When the Person Who Shows Up Isn't the Person Who Applied

TL;DR

• We've encountered the activity firsthand. Our recruiting records surfaced connections to two separate Department of Justice (DOJ) investigations involving North Korean IT worker schemes.
• One identity, three applicants. Our internal investigation uncovered overlapping phone numbers, resume similarities, inconsistent employment histories, and suspicious document metadata.
• Someone else showed up. We sent an interview invitation to a candidate, but someone other than the expected candidate joined the meeting. 
• Don't let a fake hire become a real insider risk. A fraudulent candidate who makes it through the hiring process could gain legitimate access to company systems, sensitive data, and intellectual property, exposing the business to security, operational, and compliance risks.

We've seen hiring fraud in our own recruiting pipeline

Hiring fraud is something we've been tracking closely at Pindrop. But recently, our own recruiting activity gave us a firsthand look at just how sophisticated these operations have become.

Between August 31 and September 23, 2026, one candidate identity submitted as three applicants to Pindrop.

When we looked closer, we found a collection of signals that raised concerns:

• The phone carrier and registration details didn't align with the candidate's stated location.
• The same phone number appeared on applications associated with multiple candidates.
• Two resumes closely matched 11 other resumes in our applicant pool.
• Document metadata identified authors and editors other than the candidate.
• Job titles and employment dates at the same companies changed between resume versions.

This was a pattern across applications, contact information, and documents, not just one isolated inconsistency.

Then, we found something else. An email account tied to the candidate's identity appeared on a Department of Justice list, identifying accounts associated with an alleged North Korean IT worker operation.

And the story didn't end with the applications.

The person who joined the interview wasn't who we expected

The person who joined the meeting was not the individual we expected based on the recruiting process.

This happens all the time in a typical hiring workflow. A recruiter reviews an application, schedules an interview, sends a calendar invitation, and welcomes someone into a virtual meeting. The assumption is that the person joining is the person who applied. But what happens when that assumption is wrong?

This is exactly the type of activity the FBI has warned employers about. North Korean IT workers have used AI tools to appear on camera, participate in interviews, and help secure employment under someone else's identity.

The tactics aren't limited to stolen resumes or AI-generated interview responses. Sometimes, the person applying and the person interviewing are entirely different people.

Confirming that someone can join an interview is not the same as confirming they are the person who applied.

Our recruiting records surfaced another federal investigation

On October 28, 2026, the Department of Justice announced that a defense contractor employee with an active Top Secret security clearance had pleaded guilty to helping foreign individuals secure remote employment using his identity and the identity of another person.

According to the DOJ, applications connected to the scheme resulted in nine job offers from U.S. companies. When we reviewed the announcement, we went back through our own applicant records. We found two applications from 2025 tied to identities connected to the case.

These aren't isolated tactics. Federal investigations have exposed schemes involving stolen identities, U.S.-based laptop farms, third-party interview stand-ins, and workers accessing sensitive company information after securing remote positions.

These operations are designed to get past the hiring process and into the organization, and they’re becoming increasingly common. In our own analysis of 2026 applicants, about 1 in 47 showed indicators consistent with potential North Korean connections, compared with roughly 1 in 343 in a similar analysis the year before.

This is bigger than hiring fraud

Hiring fraud may seem like a Talent Acquisition problem, but the consequences are much bigger. 

A fraudulent candidate who successfully secures a position can become an employee with legitimate access to company systems, sensitive information, intellectual property, and internal resources.

The October 28 case illustrates the potential consequences. A defense contractor employee with an active security clearance was involved in helping fraudulent applicants obtain remote job opportunities. Other federal cases have documented North Korean IT workers accessing sensitive, export-controlled information.

The risk also extends beyond direct employees. Organizations rely on international contractors, staffing agencies, and outsourced service providers. How much visibility do they have into the people actually performing that work?

A company may have vetted a vendor, approved a contract, and authorized a team. But are the people doing the work actually the people the organization approved?

Instead of ensuring candidates have the right qualifications, organizations now need to confirm the person behind the application is the one who performs the work.

Identity has to follow the entire hiring journey

To address this, the FBI recommends an approach called identity in depth, emphasizing layered detection and verification throughout the employment lifecycle. That means connecting signals across the process rather than relying on a single background check, resume review, or interview.

Organizations need visibility into:

• Application: Who is submitting the application, and are their contact and identity details consistent?
• Resume review: Are there patterns across applicants, repeated information, or suspicious document similarities?
• Interview: Is the person participating in the meeting the person who applied? Are there signs of synthetic or manipulated audio and video?
• Onboarding: Is the person receiving equipment and credentials the same person who completed the hiring process?
• Employment: Is the authorized individual actually performing the work?

No single check solves this problem. It requires collaboration between Talent Acquisition, HR, IT, and Security.

When someone shows up for an interview, do you know who they really are?

At Pindrop, our focus is helping organizations establish trust in real-time interactions. By analyzing audio and video signals, we help organizations identify potential identity risks and better understand who is actually participating in a meeting.

Because the person who applies should be the person who interviews. The person who gets hired should be the person who shows up to work.

And organizations need a way to know the difference.

Pindrop Pulse^Ⓡ extends identity verification throughout the candidate journey to help organizations detect fraudulent candidates before they're hired and granted access to the business. To learn more, talk to a real human or explore our hiring solutions.