Fake Remote Hires: NC Employer Identity Fraud Guide

TL;DR: A background check tells you a record is clean. It does not tell you the person on the video call owns that record, or that they are the one signing into your VPN on Monday. In a survey of 500 U.S. HR leaders released September 15, 2026, the identity vendor HYPR reported that for the 42 percent of organizations that only detect hiring fraud after day one, 98 percent of the fake hires already hold active corporate credentials by then. The free controls close the handoff between hiring and IT and surface inconsistencies; none establishes who is at the keyboard. The exposure underneath, sanctions and insurance, is what nobody sends you a brochure about.

Who is supposed to check that a new hire is a real person?

Often no one, and HYPR's September 15 release put numbers on the seam. Before day one, 53 percent of HR leaders say they own identity risk against 17 percent of IT and security. After credentials are issued it flips: 55 percent security, 15 percent HR. The day a candidate becomes a username, HR thinks IT has it and IT thinks HR had it.

One caveat. HYPR sells identity verification, so this is a vendor counting a real problem among its buyers, not a census. The release combines two studies: HYPR's own survey of 500 U.S. HR leaders, and a separate report produced with S&P Global / 451 Research that surveyed 950 IT security decision-makers.

How does a fake hire end up with a working password?

By being hired. Nobody phishes anything: your IT process opens the account, enrolls the second factor and mails the laptop, because that is its job.

The laptop farm is worth understanding, because it leaves physical evidence. A facilitator in the United States receives the company machine at a residence, keeps it powered, and hands the overseas worker remote access. Your monitoring sees American broadband in a plausible state. The address was real. The person living at it was not the person you hired.

Two corrections. Plenty of small employers ship nothing: a remote bookkeeper or offshore contractor on their own machine never triggers a delivery, removing your best signal. And it can be slow. Mandiant's M-Trends 2026, published March 23, 2026, puts the global median dwell time at 14 days, up from 11, and the median for cyber espionage and North Korean IT worker investigations specifically at 122 days. That 122-day figure covers North Korean IT worker cases that reached an incident responder: the median one had been inside about four months when found. HYPR's four to six days, below, covers hiring fraud of every kind as HR leaders report it.

Key takeaway: Firing the person does not take back what they already downloaded, and it does not undo the payments you already made. Both of those are decided before day one, not after.

Is this a Fortune 500 problem or a 90-person problem?

The victim lists are full of ordinary employers. In November 2025, Cybersecurity Dive reported guilty pleas from five facilitators whose actions defrauded more than 136 U.S. companies, and in April 2026 two U.S. citizens living in New Jersey were sentenced over laptop farms using more than 80 stolen American identities to place workers at more than 100 U.S. companies, generating roughly $5 million for North Korea. When the Justice Department charged 14 North Korean nationals in December 2024, SecurityWeek reported prosecutors alleging at least $88 million over six years. The 2024 indictment is a set of allegations; the 2025 guilty pleas and 2026 sentencings are not.

None got hit for being big. They got hit for hiring people they never met, through a process satisfied by documents and a delivery address. That describes a lot of manufacturing, construction and industrial businesses between High Point and Charlotte now hiring remote ERP developers, bookkeepers and help-desk staff because the local market is thin.

It is broader than one country. HYPR describes candidate fraud generally, with threat actors using generative AI, voice cloning and synthetic profiles to get onto payrolls. Filing this under foreign espionage is how a 90-person shop in Archdale talks itself out of checking its own paperwork.

What actually gives a fake hire away?

Usually a person. HYPR reports 68 percent of fraudulent hires are uncovered by human observation after clearing screening, and Help Net Security pulled the companion figure on September 18: across identity-based and AI-driven attacks, third-party security tools detect 53 percent of threats.

A 90-person company can look at every laptop that leaves the building. In our experience that goes unused. One rule first: these are reasons for a phone call, never to accuse anyone. Holland & Knight's August 26, 2026 analysis of the July 2026 State Department and FBI joint advisory is explicit that employers should work from objective, articulable indicators and apply screening uniformly, documenting a nondiscriminatory reason for any adverse decision. Screening applied inconsistently, or because of who somebody appears to be, is how an employer ends up defending a discrimination claim. When an indicator fires on one person, investigate to the standard you would apply to anyone, write down why, and involve counsel before any adverse step.

• A late change of shipping address. Sending the machine to a relative, coworker, mail center or temporary address in the first week is, in our experience, the clearest signal you get.
• The laptop first phones home from the wrong city. Whatever remote-management tool your IT uses logs the public IP a new machine appears on. Somebody compares it to the shipping label, or nobody does.
• They will not enroll a second factor you can manage. Offer a company-issued phone or hardware key first; refusing a personal phone alone is not a signal. A hardware key raises the bar, but it can still be mailed on or left plugged into a farmed laptop, so it is not proof of who is present.
• The hours drift one direction, not occasional late work but a pattern fitting another time zone.
• Anomalous login activity or remote-access tools nobody approved, both on Holland & Knight's list of objective indicators.

Holland & Knight's controls land in the same place: on-camera interviews against a government photo ID, reference checks using contact details you sourced yourself, laptop delivery requiring photo ID or in-person pickup. The same analysis says screening should be applied uniformly across similarly situated roles, and that training should cover avoiding overdocumentation, document-specific demands and premature reverification, so the photo-ID check belongs at the interview, for every candidate in the role, not as an extra demand on one person.

Want your last three remote hires walked backward? Who shipped the laptop, who watched the first login, what city the device first checked in from. Preferred Data Corporation has served manufacturers from High Point since 1987, on-site within 200 miles and remotely for clients across the US and worldwide, average client relationship past 20 years. Call (336) 886-3282, see managed IT and cybersecurity, or contact us.

