North Korean IT Workers: What the FBI's October 2026 Warning Means for Remote Hiring

On October 13, 2026, the Justice Department and the FBI acted together against North Korean IT workers who get hired into U.S. remote jobs under stolen American identities. DOJ announced an Ohio indictment charging 14 people in a scheme that reached more than 70 U.S. employers, and it disclosed Operation Lonestar Roundup, in which the FBI searched more than 40 suspected laptop farms in Texas and seized about 187 laptops and KVM devices. The FBI published a new public service announcement for employers the same day. The charges in the indictment are allegations, and every defendant is presumed innocent until proven guilty.

For HR at a remote employer, the first defense against a hire using a stolen identity is the Form I-9, completed with E-Verify on a live video call, and the FBI now names both in its guidance. The I-9 tells you whether the documents reasonably appear genuine and belong to the person on camera, but it doesn't tell you where that person lives, and that's the gap these schemes are built on. Location checks have to run beside the I-9 as their own step. If you're new to remote document review, our remote I-9 verification page explains how it works.

What DOJ announced on October 13

The Ohio case covers 2019 to about July 2025. According to the indictment, the workers applied with "stolen or fabricated identity documents," used VPNs and proxies to look like they were working inside the United States, and relied on U.S.-based helpers who hosted company-issued laptops at their homes and installed remote-access software on them. The scheme brought in about $3 million. Two U.S. nationals, one from Pennsylvania and one from Texas, were arrested, while ten of the defendants are based in China and two remain under seal.

DOJ's list of victim employers goes well beyond tech, covering health care, communications, cyber support, retail, and manufacturing across Ohio, 16 other states, and the District of Columbia. If you hire remote staff for work done on a company laptop, your industry label won't keep you off the target list.

The October actions sit on top of a run of cases from the past six months.

All of it falls under the DPRK RevGen: Domestic Enabler Initiative, a joint effort of DOJ's National Security Division and the FBI that also announced actions in June 2025, November 2025, April 2026, and May 2026. The new PSA says the workers are paying more Americans to help them, including to appear on camera, sit in job interviews, verify fraudulent identities, and keep company laptops online from their own homes.

What the FBI now tells employers

The October PSA says these workers "cannot be identified reliably with a single indicator" and asks companies to use what it calls identity in depth, meaning layered checks and "continuous identity verification throughout employment." HR should read one line in it twice.

"Using E-Verify, requiring a U.S. passport, multiple forms of identification, or live verification can raise friction for ITWs."

E-Verify and live verification fit inside the I-9. Requiring a passport and requiring several forms of ID run straight into the I-9's anti-discrimination rules, which we cover below. The PSA also says the workers often buy accounts from identity verification providers to test whether a stolen identity will pass a background check before they apply, so a clean background check doesn't settle the question.

The FBI warns against overcorrecting, too. Relying on ban lists or filtering out names tied to these workers "can be unreliable, block qualified applicants," and can hurt the people whose identities were stolen, and the PSA says aggressive controls carry "unusually high risks of generating false positives" against legitimate employees.

The most hands-on steps are still the ones in the FBI's July 2025 PSA:

• Meet in person when you can, such as an in-person drug test or fingerprinting, "to verify identity and claimed location."
• On video, ask for an unobscured background, have the person point the camera out a window, and ask about their claimed location and the location on their ID.
• Ask them to wave a hand in front of their face, which can make AI-generated video glitch.
• Capture images you can compare against later meetings, because sometimes one person passes the interview and someone else does the job.
• Ship a laptop only to the address on the employee's identification documents, ask for more documentation if they want it sent somewhere else, and hold system access until the background check is done.

What the I-9 checks, and what it doesn't

Every employer already runs an identity checkpoint on every hire. Within three business days of the start date, you or your authorized representative examine the original documents the employee chooses and decide whether they reasonably appear genuine and relate to the person presenting them (M-274, Section 4.0). E-Verify then checks the I-9 information against government records.

Remote hires can do this over video if you're enrolled in E-Verify and in good standing. Under the DHS alternative procedure, you examine copies of the documents (front and back), hold a live video call where the employee presents those same documents, check the alternative-procedure box in Section 2, and keep clear copies on file.

E-Verify photo matching is the strongest identity check inside the I-9. When the employee presents a U.S. passport, passport card, Permanent Resident Card, or Employment Authorization Document, E-Verify displays the photo the government has on file, and you compare it with the photo on the document (E-Verify User Manual 2.2.2). It only runs when the employee happens to choose one of those four documents, and E-Verify's rules say you can't ask them to.

Read the right-hand column as a list of what the FBI keeps describing. A hire can show genuine documents on camera and still be working from somewhere other than the address in Section 1, while a paid helper in another state receives the laptop.

"The remote employers who call us usually aren't worried about fake IDs," says Jed Butler, CEO of i9 Intelligence. "They're worried about a real ID on a person who said they lived in Florida and turned out to be somewhere else, and they find out after day one, once the laptop has shipped. We tell them to run the I-9 well and put the location check right next to it."

Put a trained reviewer on the video call

Our US-based compliance team meets your remote hire on a live video call inside our own platform, completes Section 2, and runs the E-Verify case, including photo matching. Your hiring manager doesn't have to judge documents through a webcam, and every review comes from a team with 28 years in I-9 and E-Verify work. It requires E-Verify enrollment and is billed at a flat price per hire. See how remote I-9 verification works, or compare options in our remote I-9 verification cost guide.

Location checks sit beside the I-9

The FBI's laptop rule is the most useful location check a remote employer has, and it works best as its own onboarding step. Federal rules limit what the I-9 and the document copies attached to it can be used for. Under 8 CFR 274a.2(b)(4), they may be used only to enforce immigration law and a short list of federal fraud and perjury statutes, so don't pull a shipping address off the license copy in someone's I-9 file.

