. I, and many others here, don't believe that the response to an in-person meeting will be to receive a Jack Barsky at reception, so your objections are not convincing me that that method will be ineffective.

[veti]

Re: north korea knows you are a coward

And passwords can be hacked, and origins can be spoofed, and even real people can be impersonated... We all know that a well resourced attacker can get through almost any feasible (and many nonfeasible) levels of security.

But it gets harder to do. Each check raises the bar a little bit. And for 99.9% of us, that's good enough. At some point, the attacker will simply say "bugger this, I'm off to infiltrate someone easier", and that's what we want. Not to catch them, not to stop them entirely - that's not our job, that's what we have professional national security TLAs for - but simply to prevent them becoming our problem.

North Korea may have Mission: Impossible level teams of infiltrators who can breeze through all of this shit, but I bet it doesn't have many of them, and those it does will be directed at the most valuable targets. That's not my company, so I don't have to worry about them.

[UnknownUnknown]

Re: north korea knows you are a coward

The recruitment pipeline isn’t bloated with middlemen, it’s been broken by A.I.. automation slop and the same job being scraped by multiple job aggregators.

It’s also plagued by scammers collecting personal info on an industrial scale - via faked or scraped job info - potted life history thankyou, correlation to LinkedIn check and in some cases the job seeker is desperate/vulnerable.

See also Indeed/Glassdoor tossing loads of staff as further evidence of this.

https://www.theregister.com/AMP/2025/07/12/indeed_glassdoor_layoffs/

[MachDiamond]

Re: north korea knows you are a coward

The idea that meeting in person somehow verifies identity crumbles the moment you examine what that meeting actually entails. "

That's like bees that will vigorously kill wasps at the hive entrance, but give them a free pass once in. Yes, it can't be rice paper wrapping but must be a serious first line of defense.

A local HR manager (cringe) can do all of the introductory work to bring somebody in, get them outfitted and checked up from time to time and that wouldn't cost a company all that much money. The remote worker would need to report somewhere that's easy to get to on public transport and would be verified along with the laptop/phone/whatever they were issued. If they can't make it to an appointment, they are suspended/locked out as one of the terms in their contract. A mechanism to ping a laptop's location is a good idea. If the worker gets a call to come in and the laptop suddenly is tracked to a FedEx shipping hub, that would be a problem.

[MachDiamond]

Re: north korea knows you are a coward

"Not that that approach is foolproof, though."

The idea is to put up as many roadblocks as needed to make the scammers more likely to trip themselves up. It's still incumbent on the company to keep tabs on their employees and have data systems in place to prevent wholesale looting. Some really good courses on managing remote staff would be a worthwhile investment for companies. Management is a skill and taking people that are already good at it and making them better is a solid line of defense. Much better than having a HR department with not a strand of natural hair color in a large room of people.

[Anonymous Coward]

Re: north korea knows you are a coward

:facepalm:

:headdesk:

[MachDiamond]

Re: north korea knows you are a coward

"But heaven forbid someone with an unfamiliar accent and a generic email address dares to know what they’re doing."

The generic email address is an issue. I'm amazed at how many people think that a free email account at Google, M$ or some other vendor is acceptable in a professional environment. I have several domain names with email addresses to match. I don't have aBcCo (dot) com and BobTheOwner2063@gmail(dot)com as an email address. I see that too often. If you want the job as an IT professional, you should look the part. It's so hard to get anybody on the phone these days that an accent is much less of an issue. I don't trade with people that won't pick up the phone as texting in my business is a massive time waster.

[doublelayer]

Re: north korea knows you are a coward

"Why would every other nationality applying for a job not be doing similar things?"

Fraudsters or criminals can come from any nationality. North Koreans have one unique quality though: the other option of getting a legitimate job and not committing a crime is denied to them because the schemes where they get these jobs are orchestrated by the North Korean government and the people carrying them out are not permitted to leave, and their family members are held as collateral in case they find a way. They are intended to get cash, and if that means that holding a company to ransom is worth more than working normally, that's what they have to do. And it means that, to get the best salaries, they will lie about their experience.

Employers can do more to prevent this from working, although there will always be some level of arms race between people faking identities and those checking them. A lot of companies have decided that hiring people in other countries is just fine, and since the employees are working remotely, they should be able to interview that way too. Meeting in person should make it much harder for scams like this to succeed, but it will also cause some problems for hiring. For example, it's much easier for a candidate to take half a day for a few remote interviews than for them to take two for a long flight, those interviews in person, and a flight back, so requiring in-person interviews will cost some candidates.

[Paul Crawford]

Re: north korea knows you are a coward

For example, it's much easier for a candidate to take half a day for a few remote interviews than for them to take two for a long flight, those interviews in person, and a flight back, so requiring in-person interviews will cost some candidates.

As posted elsewhere, why not send the manager/decision maker to them? Or get known and trusted agency to locally check ID? After all it is only something you would do after they have been selected on a remote interview as the choice to employ, if they turn slippery at that stage you know not to proceed!

[doublelayer]

Re: north korea knows you are a coward

Those methods would be cheaper, although they would be somewhat easier to fake. I mostly agree with you that this should be something that companies can deal with, and I think most or all of my employers would have caught out an attempt without having to change their typical employee checking processes.

In this discussion, however, I respond to the specific suggestions made. If the suggestion is that the candidate is brought to the office for interviews, then I'll consider what that would do, which would have a very different effect than if a candidate is visited by a local agency after being accepted. The former is dramatically more costly than the other, but several posts here are calling for it. Maybe that former approach is better or cheap enough that it doesn't matter, but we'd need to consider each option separately to determine which ones are good enough to get the needed verification and cheap enough that we don't expect a lot of people to try to cut corners.

