Candidate Fraud Threat Intelligence: How Every Fake Leaves a Trail and How to Detect It

A North Korean remote IT worker scheme reached more than 70 U.S. companies, according to an October 13 press release from the Justice Department announcing charges against 14 people tied to the operation. The FBI also searched more than 40 suspected laptop farms across Texas and published email addresses used by the operatives, urging employers to add them to their own lists of threat indicators.

The FBI also warned employers that these workers are adapting to the detections companies have put in place, and that no single indicator will reliably catch them. Finding them means piecing together signals that may look harmless on their own.

That is exactly the problem threat intelligence is built to solve.

A fraudulent candidate has one job: to look exactly like a real one. When they do it well, a single interview won't reveal anything and what gives them away isn't in one application. It shows up across many applications, many companies, and many months. 

Here's how we think about candidate fraud threat intelligence at GetReal: what we collect, how we tell a known bad actor from a merely odd one, and why the recruiting industry needs to start sharing what it sees.

A real identity, with the wrong person behind it

Some fraudulent candidates are what I'd call papier-mâché identities. Push on them a little and they fall apart: the profile photo turns out to be a stock image, the reference’s phone number rings back to the candidate, the companies on the résumé don’t exist.

The hardest cases don't look like that. Much of the activity we track traces back to North Korea, and that means the adversary is a government intelligence apparatus placing people inside Western companies. It can produce convincing fake documents. 

It also buys identities from real people who knowingly sell them, often without knowing who the buyer is. Those people will sit through identity verification steps themselves, because they're being paid to. In one case, a Maryland man let his identity be used to get hired at at least 13 U.S. companies between 2021 and 2024. He verified his identity with his own driver's license, while the work itself was done by an overseas conspirator prosecutors say was likely North Korean.

The FBI’s latest warning shows how routine this has become: North Korean IT workers now buy accounts with identity verification providers to make sure a stolen identity will pass a background check before they ever apply.

The result is the persona of a real U.S. person with a real history. There's nothing papier-mâché about it. If these candidates were easy to tell apart from real ones, the scheme wouldn't be as successful as it is.

Those who perpetrate candidate fraud reuse what's worked before

You might expect an operation this sophisticated to burn every email address, phone number, or forged document after a failed attempt. In practice, that’s not what happens. While there are some indicators they do burn through quickly — bank accounts that get banned, for example — much of what they use gets recycled.

The reason is simple: When a fraudulent candidate gets caught, the consequence is that they don't get that job. They simply move on to the next application. There's little cost in recycling what they’ve already produced, so there’s no need to be careful about it.

We've seen active, recent candidate fraud from email addresses that were publicly tied to North Korea in published research more than a year earlier. We've seen 50 different candidates give the same phone number. We've seen large groups of applicants list the same reference. 

The scale of the infrastructure behind these schemes is significant. Microsoft alone suspended 3,000 Outlook and Hotmail accounts it attributed to North Korean IT workers.

That reuse is why threat intelligence matters when it comes to candidate fraud, and why it works. A fact that shows up once is a curiosity. A fact that shows up again and again is more indicative of an adversary.

What indicators reveal a fraudulent candidate?

Any fact about a candidate you're confident is fraudulent is worth keeping, because it may surface again. The traditional indicators look a lot like what security teams have tracked for decades:

• Email addresses. Still among the most reliable, because they're reused so often.
• Phone numbers. Both the candidate's and their references'.
• IP addresses. These can point to infrastructure the operation relies on, including the home connection of a U.S.-based facilitator.
• The name and identity in use. Stolen and rented identities get recycled too, such as the Maryland case I mentioned above.
• The résumé itself. Its format and the employers it claims are useful. So is its metadata, which can reveal the tool used to generate it automatically, or an author who doesn’t match the candidate and turns out to have written many other résumés.

What's new in this space is that faces and voices are now threat indicators too. A face, like a file, is ultimately a pattern of bits showing up on your network. The FBI publishes photographs of North Korean IT workers on its wanted posters, and researchers publish others. We can instrument detection to recognize when those faces appear, including on a live call.

