If your business hires remote workers, how much do you really know about them? Did you require each individual to go into an office for interviews, screening, or to pick up materials? Do you track where you send laptops or phones? In many instances, fraudulent remote workers appear to be model employees, making these schemes particularly hard to detect. Just this month, DOJ announced coordinated actions resulting in the seizure of more than 180 computers from more than 70 US companies, and last summer, it announced the sentencing of two US nationals who helped North Korean remote IT workers pretend to be US residents in order to obtain work at US companies.
Key Takeaways
- Remote hiring creates opportunities for impersonation fraud. Fraudulent applicants may use AI-generated deepfakes to appear to be legitimate US-based workers.
- Know who you are hiring and where they are working. Employers should incorporate identity verification into remote hiring and onboarding and pay attention to red flags, including reluctance to appear on camera or in person and requests to ship company technology to an unexpected address.
- Limit access and strengthen internal controls. Companies should restrict remote-access tools, review cybersecurity safeguards, conduct appropriate background checks, and maintain incident response procedures in case fraudulent activity is identified.
- Address the risk across functions, not in silos. HR, IT, cybersecurity, legal, and other relevant teams should coordinate hiring practices, technology controls, employee policies, and incident response to address both the employment and cybersecurity aspects of impersonation fraud.
Impersonation fraud in the workplace is a serious threat that can cause severe disruption, damage, data breaches, and theft by bad actors on a global scale. When combined with digitally manipulated audiovisual imagery, often created with the help of AI (“deepfakes”), the risks are compounded. In cases involving fraudulent job applicants and employees, the FBI, FTC, and other enforcement agencies frequently become involved.
According to the recent indictment mentioned above and the associated DOJ release, for approximately six years, fake foreign workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks, and proxy infrastructure to appear as though they were US persons working from within the United States. These individuals were aided by facilitators based in the US who received and hosted multiple laptop computers at their residences. These computers were issued by victim US companies that thought they had hired legitimate workers.
Some of the warning signs of fraudulent remote workers include refusing to appear on camera, consistently having a reason to avoid going in person to an office, and requesting that company-issued technology (phone, computer, etc.) be shipped to a different location than their primary residence.
The following practices may help avoid hiring a fraudulent remote worker and mitigate the risks if it does happen:
- Require a candidate to appear on camera without a virtual background or to appear in person for interviews.
- Require a candidate to hold their identification up to their face and turn it from side to side if a virtual interview is necessary.
- Refuse to send any technology to a location other than the worker’s primary address.
- Reduce the number of approved remote access tools to a handful of vetted and secured options.
- Develop sound practices for hiring and onboarding new employees, including background checks.
- Create red-flag rules in your HR and cybersecurity systems. For example, are multiple people using the same address for payroll or shipping technology?
- In conjunction with HR and IT policies, internal controls, and cybersecurity training, maintain robust incident response mechanisms.
The workplace is one of the most vulnerable points of access for impersonation fraud and AI-generated deepfakes. While the threat from this particular scenario may pass, bad actors are hard at work developing new schemes, fueled by advances in AI. Businesses need to be vigilant in mitigating these risks by coordinating oversight among Data Privacy and Employment counsel, HR, Finance, and IT.
McCarter’s Labor & Employment and Cybersecurity & Data Privacy teams work together to help businesses address the risks posed by fraudulent remote workers and other threats. For more information, contact the authors of this alert or the McCarter attorney with whom you work.