[Arboreal Astronaut]

Re: north korea knows you are a coward

> the other option of getting a legitimate job and not committing a crime is denied to them because the schemes where they get these jobs are orchestrated by the North Korean government

The *actual* reason why getting a legitimate remote job with a Western IT firm is forbidden to North Koreans is because of US sanctions that forbid the transfer of assets to anybody in North Korea for any reason, including something as innocent as paying the salary of a remote IT worker. These sanctions make no distinction between the regime itself and ordinary civilians; the basic logic of broad-based economic sanctions against a country like North Korea, Iran, or Cuba is to weaken the regime's economic/industrial base and spread popular discontent, which inherently means targeting ordinary civilians right alongside actual agents of the regime.

Do people really not understand that this is how sanctions work?

[simkin]

Re: north korea knows you are a coward

Not sure anyone has ever seen sanctions "work".

[doublelayer]

Re: north korea knows you are a coward

The first sentence is, oddly enough, true. The rest of that is rubbish. North Koreans are not allowed to get a job with another company by their own government, sanctions or no sanctions. The government of the country decides what people are allowed to do. If you show good mathematical skills, you'll be allowed to work on computers. If you show excellent skills on those, you go to their important cyber operations, such as breaking into cryptocurrency firms or phishing security researchers to try to get more vulns. If you're less good, that's when you end up in this fake worker system. If you don't want to, you will be punished. If you still maintain on not doing it, you'll get even worse punishment.

That's why you also don't see North Koreans working privately for companies in countries that don't comply with the rest of the world's sanctions on North Korea. When they do, it's through government-run programs of labor, for example how many North Koreans are shipped to eastern Russia to cut timber, but they're still not allowed to leave (some do successfully run away). They have more modern programs that are very similar, where it operates like a normal outsourcing company except the workers were simply assigned to it and the government keeps the money. If you actually believe what you're saying, you are mistaken. Pretending that the North Korean system works like ours, where you get to refuse a job because you don't like it, is a common tactic of North Korea apologists though, so I have to consider that you knew this already.

[Arboreal Astronaut]

Re: north korea knows you are a coward

The news story where I first heard about this situation described a company hiring a remote developer who claimed to be from Singapore, they did the job, got paid for it, and the company only learned that the developer was actually from North Korea when the FBI approached them long after the work was complete -- the guy being interviewed even made a point of mentioning that the code written by the North Korean developer was still in use in the company's system, even now!

Whether or not it's part of some kind of forced labor program, or an espionage operation using legitimate IT work for cover, I have no idea, but it seems bizarre and nonsensical to describe these people as "fake workers" when by all appearances they're real people doing real work, even if they're lying to those hiring them about their country of residence. (Which, given the nature of Western sanctions, would seem like a perfectly understandable thing to do if one was an aspiring remote IT worker who happened to live in North Korea.) Is North Korea actually the realm of Mordor, and these people aren't really people, they're actually orcs or something?

Even more so than obvious big-picture lies and omissions about things like the history of the Korean War, those are the kinds of little descriptive details that tend to trigger my internal propaganda-BS detector when reading news stories about countries my own government desperately wants me to hate, as if people writing these stories can't just leave well enough alone and describe the situation in plain neutral language without adding that extra little editorialized stretch just for the sake of waving the flag in their readers' faces.

[Anonymous Coward]

Re: north korea knows you are a coward

Red flags were raised as the work was completed to a satisfactory standard. I find the whole thing pretty amusing.

Paranoia about reds under the bed doing things properly lol.

[MachDiamond]

Re: north korea knows you are a coward

" Is North Korea actually the realm of Mordor, and these people aren't really people, they're actually orcs or something?"

Yes. Officially.

There are sanctions in place that would make it illegal for a company to have an employee in N. Korea. That worker isn't collecting the salary, the government is and only conveying to them a small stipend for living expenses and some bonuses. While the work may not have some devious component to it, it does let Lil Kim keep tabs on many companies around the world and what they are up to in close to real time. If I know that SuperMegaCorp is working on the next gen turboencabulator and something about it's control system, that can be a huge bit of insider information. A full set of plans would be nice, but having a few slow and steady moles is the long game.

[Anonymous Coward]

Re: north korea knows you are a coward

The risk of industrial espionage is just one facet of this, by employing North Korean agents, or indeed agents from any sanctioned foreign power in your business you are potentially breaking sanctions and could find your business having to answer some unpleasant questions asked by serious people in suits.

Of course if your business is, like mine, involved in projects which require clearance etc then it gets even worse.

[Anonymous Coward]

Re: north korea knows you are a coward

Spin back 10 years it was savvy software developers personally offshoring their work to India/China.

Soon back 5 years it was savvy tech people working 2 jobs remotely.

[goblinski]

Re: north korea knows you are a coward

Why would every other nationality applying for a job not be doing similar things?

Because they have much better usage for their spies doing real work which can bring orders of magnitude more money and knowledge, AND a population which has other choices (however limited), and can use their technical knowledge to do something else and even have (GASP !!!) the ability to refuse getting into that game.

NK has a cash pipeline problem severe enough to make this worthy for the measly few millions (88 millions in six years is about a million a month, which wouldn't pay the electricity bill for such an op in some countries), and a deep reserve of smart people that can't say no. As well as the monopoly on training.

It's like the difference between having to provide meat via a hunting trip or in a slaughterhouse.

