The Justice Department recently announced charges against 14 people tied to a North Korean remote IT worker scheme that reached more than 70 U.S. employers, alongside FBI operations at more than 40 suspected laptop farms across Texas. 

The victims weren't concentrated in tech. They included health care, communications, cyber support, retail, and manufacturing companies across 17 states and Washington, D.C.

While the charges make headlines, enterprises should take note of an FBI public service announcement that accompanied the DOJ’s press release, updating its guidance on how North Korean IT workers operate and how companies can stop them.

The central message will sound familiar to any security team. The FBI says these workers can't be reliably caught with a single indicator, and that stopping them requires an "identity in depth" approach: layered controls and detections across the entire employment lifecycle. It's defense in depth, applied to the people you hire.

This is what GetReal is built to do.

Here are some of the most-critical of the FBI’s warnings, what each one means for your hiring process, and how GetReal addresses it — plus what else companies can do to protect themselves.

Certain identifiers are highly rotated

What the FBI warned: North Korean IT workers cycle through bank accounts, street addresses, social media accounts, and other identifiers far faster than legitimate workers, largely because their accounts keep getting banned.

How GetReal covers it: Rotation is hard to spot when you look at one application at a time, so GetReal looks across records. The same email address or phone number appearing on more than one candidate is surfaced as a finding. Each new résumé is compared against the earlier résumés that candidate has submitted, flagging unexplained changes of name, phone number, or email. VoIP, Google Voice, and other virtual numbers are identified on both candidate and employee records. And watchlist monitoring extends to email addresses that closely resemble known bad ones, catching the small variations operators use when an account gets burned.

Documents can be forged under stolen identities

What the FBI warned: Most of the names and addresses these workers give employers come from stolen identities, backed by forged verification documents. Operators even buy their own accounts with identity verification providers to confirm a stolen identity will pass a background check before they apply. The FBI recommends adding measures like E-Verify, multiple forms of ID, and live verification.

How GetReal covers it: A one-time document check confirms that an identity exists, but it doesn’t verify that the person on the other side of the call is who they say they are. GetReal adds a layer of live identity verification, which is one of the recommendations in the FBI's alert. A quick opt-in goes out with the interview invite, and from there GetReal verifies the candidate during the interview itself, inside Zoom, Microsoft Teams, or Webex, with nothing for the candidate to install. That identity then carries forward, so every interaction after is checked against the same person.

They pay others to appear on camera and interview for them

What the FBI warned: Operators increasingly pay Americans and foreign freelancers to appear on camera, sit through job interviews, and join meetings on their behalf. The FBI also notes they use tools like OBS Studio with the VDO.Ninja plugin, software that can route video between machines.

How GetReal covers it: GetReal flags when the person on a call changes mid-process or doesn't match the person originally verified, whether that's a stand-in for a single round or a different face at the final interview. It also detects virtual cameras and injected video feeds, the same techniques that let someone push prerecorded or manipulated video into a live call. Recruiters see a simple green or red signal in the moment, while the evidence goes to security. How incidents are surfaced and managed are highly configurable and backed by role-based access to ensure only authorized users can view the details of an incident.

Real professional profiles can be borrowed or hijacked

What the FBI warned: Operators pay facilitators to apply using their social media and professional networking accounts, which often carry years of legitimate history. They also claim ownership of real tech professionals' profiles they have no connection to in order to make an application look verified.

How GetReal covers it: GetReal compares the profile to the person. Online presence is compared against the experience the candidate claims, and the employers listed are checked against GetReal's employer data, including how old each company's page is and how many people actually work there.

The job is handed to someone else after they're hired

What the FBI warned: Increasingly, North Korean workers land a job and then subcontract the work to freelancers in South Asia or West Africa for a fraction of the salary. The person who got hired is no longer the person doing the work.

How GetReal covers it: Passing the interview shouldn't mean being trusted indefinitely. At offer and onboarding, GetReal confirms that the person accepting the offer, completing training, and receiving credentials is the person your team interviewed. When a candidate is hired, their GetReal identity links to their employee record, so continuity carries into employment. From there, continuous identity verification on video and voice calls catches the swap. The person on day 100 is still verified as the person you hired on day one.

Ban lists alone won't stop them

What the FBI warned: Relying only on ban lists, or filtering out names associated with North Korean activity, is unreliable. It can block qualified applicants and further harm people whose identities were stolen.

How GetReal covers it: Watchlists still matter. The DOJ announcement published 11 email addresses tied to this scheme and urged employers to add them to their indicators. GetReal was already tracking many of these identities thanks to a combination of threat hunting and partnerships across industries and organizations. 

