Employers “just want to see an American”. That is how a new US indictment summarizes a 2019 conversation. It explains North Korean IT worker fraud better than most threat reports we have read. According to the grand jury, an alleged supervisor told a US facilitator how to behave in a job interview, then promised to type all the answers.
North Korean IT worker fraud is a sanctions-evasion scheme in which overseas workers win remote jobs under stolen or fabricated identities. In practice, it splits one employee into several people. Fake documents fill the file, a paid facilitator can handle the interview or host the laptop and a worker abroad does the job. DOJ says the latest case’s revenue is believed to have reached sanctioned entities North Korea controls.
We sell document checks, so take this seriously when we say they help here and are nowhere near sufficient. Below, we go through what the case alleges, what a document can actually tell you and how to close the gap without punishing honest applicants.
North Korean IT worker fraud: what is alleged and what a court has settled
On 13 October 2026, the US Department of Justice announced coordinated actions in Ohio and Texas. DOJ says the Ohio scheme ran from 2019 to around July 2025. The indictment’s conspiracy charges run to January 2026.
The Ohio indictment charges 14 people, two of them under seal. Two US nationals have been arrested. Between them, the indictment and the DOJ announcement allege that the scheme:
- Reached more than 70 US companies, in sectors including health care, communications, retail and manufacturing
- Compromised the identities of more than 25 US persons
- Generated approximately $3 million for the workers abroad
- Cost victim companies at least $3 million in legal fees, network remediation and other losses
These are allegations. Every defendant is presumed innocent.
Don’t add the Texas figures to that list, because they are a separate matter. Between 21 and 25 September, the FBI took action at over 40 Texas residences known or suspected to be laptop farms. Across Operation Lonestar Roundup as a whole, it seized approximately 187 laptops and KVM devices (hardware that lets someone operate a computer remotely).
If you want a version a court has actually ruled on, look at Christina Marie Chapman. She pleaded guilty and, in July 2025, was sentenced to 102 months in prison. That is eight and a half years.
DOJ reports 68 stolen identities, 309 US businesses and two international businesses defrauded and more than $17 million generated. Those victims included Fortune 500 corporations, so “we have a proper HR department” is not much of a defence.
The fake documents went far beyond a forged ID
“Stolen identities” makes a good headline, but the indictment is more specific and far more useful. It alleges forged US passports, Social Security cards and driver’s licences containing the pictures of the overseas workers and the names and personal details of the US victims. The face belongs to one person and the identifiers to another.
The ID was only the first page. According to the indictment, the stolen identities were backed by:
- Fraudulently notarized attestations
- College diplomas, including some from an unaccredited online college
- Employment references built on fraudulent email addresses and phone numbers
- Fictitious resumes and online profiles
One defendant allegedly incorporated a Texas company to provide validation of past employment. A facilitator was allegedly asked for a phone number for account verifications because it was not a VoIP line.
A table in the indictment lists what one Ohio facilitator (named, but not charged, in this indictment) allegedly held in July 2025. It has 23 entries, covering diplomas, licences, Social Security cards, W-2s, pay stubs, laptop packaging and Post-it notes with usernames and passwords.
That reads like the back office of a small staffing agency, except that every employee is somebody else.
The paperwork allegedly continued after the hire. One persona gave an employer a “medical accommodation form” asking to be excused from using a video camera. It was purportedly signed by a psychologist who shares initials with another fictitious employee in the indictment.
Genuine accommodation requests are common, so don’t treat them as suspicious.
We have written before about where credential fraud enters a hiring pipeline, often because a candidate wants a better salary. This packet has a different purpose: making someone who should never reach your systems look ordinary.
The FBI adds a detail that should bother anyone in our industry: workers often buy accounts or licences from identity verification providers to confirm that stolen data will pass employment background checks before they apply. They test the identity like a product before launch.
Laptop farms split one employee into three people
Here is why a tidy file can still be wrong. Each hiring check looks at a different person. Each of them can pass.
