Hired a fake remote engineer? What to do in the first 72 hours

What to do if you hired a fake employee: don't confront them, and don't fire them yet. Contain first. Revoke their access in one sweep, preserve the evidence, check your sanctions and data-breach exposure with counsel, and only then end the engagement. The person still holds real credentials while you read this, so the order of the steps matters more than their speed.

This is an incident, not an HR problem. It's written for a CTO or VP Engineering who has just found that the identity or the work doesn't match, and it starts at "they're on payroll with access". Preventing it is a separate job, covered in how to catch fake candidates before an offer goes out and in the wider guide to vetting software developers.

First, confirm and decide which kind of case you have

Be sure before you act. Some suspicious signals have innocent explanations: a developer on a VPN, a laptop at a relative's address, a sloppy CV. A CV exaggeration is an HR matter. Someone working under a stolen name is not.

Two branches matter, and they differ mainly at the reporting step.

In ordinary proxy or credential fraud, someone other than the person you interviewed does the work, or a real identity was borrowed to pass checks. You have a security incident, a possible data breach and possibly a crime, which is a question for counsel. Sanctions law usually isn't in play unless there's a sanctions nexus.

The North Korean IT-worker pattern is the other branch. The UK's Office of Financial Sanctions Implementation (OFSI) says in its advisory on North Korean IT workers that it's "almost certain" UK firms are being targeted. The indicators are practical ones: pay routed to an account or name that doesn't match the employee, hardware sent to an address not listed on the IT worker's ID documentation, and remote-access tools installed on company hardware. If you see those, treat it as the sanctions branch until counsel says otherwise.

Whichever branch you're on, steps 1 to 4 are identical.

How to respond in the first 72 hours

1. Form a small group and don't confront the person

Name a group of four or five: your security lead, counsel, the CTO or VP Engineering, and someone from finance. Engage counsel first, then bring in HR. Keep the circle small and keep the person's manager out of it if they work closely together. Nobody mentions it to the engineer, in a call or in chat.

The advice you'll find isn't consistent. The Security Alliance's framework for North Korean IT workers says "Do not fire them immediately": pause payments, revoke access, collect evidence and audit the code, then terminate and report. Purdue Global Law School's guidance on fake workers leans the other way, telling employers to immediately terminate the person's employment and cut off all access.

Our position, and it's a judgment: contain quietly, then terminate on counsel's advice. Firing on the spot gives a hostile insider a warning and a window, and you lose the chance to see what they touch in the hours before you cut them off. Confronting a person who's using a stolen identity makes it worse: they get time to destroy evidence, and you've told them what you know.

2. Revoke access in one sweep

Do it in a single coordinated pass, not account by account over a week. Work from a list, because the person you're locking out knows exactly what they hold and you probably don't.

Start with the access list you wrote on day one, which should double as your revocation list. Then check it against reality, since access accumulates. Cover:

SSO and email
VPN and any remote-desktop tools
cloud consoles and IAM roles
git hosting, including personal access tokens and deploy keys
CI/CD systems and their stored credentials
package registries
API keys and SSH keys issued to them
shared password-manager vaults

Ask one question of each system: what could this person actually do here? A read-only seat on production logs is a different problem from a maintainer role on your build pipeline. Write the answer down, because step 4 depends on it.

3. Preserve evidence before you wipe anything

Quarantine the laptop. Don't reimage it, don't "clean it up", and don't let the person ship it back unwatched if you can avoid it. If it's company hardware sitting at some remote address, counsel should decide how it's retrieved.

Export logs for the person's whole tenure, not the last week. Identity provider sign-ins, VPN logs, git audit logs, cloud audit trails, CI run history and mail metadata all have retention windows, and those are often short. Extend retention or snapshot them now. Keep a note of who handled each item and when, so the chain of custody holds if law enforcement or a lawyer asks for it later.

KnowBe4's published account of its own fake hire is the useful benchmark here. Its security tooling flagged the new Mac, and the device was contained within about 25 minutes. KnowBe4 also found that the hire was "a real person using a valid but stolen US-based identity", and that malware had been loaded on the machine it shipped. Containing the device quickly was the right move, and the device itself became evidence.

4. Audit their work and rotate every secret they could read

This is the step page-one guidance skips, and it's the one an engineering leader owns. Using the access answers from step 2, review everything the person could have touched:

Every commit and merged pull request, including changes approved by a single reviewer.
Added or changed dependencies, lockfiles and build scripts.
CI/CD configuration, pipeline steps and any new service accounts or webhooks.
Anything that could carry a backdoor or exfiltrate data.

The Security Alliance framework sets the audit scope as dependencies, CI/CD build files and possible backdoors, and that's the right instinct even though its framing is crypto and US-centred. Our judgment is to assume anything the person could read is compromised: rotate those secrets, not just the ones you've seen used. If you've done rotating shared credentials before for a departing engineer, this is the same discipline with a worse assumption about intent.

Rotate after you've cut access, and in an order that doesn't break production. Expect it to take longer than the revocation.

5. Stop payments and check the sanctions position with counsel

Pause pay. Then ask counsel the sanctions question before another payment goes out.

Whether sanctions apply depends on a sanctions nexus, and only counsel can decide that. A fake hire with no connection to a sanctioned jurisdiction doesn't trigger sanctions law. But if there's a North Korean link, the UK exposure is serious. OFSI's advisory says that "individuals and entities who employ or pay DPRK IT workers could be directly or indirectly breaching financial sanctions". It also says civil penalties apply "with no requirement for OFSI to demonstrate that the person knew or had reasonable cause to suspect the conduct amounted to a breach of sanctions". Criminal breaches are "punishable upon conviction by up to 7 years in prison".

