The person you interview may not be the person you hire. Remote interviewing has become an entry point for impostors, proxy candidates and state-backed operators. One fraudulent hire isn’t a recruiting miss: it’s credentials, access to sensitive data, a payroll relationship and potentially a sanctions event.
- 4 in 600: remote interviews showed indicators consistent with North Korean (DPRK) IT worker operations (imper.ai Threat Research, Q1 2026)
- 1 in 4: candidate profiles worldwide are predicted to be fake by 2028, and 6% of candidates already admit to interview fraud (Gartner)
- ~$800M: generated for the North Korean regime in 2024 by IT workers using false identities to get hired (U.S. Department of the Treasury)
What we see in live interviews
- Proxy candidates: one person interviews, a different person shows up to work
- Hidden operators: remote-control tools such as AnyDesk, and off-screen coaching steering the candidate in real time
- Masked infrastructure: VPNs such as Astrill, multi-hop proxies and locations that don’t match the CV
- Operator handoffs: the face stays the same between rounds while the device, network and behavior change
Why it matters
- Insider access on day one: engineering, operations and contractor roles touch customer data, payment systems and production code
- Sanctions exposure: paying a DPRK-linked worker can trigger OFAC and other sanctions issues; IEEPA civil penalties reach the greater of $377,700 or twice the transaction value, per violation
- Regulatory and operational resilience: hiring controls are part of the access-control story regulators and auditors expect organizations to evidence
- Wasted recruiting capacity: recruiter and interviewer hours spent on candidates who were never real
The control gap
Background checks and ID verification confirm a document, once. They don’t confirm that the human in the interview is genuine, unassisted, and the same person across every round and at onboarding.
How imper.ai closes it, without changing how recruiters work
- Before the first live interview. Connects to your ATS and interview flow, so risk surfaces in the very first interaction
- Across every round. Correlates signals between interviews to catch operator handoffs and material changes, with an explainable risk score
- Into enrollment. Carries hiring risk into device, MFA and credential enrollment before workforce access is activated
Sources: imper.ai Threat Research Q1 2026 (600 remote interviews; indicators included Astrill VPN, AnyDesk, multi-hop proxies and location inconsistency). Gartner candidate survey of 3,000 candidates and 2028 prediction. U.S. Treasury statements on DPRK IT worker schemes (2024 revenue). OFAC enforcement guidance on IEEPA civil penalties. Penalty figures are illustrative context, not legal advice.
