Verifying that a remote hire is who the file says they are

On 23 July 2024, KnowBe4 disclosed that it had hired a North Korean IT worker who used a stolen US identity. It had held four video interviews and run a background check before issuing the new hire a laptop. Its monitoring software flagged an attempt to load malware soon after the laptop arrived.

In its incident FAQ, KnowBe4 said its security tools blocked the malware from running and its team quarantined the laptop. New hires received access to the company’s platform only after onboarding. This employee had not reached that stage.

This is identity fraud, not conduct risk

Most hiring safeguards are built to answer a question about behavior. They look for undisclosed convictions, exaggerated qualifications, gaps in employment and conflicts of interest, all of which assume that the person being examined exists and is the person in the interview.

KnowBe4 said its background check returned a clear result for the stolen identity. The question for an employer is how to connect the person on the call with the individual whose records it has checked.

In a separate case, the US Department of Justice announced an indictment on 23 January 2025. Prosecutors alleged that a scheme involving five defendants obtained work from at least 64 US companies between April 2018 and August 2024, and that payments from ten of them generated at least $866,255. They described US residences where company laptops were hosted to disguise the workers’ locations.

Remote onboarding removed checks nobody had listed

Distributed hiring is settled practice, and the argument here is not against it. What is worth being precise about is exactly which checks were lost when onboarding stopped happening inside a building.

Somebody used to hand over a laptop in person. Somebody witnessed the original documents rather than a scan. New joiners were seen by dozens of colleagues in their first week, in a setting where an inconsistency would have been noticed without anyone being assigned to look for it. None of that was ever written down as a control, which is why none of it appeared on a list when it disappeared.

What verification actually requires

The distinction that matters is between documents the candidate supplies and facts established independently of them. Screening that relies on the former can only confirm that a story is coherent.

• Confirm the employment history through independently obtained contact details. A supplied reference contact is part of the candidate’s submission. An employer reached through its published number can help verify whether the referee worked there and knew the candidate.
• Verify credentials at the issuing institution. A certificate is an artifact, and artifacts are straightforward to produce convincingly.
• Check a material claim about the person’s history. An employer or qualification issuer may be able to corroborate a specific claim. A limited public record leaves the question open.
• Clarify a discrepancy about location. If the shipping address differs from the agreed work location, ask for an explanation and verify the delivery arrangement before sending equipment.

For senior appointments this is the ordinary territory of executive background investigations, where the expectation is already that findings are sourced rather than collected. The change worth making is applying a proportionate version of the same logic further down the organization, because the access granted to a mid-level engineer is frequently broader than that granted to a director.

The exposure is access, not payroll

Read as a fraud, the loss is a salary paid to somebody not entitled to it, which for most organizations is an irritation rather than a crisis.

Issuing credentials on the strength of an unconfirmed identity creates an access risk. At KnowBe4, the onboarding policy limited what the employee could reach, and monitoring on the laptop alerted the security team to the attempted installation.

That is the reason this belongs alongside cybersecurity rather than in a human resources process. The hiring decision is the point at which access is granted, and it is the only point at which the question can be asked cheaply.

The question for a board

Take the last ten fully remote hires and establish, for each, which facts were confirmed with a source the candidate did not nominate. Where the answer is none, the organization has verified a set of documents rather than a person.

The second question is about proportion. Access, rather than seniority, should determine how much verification a role attracts, and most organizations have those two things the wrong way round. Our Book of the Month shelf has How Spies Think, which is useful here for its treatment of how analysts test what they are being told rather than how much of it they collect.