OFSI "encourages all stakeholders to report" suspected targeting. In the US, the FBI's Internet Crime Complaint Center (IC3) advises reporting to your local FBI field office or at ic3.gov. Counsel should decide what you report, to whom and in what order. Don't wait for certainty before asking.

6. Assess whether personal data was exposed

If the person could read customer or employee personal data, you may have a personal data breach. The Information Commissioner's Office (ICO) says you must report a notifiable breach "without undue delay, but not later than 72 hours after becoming aware of it". The same 72-hour rule sits in Article 33 of the GDPR. The threshold is risk: if a risk to people is likely you notify, and if it's unlikely you needn't. Either way, the ICO says you must keep a record of every breach.

The clock runs from awareness, not from proof. When "aware" begins is a judgment call, so put it to your data protection officer in the first hours and write down the answer. Waiting for the audit in step 4 to finish before you start the assessment is the common mistake.

7. End the engagement on counsel's advice

Don't look for a single rule here. We haven't verified dismissal mechanics country by country, so treat these as questions to put to employment counsel, not answers:

Is the person an employee or a contractor, and does that change how the engagement ends?
Which country's law governs: the person's, the contracting entity's, or the contract's?
If the name on the contract is a stolen identity, who is the counterparty, and does the paid account belong to a third party?
Does the contract or local law require notice, a hearing or a written reason before you end it?
What should the termination message say, who delivers it, and what must be recovered at the same moment?

Get these answered before anyone speaks to the person, and have equipment retrieval and the access cut-off already done.

8. Brace for what follows

Expect several things. The person may cooperate and return equipment. OFSI's advisory also lists threats to release proprietary source code if payments aren't made, so expect extortion and leak threats. Decide in advance who answers if that happens, and tell counsel before you reply to anything. Whether to pay a demand is a decision for counsel and law enforcement, not for the engineering team.

Check the rest of the team too. OFSI's advisory says successful placements lead to the worker recommending other DPRK IT workers at the same company, so look for engineers hired through the same route, sharing payment details or the same recruiter, or with similar interview patterns. Then decide what you tell the team. A short, factual note is better than the rumour that will fill the gap.

When the immediate work is done, run a blameless review. The incident postmortem on a blended team covers how to run one without it turning into a hunt for who approved the hire.

Re-hire safely

The hire passed your process, so the process is the thing to fix. Start with the checks in the prevention guide above, and change who runs them. HighCircl's own vetting has four stages: background and experience verification, a communication and product-thinking assessment, a take-home project, and a live technical session on architectural reasoning. About 1 in 10 applicants pass all four.

For the open seat, bring in contract cover while the role is re-vetted. Cover that arrives in a hurry is where the next bad hire comes from, so hold it to the same checks, including shipping equipment only to the address on the person's ID and withholding system access until background checks are complete, as the FBI's IC3 advises.

What this means for your risk and hiring plan

Your decisions come in this order: risk first, hiring second.

For risk, assign an owner to each step above before the day ends, and ask counsel and your DPO to look at the matter before HR does. Counsel decides the sanctions and reporting questions. Your DPO decides when your 72 hours began. You decide what the person could reach and what to rotate. Under the sanctions regime, OFSI doesn't have to show that you knew or had reasonable cause to suspect, and that's the reason to move fast on the sanctions question.

For hiring, decide who covers the role and how that cover is vetted. Then decide what changes in your screening: where identity is checked, and who checks it. If your current process puts all the verification at the start and none after the offer, that's the gap. The fix starts with how to design a technical screening process, which covers the stages that follow identity.

Tell your board or investors before they hear it elsewhere, in plain terms: what happened, what was exposed, what you've done.

FAQ

Should you fire a fake employee immediately?

Not as the first move. Contain first: pause payments, revoke access, preserve evidence and audit their work, then end the engagement on counsel's advice. The Security Alliance advises the same order. Purdue Global Law School's guidance says to terminate and cut access, so sources disagree, and containing first is our judgment. A person who's fired before you've cut access and collected logs can still do damage.

Do you have to report a fake hire to the authorities?

It depends on the case, and counsel should decide. If there's a sanctions nexus, OFSI encourages reporting in the UK, and in the US the FBI's IC3 takes reports. For plain proxy or credential fraud there may be no sanctions duty, but there can still be a crime to report and a breach duty. Get the reporting question to counsel in the first day.

Do you have to notify a data protection authority within 72 hours?

Only if there's a notifiable personal data breach. The ICO and GDPR Article 33 require notification within 72 hours of becoming aware if the breach is likely to put people at risk, and a record of every breach whether or not you notify. Your DPO should assess it, starting with what personal data the person could read.

Can you be fined for paying someone who turns out to be a DPRK IT worker?

In the UK, potentially, yes. OFSI says civil penalties don't require it to show you knew or had reason to suspect a breach, and criminal breaches carry up to 7 years in prison. Whether a specific case amounts to a breach is a question for counsel, and it depends on the sanctions nexus.

How do you tell a fake hire from someone who exaggerated a CV?

By identity and by work. A CV exaggeration is the right person claiming skills they lack. A fake hire is the wrong person: documents that aren't theirs, pay going to a different name, a laptop at an address that doesn't match, or someone else doing the work. If you're unsure, treat it as the more serious case until you've confirmed, and don't confront them.