Some hiring fraud gets past every background check for one simple reason: nothing in it is fake. A person agrees to let a stranger use their name, their documents, and sometimes even show up in their place. In return, they take a cut of the salary. In the North Korean IT worker schemes, this person is called a facilitator.
The setup is known as the collaborator model, and it is the kind of fraud a background check was never built to catch.
Theft and consent
These schemes need real U.S. identities, and they get them in two ways.
The first is theft. In the case against Kejia and Zhenxing Wang, the group took the identities of more than 80 Americans from background-check databases. They put those names on forged Social Security cards and driver's licenses. The real people had no idea.
The second is consent. Here the person agrees to help, and gets paid for it. This version works better, because there is a real person behind the name who can answer the phone and show up when asked. That person is the collaborator, and the whole scheme runs on them.
The economics of cover
It usually starts small and grows. At first, the collaborator just lends a name and a Social Security number so a worker overseas can apply. Then the company sends a laptop, so the collaborator gives a home address and signs for it. Next they install software that lets the worker log in from abroad while the connection looks local. A house full of these laptops is called a laptop farm.
From there it goes as far as the money allows. Some collaborators have gone to interviews, sat in offices to look busy, and even given urine and blood for drug tests, all so a worker on the other side of the world could pass as a local hire.
The pay is small next to what they help bring in. Christina Chapman ran a laptop farm from her home in Arizona for about three years. It sent $17.1 million to North Korea and touched more than 300 companies. Her own cut was about $177,000, and she was sentenced to 102 months in prison. Matthew Knoot ran a similar setup in Nashville. His workers were paid over $250,000, but his share was $15,100. He got 18 months. The math is the same in most cases: a worker can earn up to $300,000 a year, most of it sent back to the regime, while the collaborator keeps a little and takes on almost all the legal risk.
The making of a collaborator
Most collaborators are not real criminals. They are people who need money. Chapman had been a waitress. She was recruited on LinkedIn by a company she thought was a normal tech business, and she posted about her new life on TikTok, which later helped investigators build the case. In another case, three people pleaded guilty after lending their own names and hosting laptops for years. One was a college student picking up extra cash from a deal he probably did not really understand.
No one is told they are helping North Korea. They are offered a remote job that pays well and asks for little. Facilitators have now turned up in almost every U.S. state.
None of this is easy to catch, because none of it is fake. The name is real, the documents are real, call to check, and a real person answers, because that person agreed to lend their name.
The identity even outlives the person who lent it. After a collaborator is arrested or quits, their name often keeps showing up on job applications at other companies. So the real question was never whether the paperwork is real. It is whether the person who applied is the person who will do the work.
Paper can't tell you that. Tofu can. We verify the person behind the application, not just the documents, and we do it before the first interview. A real name and a clean record aren't enough to get through, because the one thing we check is whether the person who applied is the person who will do the work.
If you want to see what might be slipping through your hiring pipeline, come talk to us.
