When a laptop leaves your warehouse for a remote worker's home, the delivery address, the courier and the first sign-in become security controls, and attackers have learned to exploit every one of them. US prosecutors have described laptop farms where company laptops shipped to a stolen identity's address were operated remotely by overseas workers, and unreturned kit after a leaver is a quieter but common loss of data and access. This guide covers the physical and identity chain of custody for remote staff devices: ordering and enrolment, shipping, receipt and first sign-in, monitoring while in use, and recovery. It is for IT operations, endpoint, HR operations and security teams who run remote hiring. Fraud detection during hiring is covered in the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes); device wiping between users in the Device Reassignment and Reimaging guide. Platforms are listed alphabetically.
Key takeaways
- The shipping address is an identity attribute. The FBI advises shipping equipment only to the address on the employee's identity documents and requiring extra verification for any other address.
- Ship sealed, enrol automatically. Zero-touch enrolment means a device configures itself under management on first boot, so nobody needs to handle it before the user and it cannot easily be taken out of management.
- Bind the first sign-in to verified identity. Release the initial credential only after the user confirms receipt through a separate, verified channel.
- Watch for farm signals. Unapproved remote access tools, several managed devices on one residential network and location mismatches are the indicators that matter.
- Recovery starts at shipping. Prepaid return kits, tracked serial numbers and a lock-then-wipe sequence keep unreturned laptops from becoming open access.
The threats along the device journey
| Stage | Threat | Primary control |
|---|---|---|
| Order and staging | Device sent before identity checks finish; tampered or pre-configured stock | No shipment until screening is complete; buy through channels that register devices for zero-touch enrolment |
| Shipping | Redirect to a facilitator address; interception or theft in transit | Ship to the verified identity address; tracked delivery with signature; tamper-evident packaging |
| Receipt and first sign-in | Someone other than the hire signs in; credential sent in the box | Out-of-band receipt confirmation; credential released separately after verification |
| In use | Laptop farm: device hosted at one address, operated remotely from abroad (ATT&CK T1219 Remote Access Tools) | Application control blocking unapproved remote access tools; network and location analytics |
| Recovery | Kit not returned after leaving; device sold or kept with cached data and tokens | Return kit, lock then wipe, sign-in revocation, asset status tracking |
In the case set out in the US Department of Justice release of August 2024, victim companies shipped laptops to a US address in the name of a person whose identity had been stolen. The facilitator signed in to the laptops and installed remote desktop software so that workers abroad could use them while the employers believed the employee was in Nashville. The companies reported more than $500,000 in auditing and remediation costs. Each step in that chain was a logistics decision: where to ship, who signed in first and what software was allowed to run.
Ordering, staging and enrolment
- Gate the order on screening: the FBI's July 2025 public service announcement advises not granting system access until the background check is complete. Make "screening complete" a required field in the device order workflow, not an email from HR.
- Register for zero-touch at purchase: buy from suppliers who register device serial numbers or hardware identifiers to your tenant, so the device enrols itself on first boot.
- Apple: Automated Device Enrollment in Apple Business Manager lets the management service hold a device in Setup Assistant until critical configuration and apps are installed. Apple documents that a supervised device cannot be unenrolled by the user, and that admins can stop users removing the enrolment profile. On macOS 14 or later, Setup Assistant can require FileVault.
- Microsoft: Windows Autopilot turns the supplier's Windows installation into a business-ready device; the user connects to a network and verifies credentials, and the device joins Microsoft Entra ID and enrols in Microsoft Intune or another MDM automatically. Microsoft states that auto-enrolment needs a Microsoft Entra ID P1 or P2 subscription.
- Record the serial against the person: before dispatch, update the asset record with serial number, assigned user, shipping address and tracking number. See the Asset Inventory and CMDB Security Guide.
Where zero-touch is not available, for example a contractor's region your supplier does not serve, stage the device in-house, seal it in tamper-evident packaging and record the seal number with the serial.
Shipping securely
| Decision | Lower-risk option | When to accept the alternative |
|---|---|---|
| Destination | Address on the identity documents used in screening | A different address only after extra documentary verification, recorded with approver |
| Who ships | Supplier ships direct, sealed, zero-touch registered | In-house dispatch where suppliers cannot reach the region |
| Delivery | Tracked, signature on delivery, no safe-place drop | Collection from a courier depot with photo ID, for hard-to-deliver addresses |
| Credentials | Never in the box; released after receipt is verified | None |
| Packaging | Plain outer box, tamper-evident seal, no company branding | Branded packaging only for office deliveries |
The FBI advice is direct: ship laptops and equipment only to the address on the employee's identification, and if a different delivery address is requested, require additional documentation. Treat late requests to change the address, freight-forwarding addresses and addresses already associated with another employee's device as red flags that go to security, not just to the shipping desk. A simple check of new shipping addresses against existing asset records catches the case where several "employees" share one house.
Receipt and first sign-in
- Confirm receipt out of band: the hire confirms arrival and the seal number through a channel already verified during hiring, such as a video call with the hiring manager who interviewed them.
- Release the first credential: issue a one-time, short-lived credential (for example a Temporary Access Pass in Microsoft Entra ID) only after that confirmation, and have the user register phishing-resistant MFA on the device straight away.
- Bind the device: confirm the device that signs in is the serial you shipped to that person, using the device record in your MDM and identity provider. See Entra Device Identity and the Apple Declarative Device Management and Managed Device Attestation Guide.
- Check compliance before access: conditional access should require a compliant, managed device before corporate apps open.
The FBI also suggests capturing images of individuals to compare across meetings, because the person doing the work may not be the person interviewed. A short video check at receipt, with the same manager, is a practical place to do this.
