Fake IT Worker Scheme

What the scheme is and why it works

A fake IT worker scheme is a recruitment fraud that exploits trust in hiring, onboarding and remote work. The impostor may present convincing documents, pass interviews through proxies, and use the first days of employment to obtain salary payments, credentials or internal access before the deception is detected.

The fraud works because organisations often optimise for speed in hiring and provisioning. When identity checks are weak, the scheme can blend into normal contractor or remote-worker onboarding, especially if the candidate has a plausible role, a remote setup and a pressure to move quickly into productive work.

Common operating patterns

These schemes usually combine several signals rather than one obvious failure. False identity documents, synthetic or stolen credentials, proxy interviews, mismatched geography and repeated requests for remote onboarding are all common elements. In many cases the impostor aims to collect salary, but access to systems can become the more valuable objective once trust is established.

That combination makes the scheme more than a simple payroll scam. It is also a control-bypass problem, because the attacker is trying to enter the organisation through legitimate business processes and then inherit the access that would normally be granted to a real worker.

Security implications for hiring and access

Fake worker schemes create exposure across identity proofing, access governance and insider-risk controls. The most dangerous moment is often the transition from candidate to active user, when account creation, device enrolment, and application access can happen before a robust human review is complete. NHIMG’s Contractor Identity Lifecycle Guide is useful here because it explains how non-employee identities should be sponsored, time-bound and removed outside the HR flow.

For hiring teams, the issue is not only whether the person is real, but whether the organisation is issuing access on the assumption that the person is real. The same risk shows up in remote work environments where a strong candidate can still be a front for a different operator behind the scenes. NHIMG’s Home Office and Remote Worker Security Guide helps frame how remote onboarding, device trust and identity proofing intersect.

When the fraudulent worker is trying to create or reuse online personas to support the application, the technique often sits alongside broader account-creation abuse patterns. NHIMG’s MITRE ATT&CK T1585 Establish Accounts guide is a relevant companion because it shows how attacker personas, email accounts and cloud accounts can be used to support the deception.

Detection, response and recovery

Detection should look for inconsistencies across recruitment, collaboration and endpoint data, not just one suspicious interview. Repeated use of proxy services, unusual login geography, rapid changes in contact details, failed proofing attempts, and activity that starts before normal onboarding milestones are all useful indicators. Once suspicion rises, organisations should preserve hiring records, access logs and device evidence so they can reconstruct how the person entered and what they touched.

If the fraud is confirmed after access has been granted, the response must treat it like a compromise event, not merely a personnel issue. That means disabling accounts, revoking sessions, rotating secrets where needed and reviewing whether the impostor used the position to create persistence or lateral access. NHIMG’s Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes) is especially useful for the containment and revocation side of that response.

Risk and Threat Considerations

Fake IT worker schemes are dangerous because they convert a normal hiring path into a trusted access path. The damage can range from payroll loss to credential theft, persistence inside internal tools, or broader compromise if the impostor is given privileged access too early.

Failure mechanism: The organisation authenticates the wrong person, then allows that person to inherit legitimate access, devices and workflows before the deception is exposed.

Impact: Attackers can steal salaries, harvest credentials, abuse internal trust, maintain long-lived access and create insider-like exposure that is harder to detect than external intrusion.

Practitioner Guidance

Why practitioners should care: This is a governance problem as much as a fraud problem. HR, security, IT and managers all need a shared ownership model for identity proofing, sponsor approval, account creation and offboarding so that no single team assumes someone else has already validated the hire.

What to watch for: Be alert to pressure for fast onboarding, reluctance to use standard video or in-person verification, repeated changes in contact details, and any request to shortcut device or access checks. Those are often the earliest signs that the worker’s claimed identity and the operating identity are not the same.

Related resources from NHI Mgmt Group

• Who is accountable when a fake worker gains access and causes damage?
• What are the signs that an illicit IT-worker revenue scheme is operating through exchange deposit addresses and intermediary wallets?
• Why are fake worker campaigns so dangerous after onboarding?
• Who should own fake worker risk in an organisation?