There are two versions of this problem. The dramatic one makes the news: organised identity fraud, state-run schemes, deepfaked interviews. The ordinary one costs far more buyers far more money: you interviewed a developer, approved them, and someone else is doing the work. Both have the same fix, and it is not a tool.
What’s Covered
The Dramatic Version
The best-documented case is the North Korean remote IT worker scheme: operatives using stolen or fabricated identities to take ordinary remote engineering jobs at companies worldwide, with earnings routed back to the state. A UN estimate puts it at $250-600 million a year. In July 2026 the FBI said it had found such a worker performing work for the US federal government.
The methods are more mundane than the headline suggests: borrowed or purchased identities, facilitators inside the target country who receive company laptops and appear on video calls, VPNs and remote administration tools, and in some cases one person holding several full-time jobs at once. In an August 2026 exercise, researchers set up a fake startup and hired three suspected operatives — finding forged documents, AI tooling and remote access in the process.
An identity-verification startup reported that patterns linked to the scheme appeared in 47% of the remote IT applications it flagged in 2026, up from 11% in late 2024. It is a company that sells verification, and “applications it flagged” is not the same as all applications. Treat the exact number with suspicion and the direction as real.
The Ordinary Version
Now the one that will actually happen to you. You interview a developer through an agency, you like them, you approve them. Three months later the commit style has changed, the stand-up answers have got vaguer, and the person you approved is “on another project this week”.
This is substitution, and it is rarely malicious. It is a capacity problem: the agency won more work than it can staff, so your approved senior quietly becomes a junior with the senior reviewing occasionally — or a subcontractor from another company entirely. You are still paying the rate you agreed for the person you met.
| What you were sold | What sometimes arrives |
|---|---|
| A named senior developer you interviewed | A junior with the senior “supervising” |
| The agency’s own employee | An undisclosed subcontractor or freelancer |
| One dedicated person | Someone split across three clients |
| The person on the interview call | A colleague who interviews well, for everyone |
None of these require a criminal. They require a vendor under pressure and a contract that never named anybody.
Why Interviews Miss It
A single interview is a weak instrument for this. It tests performance on one day, on a problem the candidate may have seen, with preparation you cannot observe. Worse, the signals buyers instinctively reach for are the wrong ones.
- Accent, camera quality and background tell you nothing. Plenty of excellent engineers have poor bandwidth; plenty of impostors have good lighting.
- A clean background check confirms an identity exists and is clean — not that the person on your call owns it. That gap is exactly what these schemes use.
- A strong technical answer proves someone in the room can code. It does not prove they will be the one coding.
What does work is consistency measured over time, which is why verification should not be a single event at hire.
Three Layers of Verification
| Stage | What to do | What it catches |
|---|---|---|
| Before hiring | Camera-on live problem solving on an unseen problem, with screen share. Government ID matched to the face on screen. | Proxy interviews, borrowed identities |
| At start | Confirm employment: company email domain, payroll or contract evidence, named individuals in the Statement of Work. | Undisclosed subcontracting, “resources” instead of people |
| Ongoing | Periodic re-verification, consistent faces in stand-ups, commit history that matches the person, access logs reviewed. | Silent substitution after month three |
Notice the third row. Almost every buyer does something at stage one and nothing afterwards — and substitution happens at month three, not week one. An identity check at hire says nothing about who is logging in half a year later.
Not accents — mismatches. An address that does not match the bank details, documents that disagree with each other, written English in chat that reads nothing like how the person speaks, or a developer who cannot discuss code they committed last week. Any one of these is worth a direct question.
The Thirty-Minute Call
If you do only one thing from this article, do this. Once a month, get the actual developer on a call — not the account manager — camera on, and ask about code they delivered in the last sprint:
- Why did you choose this approach rather than the obvious alternative?
- What was the hardest part, and what did you get wrong first?
- What would you change if you rewrote it today?
- Which part of this are you least confident about?
Someone who did not write the code cannot answer these, however well briefed. Someone who did will enjoy the conversation. It needs no tooling, no vendor, and no budget — and it catches both impersonation and quiet substitution in the same half hour. The same principle sits behind our 30-point vetting checklist: test the claim, do not read about it.
