The short answer
Do three things. Check a government photo ID against a second document. Confirm the name matches the account you will pay. Hold a live video call and ask questions nobody could have rehearsed. Do all three before the offer, not after. The paperwork catches forged documents. The live call catches a stand-in. The payment check catches the case where the person on your calls is real, but the money goes somewhere else.
What changed this year
Two official documents are worth reading in full, and they are short.
The first is the joint alert issued on July 31, 2026. Twelve agencies signed it. The US State Department and FBI, plus agencies in Japan, South Korea, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand and the United Kingdom. It says these workers "impersonate nationals of other countries to obtain work and income." It says they now use "increasingly sophisticated methods, including the integration of AI, to obfuscate their identities."
The second is an FBI public service announcement from January 23, 2025, which put it plainly: these workers had been "observed using artificial intelligence and face-swapping technology during video job interviews to obfuscate their true identities." The same notice reported the same phone numbers and email addresses turning up on resumes that were supposed to belong to different applicants.
That is the part that changes how you hire. For twenty years, a video call was the check. Seeing a face was proof enough. It is not proof on its own anymore.
The warning signs, straight from the alert
The July 2026 alert lists signs for anyone hiring or buying services. Below are the ones that apply to a normal hiring process, in plain words, with what each one is telling you.
| What you notice | What it can mean |
|---|---|
| The name on the application does not match the name on the bank account | Someone else is receiving the money. The alert describes exactly this, with a third party taking a cut for the use of their account. |
| The profile reads like a machine translation of a language they claim to speak natively | The person did not write it. Worth noting that a translation tool can now produce clean text, so the absence of this sign proves nothing. |
| The video feed looks manipulated, or the ID does not match the face on the call | The alert lists photo ID mismatches and artificially generated video feeds as a specific discrepancy to watch for. |
| They will not get on video at all | Refusing a video meeting is on the list by itself. |
| The rate is well under the going market rate | Listed in the alert as a signal. It is also the oldest bait in remote hiring. |
| The person seems to change between calls | The alert says these workers often operate in teams, and who you speak to can depend on the time of day. |
| They ask to be paid in cryptocurrency, or into someone else's account | Both are named in the alert. A legitimate contractor almost never needs either. |
The name on the application does not match the name on the bank account
- What it can mean
- Someone else is receiving the money. The alert describes exactly this, with a third party taking a cut for the use of their account.
The profile reads like a machine translation of a language they claim to speak natively
- What it can mean
- The person did not write it. Worth noting that a translation tool can now produce clean text, so the absence of this sign proves nothing.
The video feed looks manipulated, or the ID does not match the face on the call
- What it can mean
- The alert lists photo ID mismatches and artificially generated video feeds as a specific discrepancy to watch for.
They will not get on video at all
- What it can mean
- Refusing a video meeting is on the list by itself.
The rate is well under the going market rate
- What it can mean
- Listed in the alert as a signal. It is also the oldest bait in remote hiring.
The person seems to change between calls
- What it can mean
- The alert says these workers often operate in teams, and who you speak to can depend on the time of day.
They ask to be paid in cryptocurrency, or into someone else's account
- What it can mean
- Both are named in the alert. A legitimate contractor almost never needs either.
One sign on its own is not an accusation. People have odd bank arrangements and bad internet. The alert makes the same point: it is when several of these show up together that you should stop and check properly.
Five checks you can run yourself
None of these need a vendor, a tool or a budget. They need someone on your side to actually do them.
- Ask for two documents, not one: A government photo ID, plus something else carrying the same name. Look at them yourself. The alert warns that these images often come from a third party living in another country. A clean scan is not the end of the question.
- Match the name to the money: Whoever you pay should have the same name as the person you interviewed. If you are asked to send payment to a different name, stop there and ask why. This single check catches the arrangement the alert describes most often.
- Keep the camera on and go off script: Ask about a job from five years ago, not the last one. Ask what the office was like, who they reported to, what the worst part of the role was. A proxy rehearses the recent history and the job description. They do not rehearse the boring middle of a career.
- Run a live task, not a take-home: Thirty minutes of real work, watched, beats a polished sample every time. It also tells you something a resume cannot, which is how the person thinks when they are stuck.
- Confirm it is the same person at every stage: Same face on the screening call, the technical call and the first day. Say out loud that you do this. Most of the people who would fail that check simply stop replying.
What this does not mean
I want to be careful here, because this subject gets used badly.
Nothing in that alert says a region is risky. It says identities are being stolen and invented. The scheme depends on posing as a national of somewhere else. So the country on the application is the part most likely to be false. Treating real workers as suspects because of it gets the lesson backwards, and it costs you good people.
The protection is not avoiding a country. It is knowing who you engaged, knowing where they actually are, and knowing that the person being paid is the person doing the work. That is true whether you hire in Bogota, Manila or Ohio. Weighing regions on the practical points instead? Nearshore vs offshore staffing covers the ones that matter, like overlap hours.
Where the low rate fits in
The alert lists a low rate as a warning sign. Two very different things look alike here, so it is worth pulling them apart.
A rate can be lower than a US rate for an honest reason. Cost of living is real. A fair wage in one country buys a very different life than the same number in another. That is most of what my clients are buying. A rate can also be lower because something is wrong. The person is not who they say. Or they get a small share of what you pay, and they will leave in three months. The two look the same on a price list.
The way to tell them apart is to ask where the money goes. Ask what the worker actually receives out of what you pay. An honest answer is easy to give. I wrote more about that in why a lower rate is not a lower standard.
When you hire through a partner
Hiring through a staffing company moves the verification, it does not delete it. That is worth being honest about, because plenty of firms in my industry imply otherwise.
It helps a lot when the firm engages and pays the person itself. A real company has checked the documents. Someone has spoken to the person live. They hold the agreement, and they send the money to an account with a name on it. If something is wrong, it is their problem before it is yours. It helps much less when the firm only forwards resumes. Then nobody has verified anything, and you are doing it alone with a middleman in the way.
So ask any agency three questions. Who verified this person's identity, and how? Has someone at your company spoken to them live, on video? Whose bank account does the money land in? Vague answers to those three tell you what you need to know.
How we handle it
For what it is worth, here is our side of it. We screen every person before a client ever sees them. On video, by someone on my team. We check identity. We run a background check. We test spoken English rather than take it off a resume. You sign one agreement with Remote Hero. We engage and pay the professional directly, and they work with your team. The money goes from us to a named person we have met. That closes the gap the alert spends most of its length describing.
We also stay involved after the placement. If something feels off in month two, there is someone to call who has a relationship with both sides. Our hiring and vetting process walks through every stage of it, and what we charge is on the site rather than behind a call.
Maybe you want to talk through a role. Maybe you have a candidate in front of you right now and something does not sit right. Either way, tell us what you are hiring for and we will give you an honest read. No obligation. No pitch if the answer is that you should just hire them yourself.
This is general information about hiring, not legal advice. Think you may have already hired someone under a false identity? Talk to a lawyer. Sanctions and employment rules can apply to what you do next.