The same logic applies to the tools themselves. Many deepfake tools ship with default avatars, and we've collected those faces so we can recognize them on a call. If one appears, it's very likely that tool is in use. 

Voices can be fingerprinted biometrically as well, including the synthetic voices of AI agents, which helps answer a question that's quickly becoming central: is this a person, and if not, what is it?

Indicators versus context

When it comes to turning intelligence into detection, I find it useful to separate indicators from contextual evidence.

An indicator tells you something is known to be bad. If a candidate's email address appears on a list of known fraudulent candidates that’s been published in threat research, that's about as clear as it gets.

Context is the set of questions you can ask about any fact, whether or not it's on a list. Take breach history. If you've used the same personal email for years, it has almost certainly turned up in a data breach. So if a candidate tells me they have been consulting for two decades, and gives me a personal email that has never appeared in a single breach, that's worth noticing. Maybe they've never used it online, or maybe it belongs to a persona that was created recently.

The kind of breaches matter too. An American candidate whose email appears frequently in breaches of Russian and Chinese services raises a question. As does an address with an account on one of the roughly 150 criminal forums and marketplaces whose breached data we track. 

IP addresses are another good example. An IP address tells you a lot about where on the Internet someone is coming from, and some places are far more likely to be associated with threat actors than others.

None of these on their own is proof. Each could have a reasonable explanation. But they're the kinds of questions a good investigator asks, and we ask them at scale for email addresses, IP addresses, phone numbers, and every other indicator we look for. 

From signals to a hiring decision

In the GetReal platform, each of these becomes a detection with a severity level that reflects how conclusive it is. A critical detection means we're confident we're looking at a bad actor, such as a match to a known fraudulent email address. A medium detection flags an anomaly, like a missing breach history, where the story isn't clear.

Those detections come together into a risk profile for each candidate, with the underlying factors visible so you can see why. 

That last part matters. A hiring decision about a person should always be made by a person. What technology can do is surface the indicators and context, and help a recruiter or security analyst decide whether there's a reasonable explanation or a candidate who needs a much closer look.

Recruiting needs a seat at the intelligence table

So where does all this intelligence come from? In cybersecurity, sharing happens in roughly three tiers:

1. Open source, where researchers publicly share blog posts and reports that include lists of indicators: email addresses, IP addresses, phone numbers, and more.
2. Private sharing between organizations connected through commercial relationships or collaboration on threat research.
3. Formal industry sharing through ISACs, the Information Sharing and Analysis Centers that were stood up roughly 25 years ago for sectors like finance, IT, and energy.

Candidate fraud data is moving through all three today. But there's a gap. Recruiting firms and RPO providers sit on the front line of this problem and hold enormous amounts of relevant data. Because they aren't considered a critical infrastructure sector, they don't have an ISAC — yet.

But they should. Every time one organization shares a phone number it caught, every other organization becomes protected against that number too. Security teams have been doing this effectively for decades, and there are platforms that make the sharing largely automatic. The recruiting industry should adopt the same practice.

This is also why we invest so heavily in it ourselves. We're constantly building relationships that give us access to new facts, and today we're aware of tens of thousands of fraudulent candidates — one of the largest collections of candidate fraud intelligence we know of. For our customers, that intelligence is working in the background of every detection they see.

Candidate fraud in its current form is still a young threat. Other industries have shown what happens when defenders stop meeting attackers one at a time and treat it as a shared responsibility. The financial sector formed FS-ISAC in 1999 so a scheme that hits one bank can be flagged to the others before it hits them too. Email providers did something similar with shared blocklists: once a server is caught sending spam, mail systems around the world can refuse to accept anything from it. 

Fraudulent candidates are betting that each company only ever sees them once. Recruiting can take that bet away, but only with help from their partners in security and threat intelligence. The more we treat modern-day, AI-powered candidate fraud as a communal threat that requires a communal response, the less time this threat has to mature.