[MachDiamond]

Re: north korea knows you are a coward

"88 millions in six years is about a million a month, which wouldn't pay the electricity bill for such an op in some countries"

That's assuming that the goal is only to bring in hard currency. If the real goal is corporate espionage, if the costs vs. salary is a break-even, that's a win.

A city can "lose" money at the fare box for public transportation, but by having it there can mean more financial activity in a city which brings in more taxes. It also means the city isn't spending as much on widening roads and adding car parks (plus law enforcement) to encourage the same level of trade. Big stores will put items on offer for less than cost to bring people into the store. They'll place that loss-leader towards the back of the store so shoppers have to pass more things they might buy while there that are marked up in compensation. They'll also put things like a microwave on sale and surround its display with accessories to go with it where they make a healthy margin.

[LVPC]

Easier solution

1. Hire local.

2. In person interviews.

3. Stop looking for the unicorn candidate - they don't exist.

And step 0 - fire hr and have the interviews done by the people they're going to work with - they're the ones with the actual expertise on what the job requires.

There's a reason why the average hr droid only lasts 3 years - it takes that long to expose how useless they are.k

[Paul Crawford]

Re: Easier solution

If they are local then in-person is trivial (even if disability access issues mean you have go the them).

If they are not local then presumably you have to have a good reason for choosing them. If $REASON is not significantly more value to the company than the cost to get the selected candidate over for an in-person introduction, etc, then you deserve what you get!

[Andy Non]

Re: Easier solution

If the only suitable candidate was in a distant location or even abroad, I'm sure there are registered solicitors or other suitable registered professionals they could take their ID documents along to for a visual check on the person, and maybe even a supervised Zoom interview could be done with the candidate while at those premises. Granted you'd have to pay the third party something for those services, but much cheaper than employing a Nork.

[LVPC]

Re: Easier solution

>> If the only suitable candidate was in a distant location or even abroad

If your criteria are that strict you're doing it wrong.

I know it goes against what hr droids and too much management believes, but you can always fund people who meet most of the requirements, then train them in what they're missing.

"OMG investing in people? Our of the question! We can't afford it! Once we train them they'll leave for better pay elsewhere! We'd rather hire someone for a number of months then just fire their ads when we're done with them! EMPLOYEES HAVE NO LOYALTY!!!"

Gee, I wonder why that is?

[Paul Hovnanian]

Re: Easier solution

>> If the only suitable candidate was in a distant location or even abroad

>If your criteria are that strict you're doing it wrong.

Well, sort of. If they are that far away and they are "the only suitable candidate" then you already know who they are. In fact, the entire industry probably does as well. And corporate will think nothing of your chartering a jet to go out and talk to them.

[MachDiamond]

Re: Easier solution

"If your criteria are that strict you're doing it wrong."

I expect that the 'criteria' is almost always going to be salary/cost. If the person is noted for their work in a field, the issue of them being a state-sponsored spy is less of a thing. Sure, it could happen, but for that person to get there would be a huge long game or that state is paying them sick amounts of money. I suppose ideology could also be a factor.

[MachDiamond]

Re: Easier solution

"Granted you'd have to pay the third party something for those services, but much cheaper than employing a Nork."

It can also be a function of a small satellite office of a company that needs to maintain a presence for 'reasons' in that country. Some companies will do that to maintain a store of repair parts or consumables to support customers where shipping something could be delayed due to customs (import or cultural).

[The Man Who Fell To Earth]

Re: Easier solution

#0 & #2 are critical. There's no excuse except incompetence for not spending what is, compared to the salary, a trivial sum bringing the person in for an in-person interview, even if that means flying them half way around the planet. If I had a nickel for how many times I've heard "we don't have the budget for that" when hiring for a 6-figure position, I'd be rich. Such an attitude is stupid in the extreme. If I were a business insurance company, I'd write it in the contract that any damage caused by an employee who was not in-person interviewed as part of the hiring process isn't covered.*

*In-person interviews don't need to be at HQ, but they do need to be between the candidate and the hiring manager face-to-face in the same room with the candidate producing appropriate government-issued ID & if needed, visa's, work permits, etc. Who does what travel is irrelevant.

[elsergiovolador]

Re: Easier solution

The grand solution: fly the candidate in - because nothing says 'rigorous hiring' like making someone burn time and money on ID theatre for a job that’ll vanish the moment shareholders demand a higher dividend.

Why is it always the worker who must travel, beg, and prove? If in-person is so vital, send the manager. They’re the ones with the salary, the title, and the decision-making power. Or is this really just about making the candidate perform submission rituals to earn a spot on the corporate balance sheet?

Let’s not pretend this is about due diligence. It’s about theatre. Companies posture like they’re fortresses of excellence, yet can’t offer stability, fair pay, or even human contact after round four of interviews. The “six-figure salary” is a relic - barely enough to rent near the office you’re now being forced to commute to “for culture.”

The truth? Workers are disposable. A commodity, rotated in and out depending on how the quarterly forecast lands. Today’s ‘key hire’ is tomorrow’s redundancy line. And yet somehow, it’s the candidate who must grovel for legitimacy.

If hiring is so high-stakes, prove you're worth working for. Until then, spare us the pomp - you’re not offering a life-changing opportunity. You’re offering a job and most likely, crap.

[Gene Cash]

Re: Easier solution

> Why is it always the worker who must travel, beg, and prove?

Because he's the one that wants the job. If you're not willing to show you're not a fake worker, then we'll interview someone else.

OTOH, it's a two-way street. They have to pay for the flight. If the company wants me to fly in in my dime, fuck 'em.

