Interviews you about the role, how you found the person and what they'll reach, then builds your own before-you-sign checklist for remote hires, an email to your staffing firm and the warning signs to watch for.
You're going to help me build my own checklist for verifying a remote hire or contractor before I sign, so I don't end up paying someone working under a fake identity. Facts to work from: Microsoft Threat Intelligence reported on October 29, 2026 that North Korean state-backed groups, including one that poses as remote workers, use AI to write résumés and interview answers, help with coding assessments, alter photos, video and voice, and keep several fake personas consistent. Microsoft says staffing companies are the easiest way in. Its vetting advice: see the person on camera across several video calls and treat camera or microphone problems that block participation as a red flag; check that names, addresses and dates match across the résumé and background check; call references by phone or video, not email only; confirm a real phone number (not VoIP), a residential address and social media accounts; check the phone number isn't shared with other profiles and the profiles aren't near-copies of someone else's; and search whether the same identity works at several companies. The FBI says no single sign reliably identifies these workers, and that aggressive controls can wrongly flag honest people. Rules: - Ask me one question at a time, numbered, and wait for my answer before asking the next. - When you offer choices, label them with letters (a, b, c). - Don't invent facts about my business, my candidate or any law. If you need something I haven't told you, ask instead of assuming. - Don't give legal advice. If a step touches employment law or background-check rules, tell me to confirm it with my lawyer or HR provider. - Never treat a person's accent, name, nationality or country as a warning sign. Every check must apply the same way to every candidate. - Never ask me for passwords, ID numbers or a candidate's personal documents. Ask these, in this order: 1. What kind of remote role is this? a) Software, IT or website work b) Bookkeeping, finance or admin c) Customer support d) Marketing, design or content e) Something else 2. How did I find this person? a) Through a staffing firm or agency b) Through a freelance marketplace c) A job board, directly d) A personal referral 3. What will they be able to reach? Pick all that apply. a) Email and shared documents b) Customer or employee personal data c) Bank accounts, payments or invoices d) Our website, code or servers e) I'm not sure yet 4. Will I send them a company laptop? a) Yes b) No, they'll use their own device c) Not decided 5. Which checks do I already do? Pick all that apply. a) A video interview b) Reference checks c) A background check d) An ID check e) None of these 6. How many remote people do I bring on in a typical year? a) One or two b) 3 to 10 c) More than 10 7. Who handles IT and access for us? a) Me b) Someone on my team c) An outside IT company Then give me: - A short checklist in three parts: before I make an offer, before I sign, and the first 30 days. Scale it to the access I described in question 3, and keep it to things I can do myself. - If I found them through an agency or marketplace, a short, polite email asking what identity checks they ran, ready to send. - Five warning signs to watch for after they start, in plain English. - One line on what to do if something doesn't add up, including that suspected North Korean IT workers can be reported to the FBI at ic3.gov. End with one line that begins "Start with:" and names the single most important check to add this week.