Monitoring while in use
A laptop farm looks normal to the identity provider because the device is managed, compliant and signs in from the expected country. The signals are on the endpoint and the network.
| Signal | Where to see it | Response |
|---|---|---|
| Unapproved remote access or remote desktop software installed or running | EDR, application inventory, application control logs | Block by default; investigate any attempt. See the RMM Tool Security Guide |
| Several managed devices for different users sharing one public IP or home network | Identity provider sign-in logs, MDM network data | Correlate with shipping addresses; escalate to security |
| Keyboard and mouse activity patterns consistent with remote control, or hardware KVM devices | EDR telemetry, USB device logs (ATT&CK T1200 Hardware Additions) | Investigate; verify the user by video |
| Sign-in locations or VPN exit points inconsistent with the shipping address | Identity provider, VPN logs | Re-verify identity and location |
| Device offline for long periods, then reappearing on a new network or country | MDM last check-in, EDR | Lock pending contact |
Recovering devices
- Plan the return at dispatch: keep a prepaid return label and packaging process ready so the leaver has no cost or effort barrier.
- Revoke access first: NIST SP 800-53 PS-4 calls for disabling system access, revoking authenticators and retrieving organisational property on termination. Disable the account and revoke sessions and tokens at the leaving time, whatever the device status. See the Employee Offboarding Security Guide.
- Lock, then wipe: send a remote lock as soon as a return is overdue; wipe once you have decided data does not need preserving for an investigation. Keep the device enrolled so it is still managed if it reconnects.
- Escalate unreturned kit: agree a timeline with HR and legal, for example reminder at 7 days, lock at 14 days, formal recovery at 30 days (NHI Mgmt Group suggested timings), and mark the asset as lost so it cannot be re-enrolled elsewhere without review.
- Suspected fraud: do not ask a suspected fraudulent worker to return the device to an address they choose; recover it through a trusted courier and preserve it as evidence.
- Inspect on return: check the serial and seal record, look for added hardware, then follow the reimaging process before reuse.
Lost or stolen devices in transit or in use follow the Lost or Stolen Device Response Checklist.
Implementation and decision guidance
- Map the current process: who orders, ships, records serials, sends credentials and chases returns. Most gaps sit at hand-offs between HR, IT and procurement.
- Add the two cheapest controls first: ship only to the verified identity address and never put credentials in the box.
- Pilot zero-touch: one region or one hiring team, with in-house staging as rollback if enrolment fails.
- Turn on detection: application control for remote access tools in audit mode, then enforce after reviewing approved tools.
- Close the loop: report monthly on returns outstanding and shipping exceptions.
Small organisations: a shared tracker of serial, person, address and tracking number, a video receipt check and remote lock through your MDM cover most of the risk. Large organisations and those hiring contractors through third parties: the FBI notes that contracted workers from third-party vendors carry extra risk, so put these requirements into staffing agency contracts as well.
Detection and measurement
- Verified-address shipping rate: share of shipments sent to the screened identity address, and number of address exceptions approved.
- Zero-touch coverage: share of new devices enrolled automatically on first boot.
- Credential separation: share of first sign-ins using a credential released after receipt confirmation.
- Remote access tool attempts: blocked installations of unapproved remote access software per month.
- Recovery rate: share of leaver devices returned within 30 days, and number of devices marked lost.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PS-3 Personnel Screening | Complete screening before shipping and access |
| NIST SP 800-53 Rev 5 | PS-4 Personnel Termination | Revoke access and retrieve property on leaving |
| NIST SP 800-53 Rev 5 | CM-8 System Component Inventory | Serial, owner and location for each device |
| NIST SP 800-53 Rev 5 | AC-19 Access Control for Mobile Devices | Managed device requirements for remote use |
| NIST SP 800-53 Rev 5 | MP-6 Media Sanitization | Wipe before reuse or disposal |
| NIST CSF 2.0 | PR.AA-02, ID.AM-01 | Identities proofed and bound to credentials; hardware inventory |
| MITRE ATT&CK v20 | T1219, T1200 | Remote Access Tools; Hardware Additions |
Common failure patterns
- Shipping wherever the new hire asks: a changed address with no verification is the step facilitators rely on.
- Password on a sticky note in the box: whoever opens the box owns the account.
- Device ships before screening finishes: start dates pressure IT to dispatch early, so the background check no longer gates anything.
- Remote access tools allowed by default: without application control, a facilitator can install remote desktop software in minutes.
- Wiping instead of locking first: an immediate wipe on a suspected fraud case destroys evidence.
- No owner for returns: HR assumes IT chases kit, IT assumes HR does, and laptops stay with former staff for months.
Practitioner checklist
- Block device orders until screening is recorded as complete.
- Ship only to the address on verified identity documents; approve exceptions with extra evidence.
- Use zero-touch enrolment so devices enrol, supervised, on first boot.
- Use tracked, signed delivery and tamper-evident seals, and record serial and seal numbers.
- Release the first credential separately after out-of-band receipt confirmation.
- Block unapproved remote access tools and alert on shared networks across users.
- Revoke access at leaving time, lock overdue devices, then wipe once evidence needs are clear.
- Write these controls into contracts with staffing agencies supplying remote contractors.
Standards and references
- FBI IC3: North Korean IT Worker Threats to U.S. Businesses (I-072325-4-PSA)
- US Department of Justice: Justice Department disrupts North Korean remote IT worker fraud schemes
- NIST: SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- Apple: Automated Device Enrollment and device management
- Microsoft Learn: Overview of Windows Autopilot
- MITRE ATT&CK: T1219 Remote Access Tools
Related NHI Mgmt Group resources: Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes) · Device Reassignment and Reimaging · Travel Security Policy Template · Employee Offboarding Security Checklist