Nobody Owns Identity Verification in Your Remote Hiring Pipeline

What Happened

The FBI opened an investigation into a remote IT worker at a U.S. federal agency who is believed to be a North Korean national (TechCrunch). Not a startup, not a crypto exchange. A federal agency, where hiring controls are assumed to be at their strictest.

This did not come out of nowhere. In its November 2025 enforcement announcement, the Justice Department counted 136 victim companies whose remote roles were filled with the help of U.S.-based facilitators (DOJ). A separate indictment of fourteen North Korean nationals covered a scheme that moved at least $88 million to the regime over roughly six years (DOJ). The State Department issued its own alert to governments and companies in July 2026 (State Department).

The mechanics explain the miss. Stolen, borrowed, and synthetic identities cleared the paperwork. Laptop farms and proxy hosts inside the United States made the applicant look domestically located during interviews and onboarding (DOJ). Everything the company checked came back clean. Only the things it never checked were false.

What This Means for Founders

Pull the remote hiring funnel apart and each stage declares what it actually tests. Resume screening tests whether the career story is plausible. The technical interview tests whether someone can write the code. Reference checks collect opinions from people who worked with that person. A background check service queries records tied to the name and identifier you submitted.

None of those asks whether the person on the other side of the call owns that name. The technical interview passes because a real engineer sits it. The background check comes back clean because it queries a real person’s records. Stacking more stages does not make this question get answered somewhere along the way.

Startup conditions sharpen the exposure. There is often no dedicated recruiter, so a founder or team lead runs everything from screening through onboarding. Remote-first means many hires never involve a physical touchpoint. Heavy use of contractors and freelancers routes people around the full-time process entirely. Each of those exists for good reasons. Together they produce a pipeline where identity is nobody’s job.

The cost is not a wasted salary. The FBI says these workers used their network access to exfiltrate proprietary data and credentials that fed later attacks (TechCrunch). That is a repository and production credential problem, not a bad-hire problem. Paying wages to a sanctioned jurisdiction is a separate legal exposure on top.

What You Can Do Now

Give identity verification its own named step. Open your hiring process doc and search for a stage whose stated purpose is confirming the candidate is who they claim to be. If it is not there under its own name, that is your answer. If you assumed the technical interview or reference check covers it, the paragraphs above explain why it does not.

Concentrate the friction on one finalist. Requiring document verification from every applicant depresses your funnel and costs real money. Placing a live document-and-face check immediately before the offer reduces the population to a single person.

Treat address and payment mismatches as a checklist item. Resume address, payroll account holder, connecting IP range, and equipment shipping destination pointing at different countries is a pattern that recurs across these cases. Each has an innocent explanation on its own. All four diverging at once is rare.

Narrow first-week access. No verification is perfect. Simply not granting production credentials and full repository access during week one shrinks the worst case substantially. This one is worth doing regardless of whether you ever meet this threat.