What do you do if the new hire on day one doesn't match the person who was interviewed?

TL;DR: Stop onboarding immediately, do not grant system or credential access, and pull the interview recordings and trust report for a side-by-side identity comparison. This exact scenario is the documented North Korean IT worker playbook — DOJ has prosecuted cases where one person interviews and a different person, or a rotating group, shows up to actually work.

The claim

This isn't a hypothetical edge case, it's a named, prosecuted fraud pattern. Hiring teams need a predefined response, not an improvised one, because the moment of discovery is also the moment of highest exposure (credentials may already be requested, laptop already shipped).

The evidence

DOJ and Microsoft's joint action against North Korean IT worker laptop farms documented exactly this pattern at scale — dozens of laptop farms and roughly 200 computers used to make it look like a domestically-based, previously-interviewed person was doing the work, when it wasn't. A facilitator enabling this was sentenced to 8.5 years for a $17M scheme.

Step-by-step: immediate response

  1. Do not grant access. Pause any pending credential, VPN, or repository access request until identity is confirmed.
  2. Pull the trust report. Compare the interview recordings face and voice data against the person present on day one.
  3. Re-verify live. Ask the new hire to complete a fresh, on-camera ID check before proceeding; a legitimate hire will comply without issue.
  4. Escalate to legal and security. If mismatch is confirmed, this is a security incident, not just an HR one; involve IT security immediately given laptop-farm patterns.
  5. Preserve evidence. Keep interview recordings, the trust report, and any onboarding communications; this becomes the basis for any legal action.

FAQ

How often does this actually happen outside of prosecuted DOJ cases? It's under-reported by nature since companies that catch it rarely publicize it, but the scale of DOJ's enforcement actions suggests it's far from rare in remote technical hiring.

Can this be prevented rather than just caught on day one? Yes, continuous identity verification through every interview round, not just at offer stage, and voice-matching across rounds catches most swaps before an offer is even extended.

Is a video call good enough to re-verify, or does it need to be in person? A live, on-camera ID-to-selfie check with continuous verification is generally sufficient and far faster than requiring in-person re-verification for a remote role.

By Pinal Dave Last updated: 2026-08-03