How to tell if a candidate is faking their location

Before Tofu I spent four years at Relay, a banking platform for small businesses. In banking, you check where a customer is before you open their account. In hiring, location is mostly whatever the candidate types into the form.

So how do you tell if a remote candidate is faking their location? Line up every place they tell you they are (resume, application, LinkedIn, phone number, interview time zone) and look for contradictions. Then confirm it on the video call and again when you ship the laptop, the way the FBI's 2025 guidance on remote hires recommends.

Why does a candidate's location matter so much?

Two reasons. The boring one: you can usually only employ people in places where you're set up to pay them, so "remote, US only" is a real constraint for most teams.

The serious one is sanctions. The FBI says North Korean IT workers rely on people in the US, some knowingly and some not, who "provide a U.S.-based location for companies to send devices" (FBI public service announcement, July 2025). That lets a worker in a sanctioned country, North Korea most often, slip past the checks companies use to avoid hiring people they legally can't pay. Our post on what a sanctioned hire can cost walks through the per-paycheck math.

How do people fake where they are?

Three ways show up again and again:

• A VPN. Basically software that routes your internet traffic through a server somewhere else, so a website (or your ATS) sees that server's location instead of yours. Cheap, common, and used by plenty of real people for boring reasons.
• A laptop farm. The company ships a laptop to a US address. Someone at that address keeps it plugged in, and the actual worker connects to it remotely from overseas. In one case the Justice Department prosecuted, an Arizona woman hosted company laptops in her home so employers "would believe the workers were in the United States"; the scheme defrauded 309 US businesses (DOJ sentencing release, July 2025). We've mapped how these operations fit together in the hiring fraud supply chain.
• A stand-in. Someone who is in the right city takes the interviews. The FBI lists "attendance at virtual interviews and meetings" among the services facilitators sell, and some of those facilitators are people renting out their own names.

What checks can a recruiter run on a remote candidate's location?

Five, roughly in order of effort, cheapest first.

1. Line up every location the candidate gives you

Put these side by side: the address on the resume, the location on the application, LinkedIn, the area code on their phone number, the time zone they book the interview in, and where their school and past employers are. The FBI's own advice starts here: check contact details against "social media profiles, portfolio websites, and payment platforms."

But people move. They do, and one mismatch is usually nothing. A Toronto area code on someone who relocated to Denver last year means they moved. Three or four mismatches that don't add up to a coherent story are worth a second look.

If I could only do one check, I'd do this one, since it costs nothing and the data is sitting in your ATS. Tofu does a version of this automatically the moment someone applies, and flags location spoofers before the first interview is scheduled.

2. Look at the phone number

A lot of fake applications use VoIP numbers, which are internet phone numbers anyone can set up in minutes. That alone proves nothing (plenty of real candidates use Google Voice), so treat it as a reason to look harder at check 1, before you read anything into it.

3. Confirm it on the video call

The FBI recommends requiring video with an unobscured background, and having the candidate "point the camera out a window" to back up where they say they are. (It feels a little like a spy movie. They recommend it anyway.) The same notice suggests capturing images during interviews to compare against later meetings, because sometimes "an individual is employed to pass the initial interview" and someone else does the actual job.

4. Ship the laptop to the address on their ID

Straight from the FBI: send equipment "only" to the address on the employee's identification documents, and ask for more documentation if they want it sent somewhere else. They also recommend holding off on system access until the background check is complete.

5. Keep an eye on payroll

Compare payment accounts across employees and look for shared banking details, watch for people who change bank accounts often, and be wary of anyone who wants to be paid in crypto. These come from the same FBI notice, and they're your last chance to catch it after the hire.

Can you check every applicant's location by hand?

Not at any real volume. Say a remote role gets 300 applicants and these checks take 10 minutes a person: 3,000 minutes, or 50 hours per role, which is why most teams only run them on finalists.

By the finalist stage, the organized operations have planned for those checks. They bring a real US address (the facilitator's), a home internet connection (the laptop farm's), and a stand-in who can talk about the neighborhood.

The giveaway usually sits across applications. The same phone number, email or address turns up under different names, or the same IP pattern repeats from candidate to candidate, and one recruiter reviewing one candidate has no way to see it.

Back to banking for a second. A bank compares each new account against the ones on file, because a single application can look clean while the fifth one with the same phone number doesn't. Hiring mostly still reviews candidates one at a time.

That cross-application view is what Tofu is built for. We flag location spoofing at the application, check whether phone numbers and emails are reused across applications in our customer network, and alert you during interviews when a candidate is calling in from somewhere unexpected (how Tofu catches fake applicants), and your team still makes the call on every flag.

What should you do this week?

Run check 1 on your next five finalists for remote roles. At ten minutes each, it's under an hour of work, and the data is sitting in your ATS. If those five turn up more than you expected, that's the argument for checking every applicant instead of just the ones who reach the final round.