Photo: LinkedIn Sales Solutions on Unsplash
Fake remote IT workers: how "laptop farms" fool employers
US police raided more than 40 homes holding laptops used by North Korean workers posing as Americans. How the scheme works, why it matters to anyone hiring remotely, and the checks that help.
Remote work opened the IT job market to the world, which is good news for skilled people everywhere. It also created a new kind of fraud: workers who hide who they really are to get hired, sometimes on behalf of a hostile government. In October 2026 the US authorities announced one of the largest actions yet against this kind of scheme.
What happened
On 13 October the US Justice Department announced charges against 14 people over a scheme linked to North Korean IT workers. Between 2019 and 2025 the group allegedly used stolen or invented identities to hold remote jobs at more than 70 companies, collecting around $3 million in pay. In "Operation Lonestar Roundup", the FBI searched more than 40 homes in Texas and seized about 187 computers. Two US citizens were arrested. These are allegations, and the people charged have not been convicted.
How a laptop farm works
- A worker abroad applies for a remote IT job using a stolen or borrowed identity.
- A paid helper in the employer's country, sometimes someone short of money, attends checks in person or lends their documents.
- The company posts its work laptop to the helper's home address.
- The helper keeps the laptop switched on and installs remote-access software, so the real worker can use it from abroad. One home might hold dozens of laptops: a "laptop farm".
- Salaries are paid into accounts the network controls.
To the employer, the worker appears to be logging in from a normal home in the right country. The FBI has also warned that some of these workers steal data, threaten former managers, or demand money after being fired.
Why it matters even if you are not a big company
Insider access is powerful. A new IT hire may get admin rights, source code, customer data or VPN access in their first week. If the person is not who they say they are, every security control you built can be quietly bypassed from the inside.
Checks that help hiring teams
The FBI stresses that no single warning sign proves fraud, and that clumsy filters can unfairly exclude genuine candidates, including people from other countries. Use layered, fair checks for everyone:
- Verify identity properly, ideally with a live video check and documents verified through an approved service, not just a scan sent by email.
- Hold at least one interview with the camera on, and ask natural follow-up questions about their past work and location.
- Ship equipment only to the verified address and be cautious if the delivery address changes at the last minute.
- Watch the technical signs: remote-access tools on a company laptop that nobody approved, logins from unusual networks, or several "different" employees sharing patterns.
- Apply least privilege: give new starters only the access they need, and increase it over time. See identity and access management basics.
Advice for job seekers
If someone offers to pay you to receive laptops, attend an interview or drug test in someone else's name, or let them "borrow" your identity for a remote job, say no. It is not an easy side income: people in the US have been arrested and charged for exactly this. Report the offer to the police.
Sources
Written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.