iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Look for a pattern of verifiable inconsistencies—not a person’s nationality, accent, education, or one unusual behavior. The strongest warning signs can surface across an applicant’s identity and contact details, interview and onboarding, equipment delivery, payment requests, and later account or network activity. Treat each as a reason to verify, not proof that someone is a North Korean IT worker.
What makes these schemes hard to spot?
North Korean IT worker schemes can involve false or stolen identities, a misrepresented work location, and people in the United States who receive company equipment or help workers connect to it remotely, according to FBI guidance. That means a seemingly ordinary remote hiring process can contain handoffs between the applicant, the person interviewed, the person doing the work, and the person receiving a device.
The FBI’s January 23, 2025 advisory says workers have used AI and face-swapping technology during video job interviews to obscure their identities. It also describes phone numbers—including VoIP numbers—and email addresses reused across resumes attributed to different applicants. A video call can help, but it does not by itself establish that the person on screen is the person who will work for the company.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The UK Office of Financial Sanctions Implementation’s guidance, published September 12, 2024, says the schemes affect firms in the UK, US, and elsewhere; workers operate primarily from Russia and China, as well as other regions. The activity is not confined to one country or hiring market.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which application and identity details deserve a second look?
Details that do not line up
Compare the resume, professional profiles, contact information, identity documents, and employment history. Check for the same phone number or email appearing on applications attributed to different people, or for a profile whose job history conflicts with the resume. The FBI and IC3 also flag multiple profiles linked to one identity with different photos, and profiles with no photo. Sparse online profiles can have innocent explanations, so use discrepancies to guide questions rather than to make a judgment.
Ask the applicant to explain a claimed location, education history, or work timeline if the details conflict. The FBI recommends soft, role-relevant questions about location or education. Do not treat attendance at an Asian institution—or any other educational background—on its own as evidence of wrongdoing.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Interview identity versus the worker who shows up later
Compare the person whose identity was checked during the interview with onboarding records and the person performing the work over time. Unwillingness or inability to appear on camera, inconsistent answers about location or work history, or a mismatch in appearance, time, or location can merit follow-up. Apply the same reasonable standards to candidates generally, and use more than a video call to verify identity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What changes in equipment delivery or payment are warning signs?
Device delivery and address changes
Independently confirm the address before shipping a company laptop. A request to send it to an address that differs from the verified employee address, a freight forwarder, or a recently changed destination warrants a check. FBI guidance describes US-based facilitators who may accept company devices, configure remote access, and reship equipment overseas; the FBI/IC3 advisory also lists freight-forwarding addresses and addresses that change rapidly after hiring.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Ask the worker to confirm changes through a known, separately verified channel rather than relying only on the email or message requesting the change. Review staffing-firm procedures for identity and background checks, and audit that process where appropriate.
Payment requests and offers to handle equipment
Verify changes to a payment platform, account, or method before processing them. Repeated prepayment requests or alternate payment arrangements are also indicators listed in FBI/IC3 guidance. Separately, the FBI warns that people may be recruited to receive work equipment or packages in exchange for a share of proceeds. Treat an offer like that as a serious reason to stop and investigate, not as an ordinary favor.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What account and network activity should employers monitor?
Compare device and account activity with the worker’s approved role and location. FBI guidance recommends watching for multiple logins to one account in a short period from different countries, remote desktop connections or software where prohibited, and unusual access or movement of data. Relevant destinations can include shared drives, personal cloud accounts, and personal code repositories.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Limit each worker’s permissions to what the role needs; avoid unnecessary local administrator rights.
- Restrict installation or use of remote desktop tools when they are not authorized.
- Review unusual endpoint, login, and data-access activity under established monitoring and incident-response policies.
- Investigate context before inferring intent. A developer might have a legitimate reason to copy code, but large-scale copying can create significant theft risk.
These controls are useful beyond this specific threat: they reduce the damage that can follow if an account or device is misused, regardless of who is responsible.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How should an employer verify a remote IT hire?
Use the same layered process for remote workers rather than trying to decide whether a person “looks suspicious.” FBI guidance recommends identity verification during interviewing, onboarding, and employment, alongside careful staffing-firm oversight, least-privilege access, and monitoring.
- During hiring: Compare application details and contact information with other applications in your HR system. Ask direct, role-relevant questions about discrepancies, location, and work history.
- At interview and onboarding: Use appropriate, lawful identity checks and reconcile the identity presented in the interview with onboarding documentation. FBI/IC3 guidance describes showing identity documents during video verification and using in-person steps where feasible. Do not rely on a video call alone.
- Before shipping equipment: Confirm the delivery address independently. Verify any later address change using a known channel, and review how a staffing firm validates candidates and handles background checks.
- During employment: Recheck identity as appropriate, monitor for unusual login locations and remote-access activity, and review data access against the worker’s approved duties. Keep privileged access limited.
- Across teams: Train HR, hiring managers, IT/security, and development teams to notice inconsistencies in identity, contact details, interview handoffs, equipment destinations, payment information, and network activity.
What should you do if you suspect a case?
Follow your organization’s incident-response procedures. Preserve relevant records and assess the assigned device and network activity; avoid making accusations based on a single indicator. The FBI recommends reporting suspected activity to the Internet Crime Complaint Center (IC3) and evaluating network activity and assigned devices. Use the current IC3 reporting site for a report. If your organization operates in the UK, consult the OFSI guidance on North Korean IT workers for the UK sanctions context; reporting and legal obligations vary by jurisdiction.
FBI indicators cited here come from its January 23, 2025 update and earlier FBI/IC3 guidance. Because advisories and reporting details can change, consult current official guidance when acting on a suspected case.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
