“Anthony of Staten Island” said that he had developed a discussion tool for Meta. His whole identity was false.

• An identity verification supplier and fraud tools has recently been targeted by what seems to be several North Korean IT workers managing dozens of characters. The flow of curriculum vitae to the solution for software development positions has all experiences in brand technological companies such as Amazon, Google and Netflix. It turns out that they were all false.

“Anthony of Staten Island” had a polished set of identification titles and said that he had previously worked on Meta Platforms. During a zoom interview for a senior software engineering work, the supposed New Yorker was charming and articulated while he was talking about creating a key chat application in the social media giant of $ 1.6 Billion of dollars.

During the first 20 minutes, everything went well. Anthony smiled, naturally hired and delivered polished answers to the questions. Then everything changed.

“What was the most striking is that he was really affable,” recalls Rivka Little, director of growth of Socure. “You can see 100% why people would become a victim of this.”

When the interview has reached more complex questions in two parts that required an additional explanation, Anthony lost its place. He seemed more pulled and less certain, little said Fortune.

Socure thinks that Anthony was a North Korean IT worker, who is part of a sophisticated And insidious criminal organization consist of Trained technologists of the Democratic People's Republic of Korea (RPDC). THE IT workers from RPRC Use American, real or manufactured identities, and apply for remote jobs American and European Companies.

The program was a massive Successful success. Hundreds of fortune companies 500 have unintentionally hired thousands of IT workers from the RPDC, and the IT team sends its wages to the authoritarian chief Kim Jong Un. Kim uses money to finance the country's mass destruction weapons program. The regime generates between $ 200 and $ 600 million per year, according to United Nations estimatesand the IT workers of the RPDC collaborate with highly qualified agents responsible for flight Billions of crypto cries.

The program is so omnipresent that some founders of technology have used the demand of potential candidates to insult Kim before moving on to an official interview. The IT workers of the RPDC are constantly monitored and insulting the supreme chief of the regime would lead to serious sanctions.

The threat is quickly on a scale. This year, Kim has doubled the required gain quotas of workers' delegations and launched a new artificial intelligence unit called Research Center 227 to support cybercrime initiatives of the country, according to research from the security company Dtex.

Red flags, changing tactics

Socure is advertisement His experience with Anthony to alert other companies on new warning panels and also to avoid the traps of too restrictive hiring practices that could make the most difficult for legitimate job seekers. The challenge is that fraudulent candidates are qualified and some are very charming, little explained.

“Anyone can fall into these interviews – he has succeeded very well for a long time,” said Little.

Some of the indicators on which companies count will not work in the long term, she warned. For example, Anthony gave a surname that sounded Italian and he claimed to come from Staten Island. During his interview, however, he had an accent that did not line up with his original story.

“People come in all kinds of packages,” she noted. Superficial shades should not be used to eliminate candidates. And while IT workers from the PDR tend to use stereotypical Western names, if they slightly changed their diagram and used names that were correlated with their accents, these signs would disappear.

More revealing, she said, were the inconsistencies of Anthony's digital imprint. Many curriculum vitae made to Socurs in recent months had big marquee names that have brought them out. Google, Meta, Amazon and Netflix were often included and the candidates claimed to have been responsible for the most innovative and interesting products of these companies. A quick check with certain internal staff who worked at Meta during the time that Anthony claimed to be there revealed that no one knew him.

Another flag was the immaturity of Anthony's digital identity. His email address and phone number had been connected to his name for only a few weeks. Usually people have telephone numbers and email addresses linked to them going up for years, she noted. And despite a LinkedIn profile corresponding to its work history and displaying the “open to work” banner, Anthony did not have much with connections, publications or likes on the platform. It was unusual for someone with a vast technological experience.

However, the last thing that a company should do is create more friction and drama that would make things more difficult for legitimate candidates, she said. In addition, although the scam by North Korean IT worker creates risks for job companies, there are many inverted diets that target job seekers. A woman contacted Socure and told the company that she had been interviewed for a job by a false HR person and scammed over thousands of dollars after providing her name, her identifier and her bank details thinking that she had been hired.

This creates the need for a delicate balance, little said. Companies must protect themselves from fraudulent hiring, but cannot create as many frictions as legitimate candidates have too much trouble applying for a job.

Few things have suggested that companies integrate passive identification verification into their HR platforms to verify the identity in the background without requiring initial identification of candidates. Careful interview techniques that have surveyed for scripted responses or the use of AI in the middle of the conversation and digital imprint indices can also help reveal fraudulent job seekers.

“I have almost never seen such an intersection of fraud, money laundering and violations of sanctions,” said Little. “It's a perfect storm.”

This story was initially presented on Fortune.com