[elsergiovolador]

Re: Easier solution

“Because he wants the job.” Spoken like someone who still thinks a job is a favour, not a transaction. That mindset belongs in a feudal system, not a global industry pretending to be meritocratic.

The company wants labour, skill, and time - but only the worker is expected to grovel, spend money, and prove they’re real. If someone fakes their way through, that’s a failure of your vetting - not their airfare.

And no, it’s not a “two-way street” when one side sets the terms, controls the money, and reserves the right to walk away at any stage - while the other is expected to jump, spend, and smile just for a shot at being exploited.

So yes - if a company demands unpaid travel just to inspect you like airport luggage, “f*ck 'em” is correct. But don’t pretend that’s how it should work. That’s exploitation dressed up as protocol.

The better question isn’t why the worker won’t jump through flaming hoops, sing, and do backflips. It’s why employers still think they deserve the show for free.

[Phil O'Sophical]

Re: Easier solution

Employment isn't a democracy. If you want to call the shots, either start your own business or develop a unique skill set, otherwise you're a commodity. You're an employee, not a partner, and easily replaced. That hasn't changed in millenia, nor will it ever.

[elsergiovolador]

Re: Easier solution

“If you don’t like it, start a business or develop a unique skill set.” - the corporate equivalent of “if you're homeless, just buy a house.” As if every underpaid worker has the time, money, and mental bandwidth to self-fund a specialist education - just to be offered a wage barely above someone stacking shelves.

This is the cruel fantasy baked into modern work: that companies deserve world-class talent, trained at the worker’s own expense, while offering none of the reward, respect, or security in return. Just another contract, another round of unpaid take-home tasks, another hiring freeze because “headcount got re-evaluated.”

And calling people “commodities” isn’t realism - it’s managerial cowardice. A lazy excuse to dodge responsibility, sidestep investment, and justify bad leadership. If everyone’s replaceable, fine - but don’t act confused when no one bothers to care, commit, or stay.

[LVPC]

Re: Easier solution

>> You're an employee, not a partner, and easily replaced.

Obviously NOT so easily replaced it you're looking at people who aren't local because you want a unicorn - someone cheap, lots of experience, no need to invest in them, and checks all the boxes. In other words, a unicorn.

[Helcat]

Re: Easier solution

>“Because he wants the job.” Spoken like someone who still thinks a job is a favour, not a transaction. <

It's a negotiation: Do you want the job and do they want to employ you. So it's give and take.

There's also the real cost of travel: Not just the cost of the car/train/plane: It's also the cost of the time and it's not a single person going, it's the interview panel, some of which will be management. From a business point of view, you'd only send your interviewers to the candidate in exceptional circumstances: In all other cases, the candidate can come to you. If an in-person interview is required. That's why some companies (usually the better ones) offer expenses for travel when it comes to interviews.

[Phil O'Sophical]

Re: Easier solution

Why is it always the worker who must travel, beg, and prove? If in-person is so vital, send the manager.

In your haste to rant, did you even take the time to read the whole post you replied to? Specifically the bit which said "Who does what travel is irrelevant.". As the poster noted, what's important is the face-to-face meeting, not how it is achieved.

[rcxb]

Re: Easier solution

There's no excuse except incompetence for not spending what is, compared to the salary, a trivial sum bringing the person in for an in-person interview,

What's to stop the Norks from hiring an actor with a hidden earpiece from acting as a stand-in for the face-to-face portion?

How many remote workers are going to get robbed or kidnapped by flying to a foreign country to interview with what turns out to be a fraudulent company?

[TimMaher]

Re: unicorn candidates

And, when they get over excited, they stick their horn in the ceiling.

[Anonymous Coward]

Re: Easier solution

The only real use for a qualified recruitment HR person is having them sit in on an interview to stop you asking the candidate question you cannot legally ask or breach your employer's own code conduct.

To be honest that could be the general counsel, if they weren't typically just as gormless.

I hadn't really noticed the term "Unicorn Candidate" and just looked it up. The unavoidable feature of mythical creatures is that this industry seems to have not grasped - they are myths. So it's no great surprise to discover employers have been impaled on the horn of a recently recruited charging rhinoceros.

[MachDiamond]

Re: Easier solution

"And step 0 - fire hr and have the interviews done by the people they're going to work with - they're the ones with the actual expertise on what the job requires."

HR should have little to do with the hiring process other than inform a manager what the latest laws prevent them from asking and if there are other restrictions on something such as nationality. The ads I see written are so often from HR droids as they say almost nothing about the position in many many words. The qualifications will also be very cookie-cutter. Why, as an avionics engineer, would I need to be expert in PowerPoint? If I'm going to work in the media department, I really don't need to be up on CRM software, it being an internal department.

[elsergiovolador]

Bogeyman

Let’s get one thing straight: this article isn’t about North Korea. It’s about corporate hypocrisy, tech industry grift, and the billion-dollar pastime of punching down.

We're told that the “North Korean fake IT worker” is the latest bogeyman haunting the plush, over-air-conditioned boardrooms of Silicon Valley. The horror! Someone might pretend to be a software engineer to… do software engineering? And yet somehow the outrage isn’t about the decades of fake job postings, unpaid interview projects, and exploitative hiring pipelines run by the same companies now clutching their pearls.

Let’s talk stakes. According to the Department of Justice, this supposedly existential threat has cost $88 million over six years. That’s the kind of change Google misplaces in the cushions of a single quarterly report. Meanwhile, legitimate candidates across the world lose billions in unpaid labour, invisible time sinks, and “trial projects” that are never compensated - all in the name of “hiring diligence.”