Collect address proof for equipment separately, under a written equipment policy that applies to every remote hire in the role. The FBI says to ship only to the address on the employee's identification documents and to ask for more documentation when they want delivery somewhere else. A U.S. passport doesn't show an address, so the policy should say what address proof you'll accept from everyone.

Some employers want a person physically present at the address the hire gave. For them, our nationwide notary network can send a mobile notary to the employee's address to complete Section 2 in person as your authorized representative. You remain liable for any I-9 violations an authorized representative commits on your behalf (I-9 Central), and our guide to notaries and the I-9 explains how that role works.

One M-274 rule shapes how you mix video and in-person review. An employer that offers remote document examination at an E-Verify hiring site has to offer it consistently to everyone at that site, though it may limit remote examination to remote hires, and it can't decide some employees aren't eligible because of citizenship, immigration status, or national origin (M-274, Section 4.5). Choose video or in-person by a written rule that covers the whole hiring site, and stick to it.

Where extra checks turn into discrimination

The FBI's list includes requiring a U.S. passport and multiple forms of ID, and for the I-9 you can't do either. The employee chooses which documents to present from the Lists of Acceptable Documents, and once they present a valid List A document you don't ask for List B or List C (M-274, Section 4.0). E-Verify employers may require only that a List B document carry a photo (E-Verify User Manual 1.5).

The INA's anti-discrimination provision treats asking for more or different documents than the I-9 requires, or refusing documents that reasonably appear genuine, as an unfair documentary practice when it's done with intent to discriminate. The Justice Department's Immigrant and Employee Rights Section (IER) says employers can't, on the basis of citizenship, immigration status, or national origin, "request more or different documents than are required," reject reasonably genuine-looking documents, or specify certain documents over others (IER FAQ). The civil penalty for unfair documentary practices currently runs $236 to $2,364 per person affected (28 CFR 85.5), and the worker may also be entitled to back pay.

The FBI's own description of the workers is where well-meaning HR teams get into trouble. The PSA says they often claim to be Chinese or East Asian nationals who need a temporary U.S. presence, or Eastern Europeans displaced by the war in Ukraine. IER's guidance is that an employer can't apply different levels of scrutiny to documents based on a worker's citizenship, immigration status, or national origin, so giving applicants who fit that description a harder look creates the exact false-positive problem the FBI warns about. Give every remote hire in a role the same steps and the same scrutiny.

The FBI's May 2024 PSA suggests asking for in-person or other reliable verification when the E-Verify check produces an error. E-Verify's rules still govern that moment. A mismatch doesn't mean the employee lacks work authorization, the employee gets notice and a chance to resolve it, and you can't take adverse action because of a mismatch unless the case ends in a Final Nonconfirmation (E-Verify User Manual 1.5).

The FBI also recommends continuous identity verification during employment, which is a job the I-9 can't do. E-Verify is for new hires, and outside federal-contractor rules you can't create a case for anyone hired before you enrolled. Reverification in Supplement B covers expiring employment authorization only, and you never reverify a List B identity document. Ongoing checks belong with IT and security, such as watching for remote-access tools and KVM devices on company laptops and comparing the person on later video calls with the images captured at hiring.

A hiring checklist for fully remote employers

1. Enroll in E-Verify and create a case for every new hire at the hiring site no later than the third business day after they start work for pay.
2. Complete Section 2 on a live video call where the employee shows the same documents they sent copies of, and check the alternative-procedure box.
3. Let the employee choose their documents, and complete photo matching whenever E-Verify prompts it.
4. Run the FBI's location questions during the interview, with an unobscured background, the camera pointed out a window, and questions about the claimed location. Keep any images you capture out of the I-9 file.
5. Ship equipment only to an address verified under your written equipment policy, and hold system access until the background check clears.
6. Decide by a site-wide rule whether hires complete Section 2 on video or in person at their address.
7. Report suspected activity to your local FBI field office and at ic3.gov.

The same documents and deadlines show up in an ICE inspection, so it's worth reading what changed in ICE's August 2026 I-9 fact sheet alongside this checklist.

Frequently asked questions

Does E-Verify stop North Korean IT workers?

It raises the bar, which is why the FBI lists it. E-Verify checks the I-9 information against government records and, for four List A documents, compares the document photo with the one on file, but a stolen identity belongs to a real person whose records can match. Pair it with a trained live document review and location checks outside the I-9.

Can we require remote hires to show a U.S. passport?

Not for the I-9, where the employee picks from the Lists of Acceptable Documents. E-Verify employers can only require that a List B document have a photo, and asking for specific documents based on citizenship or national origin is an unfair documentary practice under 8 U.S.C. 1324b.

Does the I-9 prove where a remote employee lives?

No. Section 1 asks for the employee's address, but nothing in Section 2 verifies it, and several List A documents carry no address at all. Verify location separately, for example by shipping equipment only to a verified address or by having someone meet the hire in person at the address they gave.

Can we do the camera-out-the-window check during the I-9 video call?

We'd keep it in the interview, since the Section 2 call is for examining documents, and running location questions in the interview means every candidate gets them the same way, before you've made an offer and started the I-9.

What should we do if we suspect a current employee?

Contact your local FBI field office and file a complaint at ic3.gov. The FBI asks for any street address that received a company device, the person's identifiers (names, emails, phone numbers, bank accounts, IP addresses, professional networking accounts), and any images, messages, or documents that might show who they really are.

Questions about remote hiring and the I-9?

Call (713) 668-6200 (Mon–Fri, 8 AM – 5 PM CT), email support@i-9intelligence.com, or submit a ticket. To talk through your remote hiring process with our compliance team, book a free compliance call.