Nineteen engineers who were not there: exposing a remote hiring fraud network

The situation

An enterprise software company relied on 1,412 remote contractors, most engaged through three staffing agencies. Its security team noticed that one contractor's laptop had been delivered to an address that did not match his profile, and that remote-control software was running on it around the clock. His manager added that he had never appeared on camera.

The agencies had checked identity documents and run background checks. Everything had come back clean. The security team suspected the documents were genuine and the person behind the keyboard was not.

The question

Was this one case or many? If many, who was actually doing the work, and how were they organized? And how could 1,412 people be checked without treating every one of them as a suspect? The work was commissioned through outside counsel, and all contractors were told that identity integrity checks were being carried out under the terms of their agreements.

What we did

A screening lead, three identity analysts, an investigator and a language specialist worked the matter. A reviewer who took no part in the checks confirmed every discrepancy before it was reported.

1. Agreed the scope in writing

With counsel, we limited the checks to professional identity: the career, credentials and work samples each contractor had presented. Private accounts, family and anything unrelated to the role were out of bounds, and analysts were instructed not to record them.

2. Screened every profile the same way

Aldervane Screen ran three tests on all 1,412 profiles: whether the public footprint was consistent with the claimed career, whether portfolio work was original, and whether claimed employers had existed and traded at the time. It flagged 64 profiles for an analyst to read.

3. Looked for innocent explanations first

Analysts cleared 41 of the 64. A thin online presence is not evidence of anything, and the common explanations were mundane: a change of name, employers that had been acquired, work kept in private repositories. That left 23 profiles with material discrepancies.

4. Found the seams

The 23 shared features that honest profiles rarely do. Portfolio repositories had been copied from other developers days before the application, with the authorship history rewritten. Professional networking profiles had been created inside the same six-week window. Several profile photographs showed the artifacts of synthetic generation. Claimed employers had been dissolved before the dates on the resume.

5. Connected them to each other

Records the client and its agencies held, shared under counsel's direction, tied the profiles together. Nineteen of the 23 had been paid into just seven accounts. Their laptops had gone to five delivery addresses. Their referees answered on three phone numbers.

6. Identified the facilitators

The same contact handles appeared on freelance marketplaces advertising "interview support" and "profile rental", and on a forum offering ready-made contractor accounts. Two of the five delivery addresses matched the public business registrations of one of those sellers. In all, four facilitators were operating the nineteen identities. Two could be named. Two were identified only as personas.

7. Tried to break it

The reviewer argued that these were unrelated people who had used the same resume-writing service, which would explain the similar wording and templates. A writing service does not explain shared payment accounts or shared delivery addresses. For two of the nineteen the links were thinner, and we reported them at moderate confidence.

What we found

• High confidence: 17 contractor identities were operated by a network of four facilitators.
• Moderate confidence: two further identities belonged to the same network.
• High confidence: two facilitators identified by name, through business registrations and marketplace accounts.
• Cleared: four of the 23 contractors with material discrepancies gave explanations that the evidence supported.

The outcome

We reported eleven days after tasking. The client's adjudicators interviewed each of the 23 before acting.

• All nineteen identities lost access within 48 hours of the report.
• The client's own review found that three of the accounts had copied source code outside approved systems. Counsel referred those findings, with our report, to law enforcement.
• About $2.9M a year in contractor fees stopped flowing to the network.
• The client renegotiated its agency contracts to require identity integrity checks before access is granted.
• Every new remote contractor, about 600 a year, is now screened before a laptop is shipped.

What made the difference

Document checks ask whether an identity is real. These identities were. The question that exposed the network was whether each identity had a history that only its owner could have produced, and whether several identities led back to the same hands.

It mattered just as much that 45 flagged contractors were cleared. A screening program that cannot tell a quiet professional from a fabricated one will not be tolerated by the people it screens, and should not be. The signals we used are described in The candidate who is not there.