Here’s an idea: if you're so terrified of hiring someone who's too competent, maybe stop making interviews indistinguishable from actual work. If your “engineering task” has candidates fixing production bugs or implementing real features, congratulations - you're not hiring, you're freeloading. Pay up.

And if you're so worried about identity fraud, maybe show your cards first. Share your salary range. Share your financials. Disclose whether you're in the middle of another stealth layoff round or gearing up to ship employee laptops to landfill again. Candidates are supposed to provide ID, do live coding, submit to AI analysis, and now apparently prove they're not a rogue agent from Pyongyang - yet companies don’t even have to commit to a call back.

Also rich: companies who literally sell identity verification tech, moaning that their own systems can't spot fake applicants. If you’re shocked that ChatGPT can answer your questions better than a human, the problem isn’t the candidate - it’s your recruitment process, your lazy filters, and your blind trust in LinkedIn connections as a measure of competence.

Let’s be real - this entire panic stems from the fact that “James Anderson” with an accent dares to be skilled. The subtext isn’t subtle. When a Western-sounding name doesn't come with a white face and a Harvard pedigree, the sirens go off. This is bias masquerading as national security, and the fact that it’s being sold with a straight face is embarrassing.

Instead of demanding biometric scans, document barcodes, and in-person gear pickup as if you're hiring for MI6, try this: pay candidates for their time. Respect their labour. And stop pretending your own hiring practices aren’t already a deeply broken, exploitative mess.

Because let’s be honest: the most common scam in tech hiring isn’t coming from North Korea. It’s coming from inside the building.

[Gene Cash]

Re: Bogeyman

Another nice straw man.

The end issue is that the pay is going straight to a hostile country. Not to the bloke that's getting hired.

Has nothing to do with his skill. Stop trying to deflect the conversation.

[elsergiovolador]

Re: Bogeyman

First of all - if this were truly a national security issue, why does it only become a “crisis” after the candidate’s sailed through multiple interviews and tech screens? Background checks, ID verification, basic due diligence - all skipped. Because companies don’t want actual security. They want cheap labour, fast hires, and just enough plausible deniability to look surprised when it backfires.

Second - let’s stop pretending tech corporations are innocent victims. These are the same firms that offshore entire departments to the lowest bidder, run shadow contractor networks, and route code through anonymous third-parties in ten different countries - right up until one of those countries becomes politically awkward.

And finally, this line about “the money doesn’t go to the person doing the work”? Please. This is the same industry that treats workers like disposable widgets - farmed out via gig platforms, zero-hours contracts, or shady agencies. If tech giants actually cared where the money went, they'd start with their own supply chains - not scapegoat some guy with a fake CV and better English than half the C-suite.

[Philo T Farnsworth]

Re: Bogeyman

It strikes me that two things can be true at the same time.

Corporations are run by a pack of soulless homunculi out to maintain quarterly "shareholder value" and their own fat salaries at any and all costs, including human.

North Korea, an oppressive cult of personality run by a third generation egomaniac, is out to grab as much western currency as it can to fuel its nuclear and other ambitions.

These are not mutually exclusive and apparently excusing one by excoriating the other seems to me to be at least a bit disingenuous.

[elsergiovolador]

Re: Bogeyman

No one here is defending North Korea.

But what you’ve missed is that my point isn’t to excuse one by attacking the other - it’s to highlight the selective outrage. We only seem to care about where money goes when the villain is foreign, cartoonish, and conveniently external. Meanwhile, we turn a blind eye to the everyday economic sabotage companies do to their own workforce, their own standards, and their own security - all in the name of “efficiency.”

You want to stop hostile infiltration? Start with fixing the system that welcomes it - the one that automates hiring, outsources responsibility, and is perfectly happy not knowing who’s working for them, as long as it’s cheap and fast.

[Philo T Farnsworth]

Re: Bogeyman

If your point is missed it is perhaps because it wasn't clearly stated.

[elsergiovolador]

Re: Bogeyman

Or perhaps it was clearly stated - just inconvenient to acknowledge.

I pointed out that focusing outrage on foreign threats while ignoring the self-inflicted dysfunction inside corporate systems is not only hypocritical, it’s dangerous. That’s not unclear. That’s just uncomfortable.

If that point didn’t land, the issue isn’t the message - it’s your refusal to engage with what it exposes.

[Philo T Farnsworth]

Re: Bogeyman

I'm not "refusing" anything.

I'm also not particularly outraged, especially not at North Korea. At some point, the Kim Cult of Personality will collapse, probably of its own corrupt weight.

I think I was pretty clear on my disdain for global corporatism but, you know, even a cursory examination of history tells us that it will eventually collapse of its own corrupt weight, as well. Nothing, not even oligarchy, lasts forever.

If not that, then there's always 99942 Apophis.

[doublelayer]

Re: Bogeyman

"we turn a blind eye to the everyday economic sabotage companies do to their own workforce, their own standards, and their own security"

We do? Because part of my job is trying to drag my employer into better security. And yes, they do sabotage themselves, but the reason why they chose to employ me is that they realize what will happen if their bad choices cause a problem for them: they, including the owners, managers, employees (including me), and customers of the business will suffer. They probably only care about the group they happen to be in, but that is very common as you are repeatedly demonstrating. You've invented a situation where nobody cares about this unless the perpetrator is North Korean, even though that's not at all true, and contrary to your statement, you are, in fact, using that to defend North Korea. We've read your statements doing so, including:

"North Korea isn’t a threat - it’s a metaphor. A convenient bogeyman"

"Let’s get one thing straight: this article isn’t about North Korea. It’s about corporate hypocrisy": No, it's about a real thing that North Korea does and people don't want done to them.