It is also the test we recommend for the other transparency question buyers now have — whether a human or a model produced the work. We wrote that up separately in are you paying for developers or for AI.
Contract Clauses That Help
| Clause | What it prevents |
|---|---|
| Named individuals in the Statement of Work | “Resources” being swapped without a conversation |
| Written approval required before any substitution | Silent downgrading of seniority |
| No subcontracting without consent | Your work passing to a third company you never vetted |
| Right to verify identity and employment on request | Impersonation surviving past onboarding |
| Exclusivity or declared allocation (e.g. full-time means full-time) | One person quietly serving three clients |
These sit naturally in a dedicated-team contract, which is one more reason that model gives you better visibility than a fixed-price project where you never learn who touched what — see fixed price vs time & materials vs dedicated team for how the models differ.
How We Verify Ours
Fair is fair. Here is our side, so you can hold us to it:
- Our developers are our employees, on our payroll, working from our office at the STPI campus in Jodhpur. We are not a marketplace matching you with freelancers we have never met.
- You interview the person who will do the work, camera on, and they stay named in the Statement of Work. Not “a senior Laravel resource” — a name.
- No substitution without your written approval. If someone leaves or is unwell, you are told, and you interview the replacement the same way.
- No undisclosed subcontracting. If a specialism we do not have in-house is genuinely needed, we say so and you decide.
- Direct access to the developer. Your channel, your stand-ups, your repository — no account manager relaying answers.
- You can verify employment and, if you are ever in India, visit the office and meet the team. Several clients have.
Those commitments are easy to write and easy to test — which is the point. Ask us for any of them during a trial week before signing anything longer. Rates and terms by market are on the hire developers pages, and the engagement mechanics are in our India outsourcing guide.
Frequently Asked Questions
How common is identity fraud in remote hiring?
Common enough to be standard in security reviews. A UN estimate puts the North Korean remote IT worker scheme at $250-600 million a year, and the FBI reported in July 2026 finding such a worker on US federal work. One verification vendor says scheme-linked patterns appeared in 47% of applications it flagged in 2026 against 11% in late 2024 — a vendor figure, so weigh the number carefully and the trend seriously.
What is a proxy interview?
Someone other than the candidate takes the technical interview — a stronger engineer off-camera, a different person on screen, or a facilitator in your own country appearing on video while the work happens elsewhere. The tell is rarely the call itself; it is inconsistency later, when the person cannot explain their own code.
Does a background check solve it?
Only partly. It confirms an identity exists and is clean, not that the person on your call owns it — which is the exact gap these schemes exploit. Keep background screening, but as one layer beside live verification and periodic re-checks.
What about agencies substituting people quietly?
More common than fraud and usually not malicious — a vendor with more signed work than staff. The protection is contractual: name individuals in the Statement of Work, require written approval before substitution, and prohibit subcontracting without consent.
Do I need identity-verification software?
Large remote-first employers hiring at volume increasingly do, and tooling for deepfake detection and periodic re-verification exists. For a company engaging a handful of developers through a vendor, contract terms plus the monthly call in section 05 cover most of the risk at no cost.
What is the single most useful check?
Thirty minutes with the actual developer, camera on, about last sprint’s code: why that approach, what broke, what they would change. Nobody can fake that conversation about code they did not write, and it catches impersonation and substitution at the same time.
The Short Version
If you read nothing else- Two problems share one fix: organised identity fraud, and quiet substitution by your vendor.
- UN estimate for one state-run scheme: $250-600 million a year.
- Accents and camera quality tell you nothing. Inconsistency does.
- A background check proves an identity is real, not that your caller owns it.
- Verify in three layers: before hiring, at start, and periodically afterwards.
- Substitution happens at month three, which is when nobody is checking.
- Name individuals in the SOW; require written approval to substitute.
- The monthly thirty-minute call with the actual developer catches most of it, free.
Want to test all of this on us?
Interview the developer who will do the work, ask for employment verification, and run a paid trial week before any longer commitment. We would rather you checked than trusted.
Start the conversation