How to verify a remote candidate's location: checks that work, their limits, and staying fair

To verify a remote candidate's location, combine several modest checks instead of trusting one: get the work location in writing, ask specific questions about the claimed location on a video call, match the address on the identity documents at onboarding, ship equipment only to that address, and where practical add one in-person step such as a drug test or fingerprinting. Those last steps come from the FBI's July 2025 guidance on remote worker fraud. IP addresses are a weak signal on their own, and every check should apply to every remote hire in the role, never to people singled out by accent or background. This page reflects the sources as of October 2026 and is not legal advice.

The warning signs of organized fraud are listed in North Korean IT worker red flags, and identity checks by hiring stage are in the candidate identity verification checklist. This page is the method for one question those pages raise: is the person working where they say?

Why does a remote candidate's location matter?

Most of the reasons are ordinary compliance, not fraud:

• Which state's rules apply. The U.S. Department of Labor's comparison of state unemployment insurance laws says that "in general, workers are covered by the UI law of the state in which the work is performed." Your payroll provider also needs the real work state to set up withholding and registrations, so a wrong state means a wrong payroll setup.
• Job postings and pay ranges. Several pay transparency laws reach remote roles that could be done in the state; see pay transparency for remote jobs.
• Client and contract requirements. Some clients and government contracts require U.S.-based staff or data access only from certain locations.
• Security and sanctions. The FBI's July 2025 announcement describes U.S.-based facilitators who give North Korean IT workers "a U.S.-based location for companies to send devices," which lets them get around controls meant to stop the hiring of overseas workers.

Which checks work, and how strong is each?

The FBI's own wording on shipping is the clearest rule in this list: send equipment "only" to "the address listed in the employee's identification documents," and "if the employee requests delivery to a different address, require additional documentation to verify the address." The same July 2025 guidance says not to grant access to any systems until the background check is completed.

Why doesn't an IP address prove where someone is?

IP geolocation databases estimate where an address is registered or routed, not where a person sits. MaxMind, a geolocation data provider, says on its accuracy page that its data is "never precise enough to identify or locate a specific household, individual, or street address," and that with a VPN it may locate the VPN server rather than the user. Accuracy also varies by country and by connection type, such as cellular versus broadband.

The schemes you most want to catch are built to defeat IP checks. The FBI's October 2026 announcement describes "laptop farms," where facilitators keep company devices connected to the internet from U.S. homes while the real workers connect remotely, and notes these have let workers "obfuscate their locations for years." An IP address that looks right is therefore weak reassurance, and one that looks wrong may be a VPN, a mobile network or a database error. Use IP and login patterns as a security monitoring signal after hire, interpreted by your security team, not as a hiring test.

What does a sensible process look like, stage by stage?

1. Job posting. State where the role may be performed ("remote, U.S. only, in states where we have payroll"). Clear rules reduce awkward questions later.
2. Application. Ask for the city and state the person will work from. Ask everyone, not only some.
3. Video interviews. Camera on, background unobscured, and one or two ordinary questions about the area, asked the same way of every remote finalist. Interview advice for remote roles is in the interview guide for remote roles.
4. Offer. Put the agreed work location in the offer letter and say that changes need approval.
5. Onboarding. Complete Form I-9 (remote document examination is covered in I-9 remote verification), compare the address on the documents with the stated location, and ship equipment only to that address.
6. First weeks. Your security team watches for remote-access tools and unusual logins. The FBI's January 2025 guidance tells employers to train HR staff to watch for changes in address or payment platforms during onboarding.
7. Ongoing. Re-confirm the work location when someone moves, because the payroll state and applicable laws change with it.

How do you check location without discriminating?

The fastest way to turn a location check into a legal problem is to apply it unevenly. Guardrails:

• Same checks for everyone in the role. Decide the checks per job, not per candidate.
• Location is not national origin or citizenship. Ask where someone will work, not where they were born or what passport they hold. The EEOC's national origin guidance covers decisions based on ancestry, accent or appearance, and USCIS's Handbook for Employers warns that requesting more or different documents than Form I-9 requires can be an unfair documentary practice when done because of citizenship, immigration status or national origin.
• Expect false positives. The FBI itself warns, in October 2026, that aggressive controls against remote worker fraud carry "unusually high risks of generating false positives that could harm legitimate employees." Treat one odd signal as a question, not a verdict.
• Collect the minimum. Continuous device location tracking is rarely needed for a hiring decision. If you are covered by California's privacy law, "precise geolocation" is sensitive personal information under the CCPA; see CCPA and job applicant data.
• Accommodate. A candidate who cannot travel to an in-person step for a disability-related reason should be offered an alternative.

What should you do if the location doesn't check out?

Ask, in neutral terms, and give the person a chance to explain. People move, travel, use a relative's address for mail, or connect through a VPN their partner set up. A single mismatch usually has an ordinary answer, and your remote work policy, not suspicion, decides whether working from that place is allowed.

Escalate when several signals line up: an address that changes at onboarding, a request to ship to a different address, a bank account that does not match, a camera that never works, and answers that drift from earlier rounds. Then follow the response playbook in what to do if a candidate used a proxy in an interview before hire, or the steps in what to do when a new hire is not the person you interviewed after the start date. Suspected North Korean IT worker activity should be reported to the FBI at ic3.gov.

What should staffing agencies and their clients do?

The FBI's July 2025 guidance calls contract IT work "a common way that North Korean IT workers procure employment" and asks companies that use contracted IT workers to educate the staffing firm about these checks. If you are the agency, run the location checks above before the first assignment, because you are the employer and you ship the equipment or hand the worker to the client who does. If you are the client, write the checks into the contract and ask how they were done; see how to verify staffing agency workers.