- The person on paper is a stolen, fabricated or rented identity. It appears on the contract and in payroll. The indictment alleges that much of the pay was falsely reported to US tax and social security agencies under stolen names.
- The person on camera may be a paid stand-in. The FBI’s October advisory says workers pay some Americans to appear on camera, join interviews and meetings, verify fraudulent identities and lend professional accounts with years of real history.
- The person at the keyboard is abroad, connecting to a company laptop in a US home through remote desktop software or a KVM switch.
Your HR file never sees that third person. The laptop sits at a plausible address, the work gets done and the wages allegedly land in accounts the group controls.
Meeting face to face does not settle it either. The indictment alleges that the supervisor told the facilitator to hire an actor to portray an applicant at an in-person job interview in Akron, Ohio.
In April 2023, the alleged supervisor asked for updates on approximately 24 laptops the Ohio facilitator was maintaining. In October 2024, a co-conspirator allegedly asked for a list of companies that had sent laptops. The purpose, according to the indictment, was to stop one company shipping laptops for several fake employees to the same address, one of the simplest checks an employer might run.
Rented identities are the awkward part for vendors like us. The indictment alleges that some facilitators let their own names, images and personal information be presented to employers. The FBI says workers pay some facilitators solely to use their identities.
That passport could be genuine. The face on the call could match it. How would any document check flag that?
AI-forged documents are not the story in this case
Given the current headlines, you might expect a deepfake story, but this isn’t one. Neither the indictment nor the FBI’s October advisory mentions AI or deepfakes. The Ohio scheme also dates back to 2019. Its alleged tools are older and cheaper: a photo on a forged passport, a paid American, a real phone number and a copy of AnyDesk.
To be clear, AI still matters in hiring fraud. Microsoft reported in June 2025 that North Korean IT workers appear to use AI tools like Faceswap to move their pictures onto stolen employment and identity documents.
But a real person in a real chair, paid to say yes, is not a deepfake. If your response to this case is to buy a deepfake detector, you have solved a different case.
What a clean ID check can and cannot tell you
ID checks still matter here. VerifyPDF has been rolling out identity document checks since summer 2026, with availability that may be enabled progressively across accounts. From a clear photo or scan of a passport, driver’s licence, national ID or residence permit, we check:
- Machine-readable zone (MRZ) check digits
- The printed document number, date of birth and expiry against the MRZ, when both are available
- Expiry status and image provenance, such as editor traces in the original image metadata
A failed checksum or a printed date that contradicts the MRZ is a concrete inconsistency and a good reason to stop and ask. Combining one person’s photo with another person’s details, as alleged here, can leave traces like these. It doesn’t have to. We have not seen the documents in this case, so we cannot tell you what any check would have returned.
A clean result means the submitted document is internally consistent. It does not mean the uploader owns the identity.
A careful forger can calculate check digits, because the algorithm is public. A genuine stolen ID can pass. So can a facilitator’s real one.
Many driver’s licences have no MRZ at all. A Social Security card is outside the four ID types we support. VerifyPDF also does not do selfie matching, liveness challenges, government or issuer database lookups or background checks. The final hiring decision stays with you.
If you are weighing up this layer, our identity document verification page sets out the supported ID types, the checks behind each risk rating and what they do not replace.
Supporting documents are the second layer. They answer a different question. When payslips, employment letters, bank letters, utility bills and tax returns arrive as original PDFs, document forensics can examine metadata, the text layer and file structure.
That can flag an edited employment letter or a bank letter with a suspicious file history.
Diplomas need one more step. Forensics can look for edits, but a diploma from an unaccredited college can be an unaltered file. Check accreditation and confirm the award with the issuer.
Cross-reference the two layers, because a valid ID says nothing about whether the employment letter behind it is real. Just remember that an anomaly cannot prove fraud by itself. And an unaltered PDF can still belong to a stolen identity.
A fingerprint request allegedly did what the hiring file did not
The line in the indictment that stuck with us is about a request for fingerprints. In June 2023, the Ohio facilitator allegedly received paperwork asking for the fingerprints of one identity. The supervisor ordered it dropped: “That sucks because we’ve been using A.S. for over a year.”
The indictment doesn’t say who asked or why, so let’s not over-read it. The FBI now says paid Americans complete fingerprint submissions or urinalysis tests too, so no single control settles the question. But the detail shows where friction seems to work: at steps that demand a specific person, again and again, after the hire.
The indictment describes other post-hire friction too:
- One employer asked questions about prohibited software on its laptop
- Another terminated a persona that made excuses to avoid in-person meetings and video calls
- A third persona repeatedly changed its direct deposit details and refused to travel to work events before it was terminated
None of those signals came from the hiring file. The FBI calls its answer “identity in depth”: layered detections, access controls and continuous identity verification throughout employment. It also says plainly that these workers cannot be reliably identified with a single indicator.
Here is how we would map that to this case:
| Layer | What it can establish | How the scheme allegedly got around it | What adds evidence |
|---|---|---|---|
| ID document | The submitted document is internally consistent | Forged, stolen or rented identities | Face matching and liveness from a proofing provider, where lawful |
| Supporting PDFs | File integrity and consistency across documents | Shell-company references and fake diplomas | Contacting issuers through independently sourced details |
| Interview | Someone can hold a conversation | Paid stand-ins, hired actors and typed answers | Repeat live verification with the same person after hire |
| Device | Where and how a laptop is used | Laptop farms, AnyDesk and KVM switches | IT alerts for remote tools, KVM hardware and location changes |
| Payroll | Where the money goes | Accounts controlled by the group | Review of bank account and address rotation |
Only the first two rows are VerifyPDF’s job. Your IT, security and payroll teams own the rest, which is why the FBI wants HR, IT, security and management working together.
State-sponsored identity fraud prevention without punishing honest applicants
Nor is this only an American problem. Google Threat Intelligence reported in April 2025 on personas seeking work in Germany and Portugal, facilitators in the UK and a corporate laptop meant for New York that turned up in London. If you hire remote developers from Amsterdam or Berlin, read this case as a preview.
Overreacting carries its own risk, though. The FBI warns that aggressive controls carry “unusually high risks” of false positives that could harm legitimate employees and filter out qualified applicants. It also says relying solely on ban lists risks hurting identity theft victims.
Our own view is blunter: nationality, ethnicity, appearance, accent or a foreign address on its own is not evidence of fraud. The indictment describes several overseas defendants as Chinese citizens or residents of China, so a nationality filter misses the point even here. Plenty of honest remote workers use VPNs and move house.
Then there’s the law. The FBI says E-Verify, requiring a US passport, multiple forms of ID or live verification can raise friction for these workers.
Ask your lawyers first. The DOJ’s civil rights division says US employers verifying work authorization may not demand more or different documents than necessary because of citizenship, immigration status or national origin. The same goes for requesting specific documents.
In Europe, the GDPR limits what you should collect and how long you keep it.
A process that respects those limits looks like this:
- Set checks by role before applications arrive. Base them on access level and apply them to everyone in that role.
- Check documents before the laptop ships. Run the ID and supporting PDFs at the stage your lawyers approve, while saying no is still cheap.
- Cross-reference the file against operations. Compare the application with the shipping address, payroll account and phone number.
- Verify again after hire. Hold a repeat live check, especially before access is expanded.
- Escalate combined signals, not single ones. Use a documented review workflow for false positives, so a flag leads to questions rather than an accusation. In the US, the FBI asks companies to report suspected activity to a field office and IC3.
Employers should want more than a plausible file
The Ohio allegations and the Chapman conviction point to the same lesson. A complete hiring file shows that somebody assembled a complete hiring file. Check the ID and the supporting documents, because both can expose real inconsistencies, but treat a clean result as one layer and keep verifying the person using your systems.
To see what the document layer actually returns, open our no-signup demo. It walks you through a real faked bank statement and what the checks catch. The alleged pitch was that employers just want to see an American. Your hiring process should take a little more convincing than that.