"We're told that the “North Korean fake IT worker” is the latest bogeyman haunting the plush, over-air-conditioned boardrooms of Silicon Valley. The horror! Someone might pretend to be a software engineer to… do software engineering?": No, the horror, that you just hired someone who could do software engineering, but because their bosses want money, is instead going to hold the company to ransom, from which neither the owners nor the employees are going to emerge unscathed.

Yes, someone here is defending North Korea: you. If you don't want to, you're doing it wrong. You have another set of points you keep talking about, but you intersperse your comments about them with defenses of North Korea. Having conversed with you on this topic before, I'm guessing this is a flawed attempt to change the topic to something you care more about, but you're changing the topic so abruptly and out of context that you're defending them in the process and in such an obvious way that it's logical to assume that you intended that.

[elsergiovolador]

Re: Bogeyman

Let’s be clear: criticism of corporate dysfunction is not a defence of North Korea. If you're genuinely reading "North Korea is a metaphor" as “North Korea doesn’t exist or isn’t doing this”, then you're not engaging - you’re manufacturing a position to attack.

The metaphor - and I used the word deliberately - is about how foreign threats are used as narrative cover, while internal rot goes unexamined. That’s not exoneration. That’s pointing out the selective outrage. One state actor exploiting holes is news. Thousands of companies creating those holes through negligence, greed, and indifference? Business as usual.

Nowhere did I deny that North Korea engages in malicious activity. What I questioned - and still do - is the framing: that this is a crisis only when it comes from a foreign entity, while corporate practices that enable it get shrugged off or even rewarded.

If you believe calling out that double standard is “defending North Korea,” then frankly, that says more about your argument than mine. I’m not trying to change the topic - I’m pointing out that the topic is incomplete without acknowledging the systems that make the threat viable in the first place.

[Anonymous Coward]

hiring has no relevance to actual needs.

Some bellend just thinks we need AI people incase and to look relevent. They hire some supposed (probably North Korean ,who cares) AI people who sit there doing something or nothing till maybe something happens. If not they leave and now have worked at AI on the CV

No wonder skynet would kill us all first chance it got lol.

[williamyf]

My country is one of the Few which has formal relations with North Korea...

Having said that, unlike my country (Venezuela), or Cuba, where the sanctions are imposed by one (or a few) country(es), and then coercitively making other countries institutions and companies to follow suit, most of the sanctions against North Korea come from the United Nations themselves, ergo, are multilateral sanctions...

So, in a way, this article is usseful for us too if, after consulting with Legal, they advise that NorK workers are to be avoided. So thanks.

PS: Guess that Iran and russia (to name just two) would have no such qualms. Cua has significant cooperation agreements with the NorKs since the late '80s or early '90s, pre - UN sanctions.

[DS999]

There's no need for in person interviews

Just in person VERIFICATION of identity. If you're interviewing with a company across the country they need a trusted person to verify you exist and you have identity documents like a passport or Real ID that match you. All banks have notary services for their customers, and many would presumably be willing to extend such a service to non-customers for a fee.

If the applicant is overseas you'd have to see if there is something similar where they live, but I'd suggest that if you can't trust the banking system (or whatever equivalent trusted identity verification process they may use) in the country the person is applying from you shouldn't trust applicants from that country either.

[LVPC]

Re: There's no need for in person interviews

A passport? Not gonna email a copy of that OR other documents to some shifty HR droid who hasn't got a clue. Ever.

Banks providing notary services to their clients? Not for a couple of decades. Too much liability.

But it's easy enough to generate a fake pdf of a passport scan and a notary stamp and a birth certificate and a drivers license and a diploma,, identity thieves do it all the time. Just search for "nurse identity theft" and see the fraudsters caught only after years of working as someone else.

[Tim_the_Unenchanter]

Re: There's no need for in person interviews

Used the notary services at our bank last week….

[LVPC]

Re: There's no need for in person interviews

Not in Canada you didn't. Banks are dropping services that aren't profit centers.

[DS999]

Re: There's no need for in person interviews

Did you not read the first sentence of my post where I stated in person verification of identity?

You would not be mailing PDFs of your passport. You would be showing it IN PERSON to a notary public at a bank or law office or whatever, they will verify that the identity on it matches the identity of the person showing up with it, and notarize a document saying "LVPC presented himself/herself at my office located at xxx on July 14th 2025 at 1:53 pm CDT with what was to the best of my knowledge a matching valid US passport" and would send THAT to the HR droid.

I have used notary services from my bank (actually a credit union) about a dozen times over the years, no charge. I'm not aware of any trend towards dropping that service, though if liability is a problem maybe some have added a charge to defray the cost of the required insurance. Sometimes local government employees will do it, though it probably depends on how busy they are etc. Lawyers also provide the service, generally for a fee - though a very small one when you compare to the expense of flying across the country for an in person interview.

If it became a trend to do this for remote interviews you might see other businesses offer it for a fee (but less than a law office charges) like a Staples or Mailboxes Etc.

[LVPC]

Re: There's no need for in person interviews

And it's super easy to fake that "notarized stamp." Same as diplomas, certificates , licenses, etc.

In my volunteer work I've come across people trying to receive benefits with fake documents. Same as once in a while I'd catch someone trying to pass off counterfeit money. Maybe you've never KNOWINGLY got fooled by counterfeit currency or documentation, but that doesn't mean you've never been fooled.

