North Korea's Fake Remote Workers Could Get You Sanctioned

You post a remote developer role. A sharp resume comes in, the interview goes well, the candidate's camera is on and their answers are fast and specific. Three months later you get a call: the person you hired isn't who they said they were,

You post a remote developer role. A sharp resume comes in, the interview goes well, the candidate's camera is on and their answers are fast and specific. Three months later you get a call: the person you hired isn't who they said they were, and the salary you've been wiring has been funding North Korea's weapons program.

That's not a hypothetical. On July 31, 2026, eleven governments, including the United States, the United Kingdom, Japan, South Korea, Australia, Canada, and five EU member states, issued a joint alert warning that North Korean IT workers are now using real-time AI deepfakes to get past the one hiring check most businesses still trust: the live video interview. The full alert reads less like a cybersecurity brief and more like a hiring manual for a threat you didn't know you were screening for.

If your business hires remote developers, designers, or IT contractors, this is worth ten minutes of your attention. Not because you're likely to get caught in an FBI case. Because the fix is cheap, and the alternative isn't.

Eleven governments just confirmed what recruiters suspected

North Korea runs a state-directed program that places skilled IT workers into remote jobs at companies around the world, using stolen or fabricated identities. The workers remit their salaries back to North Korean agencies, which use the income to fund nuclear weapons and ballistic missile programs. That much has been public since a 2025 joint statement from Japan, the US, and South Korea. What's new in the July alert is the method.

Governments now say North Korean operatives are pairing stolen identity documents with real-time AI video manipulation during interviews, essentially deepfaking a live call so the face on screen doesn't match the person actually typing the answers. The alert itself describes hiring teams seeing "video feeds that appear to be manipulated or artificially generated" and photo ID mismatches during calls that used to be the reliable tell.

The scale behind this isn't small. US Treasury's Office of Foreign Assets Control sanctioned six individuals and two entities in March 2026 for running a crypto-laundering network tied to this scheme, and put a number on it: North Korea's IT-worker operation generated close to $800 million in 2024 alone. A separate Justice Department sweep in 2025 raided 29 "laptop farms," US addresses where a local accomplice keeps company-issued laptops running so a North Korean worker can remote in and look domestic, across 16 states. That single sweep found more than 100 US companies had unknowingly hired someone who wasn't who their resume said.

The interview trick that beats your one reliable check

Most small businesses don't run background checks on every contractor. What they do run, almost universally, is a video call. It's the moment you actually see the person you're about to pay, and until recently it worked as a decent filter: a scammer running a stolen identity usually couldn't also fake the face.

That assumption is what the July alert says is now broken. Real-time deepfake tooling lets an operative map a different face onto their own video feed live, during the call, well enough to survive a 30-minute technical interview. Combined with large language models cleaning up second-language English and generating a plausible portfolio, the whole application can look completely normal end to end.

None of this requires your business to be a crypto exchange or a defense contractor. The alert names web development, mobile apps, and general software work as areas the scheme is actively expanding into, which is most of what a small agency or product company hires contractors for in the first place.

Hiring one isn't just an HR mistake

Here's the part that should actually change how you run your hiring process, not just make you nervous. Under UN Security Council Resolution 2397, member states are required to repatriate North Korean nationals earning income in their jurisdiction. And per the joint alert, contracting with a North Korean IT worker and paying them for services rendered "may also violate the domestic laws of many countries, including Japan, the United States, and the Republic of Korea, and may result in legal consequences or financial penalties."

That's the real cost of skipping verification. It isn't just "you might get scammed out of a salary." It's a compliance exposure sitting inside a process most businesses treat as pure HR admin.

The checklist the alert actually gives you

The joint alert doesn't just warn, it lists specific behaviors to watch for, aimed at anyone hiring or procuring remote services. Worth keeping next to your applicant tracker:

• The candidate refuses a live, unscripted video interview, or the video shows glitching, lag, or a photo ID that doesn't quite match the face on screen.
• Profile text reads like an inaccurate machine translation, inconsistent with the fluency the candidate claims.
• The account behind the application has changed its name, contact details, or payout bank account more than once.
• Payment is requested via cryptocurrency, or routed through a third party's bank account instead of the contractor's own.
• The rate quoted is meaningfully below market for the stated skill level.
• Communication style shifts noticeably between messages, as if more than one person is answering from the same account.

If multiple characteristics apply to a job applicant, there is a possibility that a North Korean IT worker is fraudulently seeking work.

— Joint alert to countries, companies, and other entities regarding North Korean IT workers, July 31, 2026

None of these checks is exotic. The problem is that almost nobody runs all of them, because nobody owns the process. A founder sourcing a contractor off Upwork isn't cross-referencing bank account names against ID documents. A hiring manager under pressure to fill a role isn't going to flag "the answers came a beat too fast" as a reason to slow down.

A background check won't catch this. A workflow will.

We build fraud-prevention workflows for clients on the accounts-payable side already, the kind that flag a vendor's bank details changing and hold the payment until someone confirms it through a second channel. That exact pattern, applied one step earlier in the pipeline, is what actually catches this. Identity document capture that cross-checks the payout account name automatically. A required live-video step that can't be skipped for a "scheduling conflict." A hold on the first payment cycle until someone signs off that the interview and the invoice match.

This isn't a one-off checklist you tape to the wall and forget. It's the same category of problem we've written about before: AI made invoice fraud a $3 billion industry by making the fake vendor email sound real, and the fix there was a verification step baked into the payment workflow, not a policy nobody reads. The pattern repeats everywhere AI lowers the cost of impersonation, including inside your own agentic tools if you're not watching what they trust, and in what your team pastes into a chatbot without anyone approving it. Hiring is just the newest surface.

If you're running a lean team and hiring contractors through freelance platforms or cold outreach, you likely don't have a dedicated verification step at all right now. That's the gap. We wire the check into the process you're already running: document capture, payment-account matching, and a hold on anything that doesn't line up, so it happens automatically instead of depending on someone remembering a fifteen-point checklist mid-interview.