Remote hiring removed the one check that used to be automatic: a person walking through a door. What replaced it was a set of document checks designed for a different kind of fraud.
Why document checks no longer catch it
Identity verification asks whether a document is authentic and whether it belongs to a real person. Background checks ask whether records are held against that person's name. Both questions have honest answers in the cases we now see, because the identity has been lent or sold by its owner. A facilitator then operates it: sitting interviews, or coaching someone through them, and passing the work to people the employer has never heard of.
The motive varies. Some operations simply collect several salaries. Others want what the job gives access to: source code, customer data or payment systems. From the employer's side the two look identical until something goes wrong.
What these schemes cannot easily manufacture is a professional history. A real career leaves years of uneven, independently recorded traces. An assembled one has to be built quickly from parts, and the joins are visible in public sources.
Signals in the public footprint
1. Everything began at once
Professional profiles, code hosting accounts and portfolio sites all created within the same few weeks, shortly before the applications started. Careers accumulate. They do not launch.
2. A network with no depth
Hundreds of professional connections, none of whom worked at the claimed employers in the claimed years, and none of whom have ever interacted with the profile.
3. A photograph with no past
A profile image that appears nowhere else, at any age, in any setting, and that shows the smooth symmetry and inconsistent background detail of generated portraits. This is a lead and never a finding. Detection of synthetic images is not reliable enough to carry weight alone.
4. Activity in the wrong hours
Public commits, posts and replies consistently timed for a working day far from the claimed location. Suggestive only: shift work and scheduling tools produce the same pattern.
Signals in the work product
5. A copied portfolio
Repositories duplicated from another developer, with the authorship history rewritten to show the applicant's name. The original usually still exists, with an earlier date.
6. A portfolio shared with other applicants
The same projects, screenshots or writing samples presented by several candidates. One of them may be the real author. In a recent engagement, a genuine engineer was flagged for exactly this reason and turned out to be the victim.
7. Skills that do not match the trail
A resume claiming a decade in one technology, attached to public work that is entirely in another, or to none at all.
Signals in the claimed history
8. Employers that did not exist at the time
Companies dissolved before the claimed dates of employment, registered after them, or never registered in the claimed country at all. Corporate registries settle this in minutes.
9. Qualifications no register confirms
Degrees and certifications whose issuing bodies publish registers that do not contain the name. Absence needs care, because registers are incomplete and names are transliterated inconsistently.
10. A history that moved
Archived versions of the same profile showing different employers, dates or locations a few months earlier.
Signals across applicants
11. Shared referees and contact details
Several candidates whose referees answer on the same phone number, or whose own contact details differ by a single character.
12. Shared logistics
Equipment shipped to the same address for different hires, or payments for different contractors arriving in the same account. These records are held by the employer, not found in open sources, and they are usually what turns a suspicion into a pattern.
No single signal means anything
Every signal above has an innocent explanation, and most people who show one of them are exactly who they say they are. Privacy-conscious engineers have thin public profiles. People change their names. Employers are acquired and renamed. Good developers keep their work private.
We therefore weigh signals in combination and by type, in the same way our attribution standard requires independent lines of evidence.
| What we see | How we treat it | What happens next |
|---|---|---|
| One signal, any type | Not reportable | Nothing. The profile is consistent. |
| Two or more signals of the same type | Unresolved | Analyst review. Most are cleared at this stage. |
| Signals from two different types | Discrepancy, moderate severity | Reported to the adjudicator. The subject is asked to explain. |
| Signals from three types, or any cross-applicant link | Discrepancy, high severity | Reported at once. Access decisions are for the client. |
In one program covering 1,412 remote contractors, automated checks flagged 64 profiles. Analysts cleared 41 of them without the contractors ever being troubled. Of the 23 reported, 19 were confirmed as fraudulent and four were cleared once they had been asked. The case is described in Nineteen engineers who were not there.
Rules that keep screening fair
A screening program that honest people experience as an accusation will fail, and deserves to. These are the rules we work to.
- The subject knows. Checks are disclosed, and consent is obtained where the law requires it. We do not screen covertly.
- Only the role-relevant. We test the professional identity a person has presented. Health, beliefs, family, lawful political or union activity and private accounts are never examined or recorded.
- Everyone is checked the same way. Scope is set by the role and its access, never by a person's name, origin or nationality.
- A person, not a score, decides. Automated checks produce questions. An analyst reads each one before anything is reported, and the client's adjudicator makes the decision.
- The subject can answer. Material discrepancies are put to the person before any decision is taken.
When the signals point to a network
Cross-applicant links change the nature of the problem. Several identities that share referees, addresses or payment details are being run by someone, and removing them one at a time leaves the facilitator in place to try again under new names.
At that point the work becomes an investigation, with counsel involved. The facilitators advertise. Their services are offered openly on freelance marketplaces and forums under handles that also appear in the contact details of the profiles they operate. Identifying them protects every employer they are targeting, which is why these cases are usually referred to law enforcement.
The identity checks all passed, because the identities were real. The question that mattered was whether each one had a past that only its owner could have produced.