North Korean IT workers apply for remote tech roles with stolen or invented identities, often posing as Europeans. Hiring teams can stop most of this with identity checks that happen outside the candidate's own paperwork, live interviews, and tight access for new hires until screening is done.

This hits hiring managers and CTOs first, because they sign the contract and hand out system access. It also hits honest remote developers, who will see more verification steps in the coming months. As a recruiter, I would rather explain those steps up front than apologize for them later.

They use false identities on recruitment, freelance and contracting platforms and present themselves as developers based in Europe or the US. Some work through local facilitators who do interviews, manage accounts and collect the salary. Then a share goes to Pyongyang.

A joint alert from eleven governments, including the Netherlands, says these workers impersonate nationals of other countries to get work and income through online platforms. The US government says the money supports weapons programs.

Dutch media have also reported that such applicants got through at Dutch companies while posing as European remote workers. How often this happens is unclear. The public data is thin, and nobody can say how many cases go unnoticed.

Cover companies in Western countries have reportedly opened accounts on popular job platforms for workers abroad. So a clean-looking profile with good reviews proves very little.

A fake hire is an insider threat. Authorities name data theft, cryptocurrency theft and theft of sensitive information as the risks. On top of that, paying a sanctioned person can cause legal trouble even if you never knew who you hired.

"North Korean IT workers pose an insider threat to companies" through data exfiltration, cryptocurrency theft and the theft of sensitive information, according to the multinational government alert.

The EU sanctions list keeps growing. On 12 October 2026 it added three individuals and four entities, bringing the total to 80 individuals and 25 entities, according to reporting on the latest measures. EU rules prohibit making funds available to listed persons and entities.

The US also sanctioned ten people and one entity over these employment schemes in late October. Governments are moving from general warnings toward action against the facilitators and the platforms.

For a Dutch employer, this combines recruitment, security, compliance and payroll. Those are four teams that rarely sit in the same room.

The clearest signals sit around the person, so look beyond the technical answers. The candidate can be strong on code and still evasive about location, previous employers or payment details.

The government alert lists several indicators: several accounts tied to the same ID document or IP address, a payment account in a different name, altered ID documents, refusal to appear on video, manipulated video feeds, below-market rates and requests for cryptocurrency.

From the recruiter side, I would add a few things to watch:

• A profile claims a European location, but language or working hours point elsewhere.
• The CV has generic wording, inconsistent dates or machine-translated text.
• The candidate seems coached, or someone else seems to answer.
• Several candidates share similar CV text, contact details or references.
• The candidate asks for equipment or salary to go to a third party.

No single flag proves anything. A shy candidate with a bad webcam is not a spy. A pattern of three or four is a reason to slow down.

Treat "based in Europe" as a claim you verify. Check identity through a reliable procedure, compare details across CV, contract, payroll account and delivery address, and contact former employers using contact details you found yourself.

The US government also recommends in-person meetings where possible and shipping company equipment only to an address that matches the ID documents.

In our Delivery Sprint, this fits into steps we already run. The intake agrees on what the role needs. Sourcing is done by senior recruiters who talk to every candidate. Interviews are live and repeated, with a spontaneous technical conversation instead of a rehearsed one. A fake profile has a hard time surviving three live conversations with people who know the market.

After the hire, keep access small at the start. Give new remote hires limited credentials and no production, source-code or secrets access until screening is complete. Then watch for logins from inconsistent locations, odd working hours, remote desktop tools and the same IP address across supposedly unrelated employees.

Finally, make sure HR, legal, security and sanctions compliance know who does what if something looks wrong. That route should exist before the first incident.

Roles with deep system access get screened hardest. Think infrastructure, cloud and platform work, for example an infrastructure software engineer or an Azure architect. These people touch production, credentials and customer data, so a fake hire does the most damage here.

For honest developers, the effect is more friction. Expect ID checks, reference calls that you cannot steer, and maybe a meeting in person. That is a normal price for a market where profiles can be forged.

For companies, screening costs time and money. It is still cheaper than an unchecked remote hire with access to sensitive systems. Sanctions exposure, investigation costs, lost intellectual property and reputational damage add up quickly.

Fast hiring makes the problem worse. When a team is under pressure to fill a seat, checks get skipped. That is where a boutique approach helps, because we only put forward people we have actually spoken to and who fit the role. For senior profiles such as a senior software engineer, a slower and more careful process is normal anyway.

One caveat. The public numbers on how many fake workers get hired in the Netherlands are limited. Anyone who gives you an exact percentage is guessing.

Fake remote workers are a mix of recruitment fraud, sanctions risk and insider threat. Verify identity independently, run live interviews, keep early access limited and agree internally who acts on a red flag. None of this is rocket science, it just has to be done every time.

If you are hiring for a role with deep system access and want a second pair of eyes on your process, we are happy to talk it through. If you are a developer, expect more checks and ask a recruiter how they handle them. A good one will have an answer.

1. Alert to Countries, Companies, and Other Entities Regarding ...
2. U.S. sanctions 10 people, one entity over N. Korean IT schemes
3. Noord-Koreaanse it’ers doen zich voor als Europese thuiswerkers - Computable.nl
4. BNR vindt cruciale ASML-videoband terug - Computable.nl
5. Need help?
6. Joint Statement on Democratic People's Republic of Korea (DPRK) Sanctions

Written by our AI, read by a flesh-and-blood recruiter.