How well do you know the people who work at your organization? If there’s an employee who works entirely remotely and has never been met in person by anyone else on staff, would you be surprised if it turned out they were an imposter, and a security threat?
As it turns out, this isn’t as far-fetched as it might sound. Hiring fraud is an increasing problem for companies looking to take on new staff, and it’s not just limited to the tech sector. Any firm that contains sensitive data and has remote positions available faces this risk from threat actors, particularly those from North Korea.
How can you keep your company safe from these intrusions? To find out, we spoke to several experts within the cybersecurity field, many of whom have been directly affected by North Korean hiring fraud and have hardened their security posture as a result. Their lessons are worth learning before your organization becomes the next target.
A problem you can’t ignore
When ethical hacking outfit Vidoc Security Lab started looking for a new developer, it received a swarm of applications within seconds of the job being posted online, with many of the approaches almost certainly made by bots. Weeks later, the firm almost hired an applicant using deepfake technology to hide their identity. Dawid Moczadło, co-founder and CTO of Vidoc, told CISO Voice that the problem is a “bigger one than most companies think.”
Vidoc was far from alone. Gartner believes that by 2028, one in four job candidates will be fake. Many of these likely come from North Korean state actors, with security firm Nisos estimating that a single DPRK cell, which it began investigating after a suspected operative applied for a job at Nisos itself, was behind some 167,000 fake job applications between late 2024 and 2025.
The process usually follows a recognizable pattern. A threat actor disguises themselves as an attractive candidate by deploying a variety of tricks, from fabricating credentials on their CV and using AI to answer interview questions to deploying deepfake tech to disguise their face and voice on video calls.
Then, once they’re in, they get to work. Moczadło explained that as soon as “someone like that is inside, they get access to your code, your data and your systems. In the best case they collect a salary and do nothing. In the worst case they plant vulnerabilities or steal data.”
Aaron Painter, CEO of identity verification company Nametag, summed it up succinctly to CISO Voice: “Hackers don’t break in anymore; they log in.”
And AI is changing the game for both attackers and defenders. For attackers, it lowers the costs involved and helps them appear more convincing than ever, said Richard Byrd, Chief Growth Officer at Nisos. For defenders, it can connect various elements of the fraud (resumes, profiles, and application data), and spot inconsistencies that a human might miss.
AI or not, though, Byrd argued that “the strongest results come when HR, security, and legal teams work together to investigate those signals and apply human judgment.”
Spotting the clues
So are there any telltale signs that a potential hire is not who they claim to be? While there isn’t a single indicator that acts as a smoking gun, taken together there are indicators that can point towards something untoward.
Never meeting in person allows the fraudulent hire to go undetected (and potentially work simultaneously for many companies). Having a company device sent to a different location from the one listed on a CV might be a sign that a laptop farm is being used to help foreign workers log in remotely on US soil.
Go beyond the application. Moczadło advises firms to check LinkedIn, where “Fake profiles are usually empty, brand new, or too perfect” and brimming with experience at Meta, Google, and Amazon all in a short space of time.
And then there’s the interview itself. A classic technique is to watch for visual glitches on the applicant’s face. This can be a sign that they’re using deepfake technology to obscure their identity. If you suspect that’s at work, ask the applicant to wave their hand in front of their face. If they refuse or it causes further glitches, you may have caught a fraudster.
Interviews can also offer up other signs of deception. “Broken” cameras, stilted answers that sound like they come from ChatGPT, an inability to answer unscripted questions that should be trivial for genuine applicants; all of these are warning signs.
But everyone we spoke to warned that there is no hard-and-fast playbook that can unmask a fraudster every time. Indeed, Byrd warned that “organizations get into trouble when they build a checklist and assume that checking one or two boxes identifies a fraudster.”
Instead, each company needs to assess whether every claim put forward by an applicant can be verified. Byrd pointed to “discrepancies between a person’s professional history and other available information, unusual patterns in their employment history, difficulty substantiating specific experience, inconsistencies across interviews or an identity that doesn’t hold together when you look across independent sources” as clues that something doesn’t add up.
Be careful not to treat any of these indicators as foolproof “gotchas.” Instead, Byrd cautions that “the strongest signal is often not a suspicious-looking piece of information. It’s the absence of corroboration when you would reasonably expect it to exist.”
How to stay safe
Aside from recognizing the tells that point towards a deceptive hire (and learning not to treat any of them as simple checklist items), how else can you keep your company and its data safe?
All three experts emphasized independent verification. Don’t rely on sources the applicant provides. If you can, meet them in person before offering them a job.
That applies to existing hires, too, stated Painter. “Assume you have already been targeted,” he suggested. “Look back at your recent remote hires, especially anyone who has never been seen in person, and re-verify them.”
Once someone is on the team (whether or not you suspect them of being fraudulent), you must “start with least-privilege access and expand it as trust is established,” Painter advised. Re-verify at high-risk moments like when granting access to sensitive systems and watch out for remote access that doesn’t match where they say they are based.
Detecting hiring fraud has traditionally been seen as an HR problem, Byrd said, but that has to change. Instead, he argued that “there needs to be strong collaboration between HR, legal, and security departments to identify potential fraud before trusted access is given.” If these three business areas can only see their own part of the problem, Byrd added, “an organization can easily miss the larger picture.” The gaps between teams “are where these actors operate,” Painter warned.
Closing those gaps requires time and effort, and efforts to do so might meet with resistance from incredulous decision makers who don’t think they could possibly become a target. But tightening up your operations could have a huge impact on your business, saving you from sanctions, stolen funds, exfiltrated data, and a whole lot of pain.
