North Korean IT worker red flags for recruiters, from the FBI, DOJ and Treasury

North Korean IT workers apply for remote jobs under stolen, borrowed or invented identities and send most of their pay back to North Korea. The red flags US agencies publish for employers, as of October 2026, are: contact details reused across different applicants, profiles that disagree with the resume, refusal to appear on camera or video that freezes or looks manipulated, signs that someone else is answering, laptops requested at an address other than the one on the ID, pay to cryptocurrency or a third party's account, and frequent changes to bank, address or accounts after hire. The FBI's newest guidance stresses that no single indicator is reliable: look for combinations, and check everyone at the same stage the same way.

This page collects the indicators from each advisory, by hiring stage, with its source. General identity fraud detection, including deepfakes and proxies of any origin, is covered in how to spot candidate identity fraud.

Who are North Korean IT workers, and why do recruiters see them?

The State Department, Treasury and FBI warned in May 2022 that North Korea dispatches thousands of highly skilled IT workers who pose as non-North Korean, often US-based, teleworkers; individuals can earn more than $300,000 a year in some cases. Treasury said in March 2026 that these schemes generated nearly $800 million in 2024. One facilitator alone helped workers get jobs at 309 US companies using 68 stolen identities, according to the Justice Department (July 2025).

The work they seek is web, mobile, software and blockchain development, according to a July 2026 multinational alert published on the FBI's Internet Crime Complaint Center site by the states participating in it. The FBI's October 2026 announcement adds that they now also seek roles requiring security clearances with defense and government contractors. Recruiters see them because remote technical roles, freelance platforms and staffing firms are the way in.

What changed in 2026?

The FBI's October 13, 2026 announcement describes a shift in tactics:

• More facilitators. Workers hire Americans and others to host laptops, run more laptop farms with fewer devices each, and target people under financial stress.
• Identity and account rental. Workers pay to use facilitators' professional accounts and sometimes their identities, and buy verification accounts to pass background checks.
• Subcontracting. Some get the job, then pay cheaper freelancers in South Asia or West Africa to do the work.
• Escalation. Threats against former managers, data leaks and, in some cases, hired in-person intimidation.

The practical consequence for recruiters: the person you meet, the person whose identity is on the paperwork, the person receiving the laptop and the person doing the work may be four different people.

What are the red flags at the application stage?

What are the red flags in interviews?

The September 2026 advisory suggests asking for detailed explanations of the skills on the resume and simple personal questions about the candidate's hometown, the weather or hobbies, because a team can inflate one person's apparent skills. The FBI's July 2025 guidance suggests asking the candidate to point the camera out of a window and answer questions about the location they claim and the location on their ID.

What are the red flags at offer and onboarding?

• Equipment to a different address. Requests to send a laptop somewhere other than the address on the ID, or to a freight forwarder, or a home address that changes soon after hiring (May 2022; October 2023). The FBI's July 2025 guidance says to ship only to the ID address and require more documentation if another is requested.
• Unusual payment requests. Payment in cryptocurrency or through money transfer services, a third party's bank account, or an account name that does not match the worker (May 2022; July 2026 alert).
• Payment platform changes. A freelance or payment account that was shut down, or a request to use a different account, especially in another name (May 2022).
• Avoiding in-person steps. Inability to complete in-person drug testing or fingerprinting, which the FBI suggests where possible to confirm identity and location (July 2025).

What are the red flags after the person starts?

These belong to the hiring manager and security team, but recruiters and agencies often hear about them first:

• Remote access tools such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop or Splashtop, KVM-over-IP devices, or a separate laptop controlling the work device (FBI, October 2026).
• Software unrelated to the job, such as screen-streaming tools, and frequent changes of bank account, address or social media accounts (October 2026).
• Several logins to one account from different IP addresses, often in different countries, in a short time; software that supports multiple simultaneous calls (January 2025).
• Inability to work required business hours, slow responses on instant messaging, tasks not completed (May 2022).
• Threats to release proprietary code unless paid (October 2023; January 2025).

How should recruiters and agencies respond?

The FBI's October 2026 advice is "identity in depth": layered controls across the whole employment lifecycle rather than one filter, with weak or moderate signals treated as grounds for closer review when they accumulate. It suggests adding friction such as E-Verify, passport requirements, multiple forms of ID or live verification, while warning these are not foolproof. For recruiters, that translates into:

1. A live identity check on camera for every remote candidate at a fixed stage, with ID held to the camera, as the October 2023 guidance describes. The candidate identity verification checklist sets out the stages.
2. Continuity across rounds, so a change of person is noticed.
3. Equipment and pay rules that match identity: laptops to the ID address with signature delivery, payroll to an account in the employee's name.
4. For agencies: the October 2023 guidance tells employers to request documentation of staffing firms' background check processes, to assume none was done if a firm cannot provide it, and not to accept background checks from untrusted sources. Expect clients to ask, and have the answer written down.
5. No access before checks clear. The FBI's July 2025 guidance: do not grant system access until the background check is complete.

Screening questions for contractors are in IT contractor screening questions, location and time-zone questions in remote candidate screening questions, and a remote hiring loop with identity checks at each stage in the interview guide for remote roles.

What are the legal risks of hiring one by mistake?

Paying a North Korean worker can violate US sanctions. Treasury states that civil penalties for sanctions violations can apply on a strict liability basis, and the 2022 advisory notes civil penalties of up to the greater of the statutory maximum or twice the value of the transaction. The criminal cases announced so far have charged North Korean workers and the people who knowingly helped them: Christina Chapman received 102 months in prison in July 2025, and two New Jersey facilitators received 108 and 92 months in April 2026. If you think you have hired or paid one, involve counsel promptly. This is not legal advice.

Which signals are not evidence?

Several advisories list items such as a Korean-language preference, or education in one region with employment in another, as indicators in combination with others. On their own they describe millions of legitimate candidates. An accent, a name, a nationality or a foreign degree is never a reason to treat someone as a suspect, and the EEOC's national origin guidance covers decisions based on ancestry or appearance. The FBI's own October 2026 guidance warns that aggressive measures produce false positives that hurt legitimate applicants, and that name-based ban lists can harm identity theft victims. Apply the same checks to everyone at the same stage, and act on verification results, not on profiles.

Where do you report a suspected North Korean IT worker?

Report to the FBI at ic3.gov, through a local FBI field office or at 1-800-CALL-FBI. Include any street address that received a work device, identifiers such as names, phone numbers, emails, bank accounts, IP addresses and profile links, and any images, messages or documents. If the person has already started, security should act first; the step-by-step response, including what to tell a client, is in what to do if a candidate used a proxy. The numbers behind this threat are in candidate fraud statistics.