Whose problem is it when the fake hire was on your payroll?

Not your IT company's, and this is the section vendors skip. None of it is legal advice; the point is which calls to make.

Sanctions first. If payroll went to somebody fronting for a sanctioned jurisdiction, the money left your account. Holland & Knight puts it plainly: because OFAC sanctions violations carry strict liability, engaging with North Korean workers can result in penalties even when companies are unaware of who they transacted with. Their guidance: take counsel's advice before any further payment, consider blocking or escrowing amounts payable, and have a path for voluntary self-disclosure to OFAC, the Justice Department or the FBI.

Insurance, second, and now. Report a discovered fake hire to your broker or carrier and to coverage counsel straight away, under every policy that might respond, because each policy sets its own notice terms. Whether a crime or fidelity policy pays turns on its wording, so ask specifically how it defines employee: the person you paid may never lawfully have been one. Read the wording again at renewal, when you can change it.

Employment law, third. Beyond the discrimination exposure above, Holland & Knight notes that the Immigration and Nationality Act prohibits citizenship-status discrimination and unfair documentary practices in the I-9 and E-Verify process, so demanding extra or specific documents because something felt off is a question for employment counsel, separate from the IT half.

And one nobody raises: if the identity belonged to a real American, you have been putting their Social Security number on a W-2. Ask counsel what you owe them and whether North Carolina notice obligations apply.

You already hired someone. What now?

One change, applied to everybody, and taken to employment counsel before you adopt it: a quarterly identity re-verification on camera for every remote worker and contractor, where the person shows a government photo ID checked against the employment record and the account payroll pays. Two cautions decide whether it is safe. It is not I-9 reverification and must not be run as one; Holland & Knight's list of things to train against includes premature reverification. And demanding a specific document can create the document-abuse exposure described above even applied to everyone, so uniformity is necessary, not sufficient. Counsel decides the form; you decide it happens.

Now the limit, where employers hand themselves false assurance. A scheduled video check proves who appeared on that call and nothing else. Whoever sat the interview can sit every ceremony you schedule, first login included, then pass the credentials, the session or a remote-controlled laptop to whoever does the work. It raises the cost and creates a dated record. It does not bind that person to the account activity that follows.

Nothing you run in-house establishes who operates an account. These signals are narrower and still worth having. They surface inconsistencies you would never otherwise look for: login geography against the address on file, remote-control software on the endpoint, two sessions at once, payroll account name against the employment record. An impostor working from the stated address, on one machine, paid into a matching account, trips none of them. Their advantage over a ceremony is running continuously, and they remain indicators, not identification. Identity assurance needs verification against independently sourced evidence, which is what an identity-verification service or an investigator working for counsel is for. If something does not reconcile, counsel gets the call before anyone is confronted.

What to change before the next remote hire

1. Supervise the first login. Fifteen minutes on video while IT watches the person set their password and enroll their second factor, same face that interviewed. Be clear: a record and a raised bar, not proof of who uses the account on Tuesday.
2. Match the shipping address to the employment record in writing, in the ticket, by whoever ships the device. An address change inside 30 days becomes a phone call.
3. Add dual control on payment changes, and scope the access as tightly as your software allows. Require a second person to approve any new vendor or bank-detail change, and ask what your accounting package can scope: role limits, time-limited elevation, export restrictions. Dual control alone leaves reading and exporting data, and altering invoices for vendors already on file, untouched.
4. List every outside party holding a login. Contractors, the ERP consultant, the bookkeeping service, the website firm. In our experience many cannot, which is more persuasive than any statistic here.
5. Review first-seen device geography at 30 days. The data exists wherever your IT support manages machines. Looking at it is what does not happen.

Monday morning: pull your last three remote hires and answer three questions each. Who shipped the laptop. Who watched the first login. What city the device first checked in from. Cannot answer all nine? Call (336) 886-3282 before the next offer letter goes out.

Frequently Asked Questions

Does an I-9 or E-Verify check catch this?

Not reliably. The I-9 requires an employer to examine original documents in the employee's presence, or over live video under the DHS alternative procedure available to E-Verify participants in good standing, and E-Verify photo matching applies only to certain documents. What none of it proves is that the person examined is the person who signs in on Monday. The New Jersey laptop farm case sentenced in April 2026 involved co-conspirators stealing the identities of more than 80 Americans, as TechCrunch reported.

We only hire locally. Are we exposed?

Less on employees, more on contractors. A remote ERP developer, offshore bookkeeping service or website contractor gets comparable access with none of the scrutiny. Start with step four.

What is the actual damage if this happens to us?

The expensive damage is stolen data such as drawings and customer lists, and cleanup: Help Net Security's summary of the report says most companies need at least one to three weeks to resolve an incident, and HYPR's release puts 24 percent at one to three months.

How fast should we expect to catch one?

It depends which cases you mean. For hiring fraud generally, among the 42 percent of organizations that only find out after day one, HYPR puts the average at four to six days. The North Korean IT worker cases Mandiant investigated ran a median of 122 days. No video ceremony shortens that by itself. What can shorten it is watching the account for inconsistencies: login geography against the address on file, remote-control software on the endpoint, two sessions at once. None of that identifies the operator; it gives you something to notice.

Is there a product that solves this?

Identity verification products help at the document-to-human step. What they do not do is decide who owns the handoff between hiring and provisioning, the failure this research documents. Buy the product after you have named the person, not instead of it.

Related Resources

• IT onboarding and offboarding security, the process this post extends
• Deepfake fraud and the insurance coverage gap
• Voice cloning and executive impersonation
• Third-party vendor risk management for manufacturers, for the contractor question
• Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265, (336) 886-3282, serving Greensboro, Winston-Salem, Lexington, Thomasville, Charlotte, Raleigh and the Piedmont Triad