Trusting paperwork is stupid. Evaluate the person, not the paperwork. If you're deep ring on papers to hire someone, you deserve to be scammed, same as people who give money to total strangers on Facebook to "invest" in get rich quick scams.

In both cases, lack of the diligence is stupid.

[DS999]

Re: There's no need for in person interviews

But the APPLICANT isn't getting that notarized statement, the company doing the hiring is getting it sent directly to them from the notary. Notaries have an official notary license number they include, they'd be sending the email from their official work account etc.

Its clear you have no clue how the notary process works and have never used it, and are offering zero alternatives other than criticism. Worthless opinions are worthless.

[An_Old_Dog]

Much Ado about the Wrong Things

1. Many of these filters are too-tight, or are simply bogus.

• Fat resumé, few LinkedIn connections: I don't have a fat, "unicorn" resumé, but I do not have any LinkedIn connections, because I am not on any social media sites. Not LinkedIn. Not Facebook/Meta. Not Twitter/X. Not Foursquare (yes, they used to be a social media company). Not Mastodon.

• Name/ethnic appearance correlation: I work with a woman who has a Hispanic given name -- "Esperanza". Her physical appearance is African. Some of my co-workers have Hispanic names, and are ethnicaly Hispanic, yet a few of them have Anglo appearances. When I attended uni, it was common for Asian students to adopt Anglo-sounding nicknames. Name/ethnicity correlation may be high if your mental and physical world is centered on South Hog's Rump, Iowa, USA. Elsewhere, it's far, far less.

• ChatGPT, et. al.: LLMs provide average-ish answers; that's a consequence of how they work. An average answer by the candidate should not disqualify a candidate (there are few perfect unicorn candidates, and none of them will be applying to your company).

LLM output has a distinctive, recognisable (unpleasant, aggravating) style* which becomes more-appearent in longer texts. Have the candidate compose a multi-page technical document covering a job-relevant area.

* which I, and some other, but seemingly not most, people can recognise.

• Document verification: this is nothing but a bad joke. It might catch some low-budget scammers, but a nation-state-backed operation will have professional document forgers to support their agents. Further, there will be people they can bribe or blackmail working at government and scholastic institutions who can create/change electronic records to match the forged identity. Further still, they probably have compromised some of those government and scholastic computer systems.

2. Some things can effectively screen the posers.

• Face-to-face interviews with the team (not just the hiring manager). Have the candidate write code and design on the blackboard/whiteboard. (For managerial positions, design/coding tests will obviously will not work.)

[LVPC]

Re: Much Ado about the Wrong Things

Agree with everything except this:

>> For managerial positions, design/coding tests will obviously will not work

How do you expect someone to manage something they don't understand and have no experience with? The whole "management class" concept is a fraud.

[Omnipresent]

It all smells rather foul.

The whole thing coming and going through pootin's arse like a greasy one through an old pair of underpants. The Fat Elvis from Asia minor is in a quid pro quo with a country that rhymes with "flusha".

[Pascal Monett]

So, Fortune 500 companies are wasting money and time

They're actively trying to spend the least to get the "most qualified" and so will not spend one cent on checking who said "most qualified" says he is.

And I'm supposed to shed a tear over this ?

Could we get a Fuck You icon ?

[TimMaher]

Re: Fuck You icon

Best I can find @Pascal. ——->

There again…

[Anonymous Coward]

Hire

I would never hire anyone with meeting that person in real life.

BTW what's even more concerning is probably IT workers showing up to do the interview and then working remotely and letting cheap Indians or even North Koreans do the work for them. That's a realistic scenario IMHO. That's much harder to detect.

[Wellyboot]

Re: Hire

Subcontracting work (that’s what this is) has already been seen, it scales best when the hiring companies management invest zero time in getting to know their staff and the staff themselves are not interacting beyond actual work functions. AI just makes it easier to pull off in an industry filled with apocryphal basement dwellers.

Know your people, listen to them, improve their situation when you can and be honest about it when you can’t, above all don’t trip the B-S detectors that all engineering types begin developing during their first PFY job.

[elsergiovolador]

Re: Hire

BTW what's even more concerning is probably IT workers showing up to do the interview and then working remotely and letting cheap Indians or even North Koreans do the work for them.

That's how many big consultancies operate actually. It's only bad if workers do it themselves.

[Anonymous Coward]

Re: Hire

Because you're hired / paid to do the work yourself. Not let someone else do it for you.

Now that I think about it I don't think most contracts expressly forbid this.

[Anonymous Coward]

“chief people officer”

There’s ya problem right there…

[DrXym]

Is it really that hard to fix this issue?

Require an in-person interview. If there are reasons this cannot be done, then require them to interview in conditions that the company sets, e.g. a video call in a satellite office, or in the presence of a solicitor / notary / commissioner of oaths after presentation of id etc. The interview process could even have some left field questions, like "film yourself in your local park, or your favourite coffee shop". Things that would be a pain in the arse for North Koreans and would probably make them try some other target.

[Ken G]

Re: Is it really that hard to fix this issue?

Video AI has really come along, to the point that those location requests could be easily faked but calling into a know agency (recruitment or legal) and having them check ID vs face and put them on a video call to you should work. If there was a telephone booth left in their claimed location you could ask them to visit and answer as it rings :)

[elsergiovolador]

Re: Is it really that hard to fix this issue?

If we’re doing that, let’s make it mutual.

Before the interview, the company should provide evidence of solvency, proof they can actually pay the advertised wage, and a breakdown of all layoffs, “headcount realignments,” and stealth firings from the last three years. Let’s add a statement of corporate ethics, including the number of open complaints at employment tribunals. Maybe a filmed walk-through of the office, narrated by someone not in HR.

