Overview
Technology hiring inverted an assumption every other industry still relies on. Most screening was designed around a person who walks into a building, hands over a document, and is seen. A remote software role may be filled, onboarded, and given privileged system access without anyone ever meeting the person.
That makes identity the weak point rather than criminal history, and it is now a documented one.
Throughout this page, “screening company” refers to the outside firm an employer hires to run the check. In the law it is called a consumer reporting agency, or CRA.
Which Checks Are Commonly Run
| Identity Verification | The component that matters most here, and the one most often treated as a formality. |
| Employment History | Independent verification matters more than usual, since fabricated employers and referee phone numbers are a known tactic. |
| Education Verification | Confirmed with the institution rather than from a supplied document. |
| Criminal Records | Standard, and dependent on an accurate address history to know which jurisdictions to search. |
| Global Watchlists | Relevant where the company handles controlled technology or has export obligations. |
| International | For candidates with overseas history, where records take weeks rather than days. |
The Remote Identity Problem
Since 2022, federal agencies have repeatedly warned that organized operations place workers into remote technology roles using stolen identities. The scale is no longer speculative.
Justice Department enforcement has documented laptop farms searched across multiple states, more than 130 U.S. companies tricked into hiring workers who were not who they claimed to be, and more than 40 individuals charged, including U.S. nationals who hosted company laptops in their homes to make a worker appear domestically located. In one prosecution, the identities of at least 80 real U.S. people were used to obtain work at over 100 companies. Wages were reported to tax authorities in the name of the real person whose identity had been taken.
Screening by nationality is the wrong response, and it does not work. These schemes run on stolen American identities, so a citizenship filter catches nothing. It is also unlawful. The Justice Department has penalized employers for restricting hiring by citizenship or immigration status, including where they believed export rules required it. The effective answer is verifying identity rigorously for every candidate.
The costs land in 2 places. Companies have faced not only the fraud itself but substantial expense auditing and remediating systems afterward, and in at least one case data marked as export controlled was taken. And ordinary Americans have had their identities used, their names attached to work they never did, and earnings reported to tax authorities that were never theirs.
What Actually Verifies a Remote Hire
Federal guidance to employers is unusually concrete on this, and the measures are cheap relative to the exposure.
- Examine identity and employment documents for inconsistencies rather than filing them.
- Verify prior employment and education independently. Contact the institution and the employer through details you found, not details the candidate supplied.
- Cross-check the photograph and contact details against professional and social profiles for consistency over time.
- Use live video with the camera unobscured, and ask questions requiring movement or referencing something local. Real time generated video struggles with both.
- Ship equipment only to the address on the identification document, which is what laptop farms exist to defeat.
- Delay system access until screening is complete, rather than granting it on the start date and catching up afterward.
The last 2 are the ones most often skipped, because both slow down onboarding. They are also the 2 that would have prevented most of the documented cases.
One caution on identity components. An identity check confirms that a name and number have been associated in commercial records. It does not confirm the person in the video is that person. Our identity verification page explains why a clean trace and a verified human are different things.
Export Control for Software and Data
Technology companies frequently hold data subject to federal export rules, and the trap is identical to the one manufacturers fall into.
Releasing controlled technology to a foreign person counts as an export even when it happens on a laptop in Denver. But those rules restrict the release of technology, not who may be hired. Where a role requires that access, the employer applies for a license rather than excluding the candidate.
Two definitional points save a lot of trouble. A U.S. person for these purposes includes lawful permanent residents, asylees, and refugees, not only citizens. And a job posting for a role involving controlled technology may not restrict applicants to citizens or green card holders. Our manufacturing page covers the enforcement history in more detail.
Contractors and Privileged Access
Technology workforces are heavily contingent, and access rarely matches employment status. A contract engineer may hold deeper system privileges than most employees.
Three things follow. Screening should be tiered by access and privilege rather than by whether someone is on payroll. Where an agency or vendor supplies the person, the screening level, frequency, and evidence belong in the contract, since the obligation does not transfer by assumption. And offboarding matters as much as onboarding, because a contractor whose engagement ended with credentials still active is the same exposure as a bad hire.
Our staffing page covers who owes what when 2 organizations share a worker.
Common Mistakes
- Granting system access on day one while screening is still running.
- