August 14, 2026

What Are North Korean IT Workers? How the Remote Hiring Scam Works

The remote hiring scam filling your inbox with polished resumes may be funding a weapons program. Here's how to spot it and stop it before the interview.

Back to Blog

Key takeaways:

North Korean IT workers are identity fraud in the hiring funnel. They use stolen or fabricated identities to get hired, passing background checks that assume the identity is real.
Generative AI and remote work have accelerated the threat. Convincing resumes, polished headshots, and deepfake-ready video calls now take minutes to produce, making impersonation cheaper and faster than ever.
The scale is already here. Across 127,000 applications at three companies, Socure flagged 20–27% as high-risk, roughly one in four. Gartner predicted that level for 2028. It’s showing up now, in 2026.
The costs compound fast. Each fake applicant who reaches an interview wastes about 800–1,000 in recruiter time and pipeline disruption. A single bad-actor placement can cost $1 million or more once IP exfiltration, incident response, and regulatory exposure are counted.
The strongest detection signals appear before the interview. Email age, phone-to-name correlation, and device data reveal patterns that fabricated identities can’t hide.
A passive-first approach keeps real candidates moving. Verify before you interview: screen identity at application, run checks behind the scenes, and escalate only suspicious applicants to document and selfie verification.

Posted by

Socure

Topics

First-Party Fraud

Fraud Prevention

ID Document Verification

Hiring the Enemy: When Job Scams Target Companies and Consumers Alike

What Is Workforce Verification?

AI Platforms Are Going to Need Receipts

Stay ahead of identity risk

Insights on fraud, identity, and risk. Delivered monthly.

Socure

Socure is the leading platform for digital identity verification and trust. Its predictive analytics platform applies artificial intelligence and machine learning techniques with trusted online/offline data intelligence from email, phone, address, IP, device, velocity, and the broader internet to verify identities in real time.

VIEW MORE POSTS

Industries

RiskOS^®

Socure Enterprise

Socure Launch

Products

Developers

What Are North Korean IT Workers? How the Remote Hiring Scam Works

Related Posts

Stay ahead of identity risk

Socure

Industries

RiskOS®

Socure Enterprise

Socure Launch

Products

Developers

What Are North Korean IT Workers? How the Remote Hiring Scam Works

Related Posts

Stay ahead of identity risk

Socure

RiskOS^®