For GetReal, a watchlist match is only one signal in a larger picture, never the whole verdict. Matches run against contact details like email addresses and phone numbers, not just names, and they sit alongside cross-record, résumé, and live interview signals. Customers can also maintain their own tenant watchlists alongside GetReal's global ones.

Aggressive controls create false positives

What the FBI warned: Because North Korean workers overlap so heavily with legitimate remote employees, aggressive controls carry an unusually high risk of flagging the wrong people. The FBI calls for careful calibration, substantive review, and continuous refinement.

How GetReal covers it: Every signal that fires in GetReal becomes a detection with a severity level that’s part of the overall picture. Detections roll up into a risk profile for each candidate, with every contributing factor visible and guidance on how to interpret it. GetReal identifies the risk, and your team makes the decision, with the evidence to distinguish an unusual but legitimate applicant from one who needs a much closer look as a potential threat.

No single team can see the whole picture

What the FBI warned: IT, HR, security, and management each hold different insights. Detection works better when those teams combine what they see.

How GetReal covers it: Collaboration only works if each team gets the evidence where it already works. GetReal connects to applicant tracking systems and HR systems of record, including Workday, and keeps syncing hires, terminations, and contact changes so checks rerun whenever something changes. With an optional permission, findings are written straight onto the candidate record in the ATS. Recruiters can view findings in a browser extension while they review candidates, security gets the full forensic detail, and everything is available through an API for the systems GetReal doesn't connect to directly.

North Korean IT workers are going after a wider range of jobs

What the FBI warned: Operators look for identities and facilitators that qualify them for a larger pool of jobs, including positions that require U.S. government security clearances and roles with cleared defense contractors.

How GetReal covers it: "IT worker" undersells how far these schemes reach. The victims in this week's DOJ case included companies in health care, manufacturing, retail, communications, and cyber support. GetReal is built to work wherever you hire. The signals it examines apply as much to a hospital hiring a remote billing analyst as to a manufacturer hiring a controls engineer. And because the same checks catch proxy interviewers, fabricated histories, and identity swaps no matter who is behind them, GetReal covers hiring fraud in all its forms, not only the North Korean variety.

Additional layers of identity in depth

The FBI's guidance reflects how these operations work today. These steps help prepare for where they're heading, and close gaps that sit outside a single hiring decision.

Prepare your interviews for synthetic media

Today's playbook leans on real people standing in for real identities. But the tools to fake a face or voice on a live call are cheap, widely available, and improving fast, and people are poor judges of them. In research published in PNAS, GetReal co-founder and chief science officer Dr. Hany Farid and Dr. Sophie Nightingale found people identified AI-generated faces correctly only 48% of the time. GetReal detects deepfake video and cloned voices during live interviews, so your defenses are ready before operators decide a face swap is cheaper than a paid stand-in.

Treat the résumé as evidence

A résumé holds far more than the experience it lists. GetReal analyzes document metadata and authorship, including résumés with suspiciously little metadata, and detects hidden text such as white-on-white keyword stuffing. It checks employment dates against when each employer was incorporated, renamed, or merged, and verifies a core set of certifications against their issuing registries. It flags internal contradictions like overlapping jobs or experience that doesn't fit the timeline. It compares résumé content across applicants with different names and against known North Korean and honeypot résumés to catch documents produced by the same source.

Look at who's already inside

The scheme in the DOJ indictment ran from 2019 to mid-2025. Screening new applicants doesn’t catch those who have already made it past the front door. According to our research, 41% of enterprises have already unknowingly hired a fraudulent candidate. 

GetReal runs the same checks retroactively across current and past employees, and across past candidates who were hired, rejected, or withdrew. Finding a fraudulent candidate is valuable even if they've already left, because the same indicators may still be in use elsewhere in your pipeline.

Protect the moments that matter after the hire

An imposter doesn't need to be on your payroll to cause damage. Someone posing as an employee can call the help desk to reset credentials, or impersonate an executive on a call to push through an urgent request. GetReal extends the same identity verification to help-desk and account-recovery calls and to high-stakes meetings, so the person asking for access or approval is confirmed to be who they claim.

Coverage without gaps

Each of the FBI's warnings describes a way around a single check: a background check passed with a stolen identity, an interview passed by a stand-in, a hire who quietly hands the job to someone else. Identity in depth means connecting those checks, from the application to the interview, through onboarding, and across every day of employment. 

The goal is to ease friction for legitimate candidates while leaving no gap for the wrong person — or a synthetic person — to become a trusted one.