How do I spot a fake remote IT worker — or a fake remote job — before it puts me or my employer at risk?

The Justice Department says North Korean operatives have posed as remote IT workers inside dozens of US companies — and the laptop-shipping request is the most reliable tell, on both sides of the hire.

The single most reliable tell is a laptop being shipped to the wrong place: legitimate employers send equipment only to the verified employee at their verified address, so any request to route a company laptop somewhere else — in either direction — should stop the process cold. The US Justice Department says North Korean operatives have infiltrated dozens of US companies by posing as remote IT workers, increasingly using Americans as facilitators who lend the operation a local face and address. That makes the risk two-sided.

A company can unknowingly hire a sanctioned operative and hand them system access and a salary that funds a weapons program. And a job-seeker can be recruited as an unwitting middleman — receiving laptops, opening accounts, or moving money for people they have never met — and end up carrying the legal risk for the whole scheme.1. Verify identity before any access.

Employers: confirm the hire in person or on live video against government ID before accounts, VPNs, or code access are issued — not after the first week.2. Watch for camera refusal. A candidate who will not appear on live video, whose location and time zone keep shifting, or whose story changes between interviews is a red flag, not a privacy preference.3.

Treat equipment detours as disqualifying. Requests to ship the company laptop to a different address — a “friend’s place,” a reshipping service, another state — are the pattern investigators keep finding.4. Job-seekers: know the middleman trap.

Any “job” that asks you to receive and forward laptops, open bank accounts in your name, or move money for an employer you have never met is not a job. Walk away and report it.5. Limit new-hire access until checks clear.

Employers should stage access — email and training first, production systems only after identity verification is complete.Pro tip: when something feels off, slow the process down rather than confronting the person. Preserve the messages, pause the shipment or the access grant, and verify through a channel you already trust.