How do fake contractors get hired through staffing agencies?

When a contractor comes to you through a staffing agency, somebody else did the screening. You see a resume in a portal and run one interview, and the agency handles the background check and ships the laptop.

Fake contractors get hired in the gap between your checks and the staffing firm's. In one federal case, the staffing company itself was the fraud. In another, a real American passed every check while someone overseas did the work. The fix is to run contractors through the same identity checks as employees, and to ask your suppliers to show you how they verify the person.

How does a fake contractor get through a staffing agency?

In a typical contingent program, a hiring manager opens a request. Approved staffing suppliers (the agencies on your vendor list) submit candidates, usually through a vendor management system, which is basically the portal where contractor resumes and timesheets live. The manager interviews one or two people and picks one. The supplier employs the contractor, runs whatever checks its contract says it runs, and bills you by the hour.

Each step assumes the step before it checked the person: the supplier trusts the candidate's documents, and you trust the supplier. Nobody compares the face on the video call with the identity on the paperwork.

The cleanest example is a case that reached sentencing this spring. Erick Ntekereze Prince used his company, Taggcar Inc., to "fraudulently supply 'certified' IT workers to victim U.S. companies," knowing the workers were outside the US and working under false and stolen identities, according to the Justice Department's May 2026 sentencing release. He also hosted the client companies' laptops at homes in New York and put remote access software on them, so the workers looked like they were logging in from there. He got 18 months.

What does that kind of fraud cost the client?

Do the sum on that case. The victim companies paid the North Korean workers more than $943,069 in salary, and spent more than $1 million auditing and fixing their systems afterward. The cleanup cost more than the payroll.

Those totals cover the whole case, not just Prince. The January 2025 indictment charged him with four others and says the scheme got work from at least 64 US companies between 2018 and 2024. Prince himself was paid $89,000 for his part, which is not a lot of money to sell someone else's network access for.

There's a sanctions side too, and it's the part I'd worry about most. If the worker is North Korean, every paycheck can be its own violation, whether or not you knew. We did the per-paycheck math in what a sanctioned hire can cost.

Is it only North Korean IT workers?

No, though they're the best documented. Two other patterns show up in the public record, and neither needs a fake staffing company.

A real person fronts for someone else

Minh Phuong Ngoc Vong of Maryland got hired by at least 13 US companies between 2021 and 2024, per the Justice Department's December 2025 release. He sat the interviews himself and showed his own driver's license and passport. One company put him on a Federal Aviation Administration contract, and several of the others contracted his services out to other government agencies. The work was done by a man in China the department says is likely North Korean. Every identity check passed, because the identity was real. Our post on people who rent out their names covers this model in more detail.

The worker subcontracts the job

The FBI's October 2026 public service announcement says North Korean workers are getting jobs at western companies and then paying freelancers, "usually in Pakistan, India, Nigeria, or neighboring countries," to do the work for a fraction of the salary. They also pay freelancers to apply in bulk and to sit interviews for them. The same notice says they target cleared defense contractors and companies on US government contracts.

If you run a contingent program, contractor roles are one step removed from you to begin with. Add a subcontractor or a stand-in and the person doing the work can be three steps away from the person anyone verified.

Why don't your usual checks catch it?

Because most of them check the documents, and in a staffing chain the documents come from someone else.

A background check confirms that the identity the supplier gave you is real and clean. A stolen identity is usually both. (A synthetic one is built to look that way; here's how to tell the two apart.) The interview is often the only time you see the person, and it's short. And the laptop goes to whatever address the supplier lists, which in the Prince case was the fraudster's own home.

"But our supplier contract says they verify identity." Fair, and most suppliers do something, but you need to know what. The FBI's January 2025 guidance tells companies to "verify third-party staffing firms conduct robust hiring practices and routinely audit those practices." A clause in a contract doesn't tell you either of those things.

I'd also look at who owns the problem internally. Contractors often sit with procurement, not with talent acquisition or security, so the fraud checks you added for employees this year may never touch them.

What should you ask your staffing suppliers?

Ask for answers you can check. Here's the list I'd send every supplier on your program:

1. How do you confirm the person on the video call is the person on the ID? When, and who does it?
2. Do you check for the same resume, phone number or email showing up under different names? The FBI's January 2025 notice flags reused phone numbers, especially internet (VoIP) numbers, as a sign.
3. Do you subcontract any placements to another firm? If yes, who verifies identity at that firm?
4. Where do you ship equipment, and do you check that address against the worker's ID?

Then ask how often they audit themselves, and for a copy of the last one. A supplier that can answer the first four quickly is probably doing the work.

What can you check yourself before a contractor starts?

You don't have to rely only on the supplier. A few checks sit on your side of the handoff:

• Run contractors through the same fraud check as employees. If contractor submittals arrive outside your applicant tracking system, route them through the step where you check applicants, before the interview. Tofu flags suspicious candidates the moment they reach your ATS, and you can also turn it on later, pre-interview or pre-offer.
• Look at where they say they are. Phone number, time zone on the call, and the address on file should agree. Our guide to spotting a faked location has the checks.
• Ship your own equipment to the address on the ID, not to an address the supplier forwards.
• Watch the first weeks. The FBI recommends limiting who can install remote desktop software and checking for logins from several countries in a short window, two signs of a laptop farm.

It annoys me that none of these releases say how the client companies found out, since that's the detail that would tell us which of these checks catches it first.