After all, if the worker has to prove they’re not a hostile threat - the company should prove it’s not an unstable, exploitative mess wrapped in buzzwords.

[MachDiamond]

Re: Is it really that hard to fix this issue?

"After all, if the worker has to prove they’re not a hostile threat - the company should prove it’s not an unstable, exploitative mess wrapped in buzzwords."

Well, there's the vast majority of Silicon Valley companies off of the list.

[iComment]

This problem needs a government level legally binding requirement that you must have a job candidate appear in person at your premises at least once before work commences. It need a legal requirement and not just some kind of best practice guideline to stop company's that should know better from cheaping out. It's not just company information that is at risk but also the personal data they may be processing.

No genuine candidate, even if they want to work 100% remote, is going to have a problem with a one-time appearance. A North Korean is going to have a problem as they won't likely get a Visa.

[abend0c4]

Only having 25 LinkedIn connections

I junked LinkedIn decades ago because I was even then being pestered by all and sundry wanting me to endorse their career achievements. I doubt if there were ever even 25 people who have given an honest and accurate account of my strengths and weaknesses. Most LinkedIn connections seem to be people who would once simply have exchanged business cards but now feel the need to be seen to be playing the numbers game.

If you're getting 1000 applications per month you have no hope of screening them, whether for competence or for fraud. The myth is that, if you attract a lot of applicants, somewhere amongst them will be the brightest and the best and all you have to do is identify them. The brightest and the best (or the most appropriate for the post) are not going to waste their time chasing jobs that attract thousands of applicants because it's a waste of their time and a clear signal of an employer to be avoided. If they were to apply, your chances of spotting them amongst the chaff are minimal. The first step is to have a recruitment process that is actually manageable.

Above and beyond the security risk to the employer, employment is subject to a legal framework: there's taxation and social security and having a legal right to work in a particular jurisdiction and not being subject to sanctions against particular individuals or regimes, etc. It's quite hard to get those things right without having a subsidiary based in the country where the candidate is located - in which case there's really no excuse for them not to be seen in person. If you're prepared to pay them through a freelance platform, set our expectations accordingly.

Recruitment is an inherently risky business. If you're prepared to hire a face in a fuzzy video call backed up with a pinky-swear that their qualifications are real it shouldn't be a surprise if it all goes horribly wrong. Perhaps what you're trying to do is simply unrealistic.

[Anonymous Coward]

Re: Only having 25 LinkedIn connections

Hear hear on LinkedIn - I might not have 25 connections either, but that doesn't mean I'm fake, it means I don't waste time on LinkedIn and I'm selective about who I accept "friend" requests from. (Hint - if someone has 1000+ connections, they don't actually know most of them, or even have met them.)

[joepie91]

"These types of scams, largely originating from North Korea, or at least funneling money back to Pyongyang, have cost American businesses at least $88 million over six years, the Department of Justice said last year."

That's... it? $13 million per year on average, across the entirety of a major economy? That's what we're all making such a ruckus over? Even if that were underestimated by a factor of 10, it'd still barely be worth writing a news article about.

It reminds me of the people who get up in arms about a municipal bridge costing "millions of dollars", not realizing that at society scale you need to divide everything by a thousand or so to get a number that makes intuitive sense.

[martinusher]

..and it assumes that such workers are entirely useless, they're just unproductive spies, rather than competent workers.

I suspect that what's really useless is the DoJ and their spy novel grade conspiracy BS. Unfortunately with the actual and impending carnage of the Federal government and its agencies this is one agency that won't see any cuts, at least ones not related to ideology (i.e. 'disagreeing with the leader"). Add to this the small practical detail that NK shares a land border with both Russia and China, countries that are currently on our (s)hit list. Regardless of a particular government's official position might be you can bet that the locals aren't going to be falling over themselves trying to implement sanctions policies for us.

[TheBruce]

Thats an oddly specific number

"That number has recently jumped to more than 1,999 purported job seekers in a two-month period"

[ICL1900-G3]

Asleep at the Wheel

Saw them with Emmylou Harris in Central Park, 1977. Absolutely ace. Possibly off-topic though!

[Tron]

Worse to come.

Anyone leaving school or uni now may well have been 'assisted' by the use of AI. So you may be getting someone a lot dumber than you think, who is prone to cheating.

And none of the NK fixes will work on them. Best get ready for Generation Fake.

[rcxb]

Fraudulent employees interviewing for Ghost jobs

Gotta hire a security company to ensure your HR department doesn't interview fake employees to fill your fake "ghost jobs".

[Anonymous Coward]

Your problems started with the letters HR.

[IvaliceResident]

My linkedin is terrible lol. I have hardly any connections.

It's also pretty bland in terms of the corporaty "suggested posts".

I also am considering deleting it as iI get sick of the inbox spam that I can't disable.

[Anonymous Coward]

Rivka Little genuinely liked the candidate

"He was affable, a nice guy," she said. "He was making jokes. There was nothing about him that would make me not want to work with him."

"Affable", "nice", "jokes" and "want to work with" ?

We are speaking of IT ?

Seems more like some delusional IT Shangri-La or just plain confidence trick.

The highest performing personnel in IT from my experience were quite objectionable and almost invariably borderline sectionable.

[Zack Mollusc]

Missing the point..

It may be possible to weed out the evil foreign spies, but that would take competence, effort and money. If the companies were competent and willing to put in some kind of effort and spend a little money, they would not be recruiting remote workers from the ends of the earth.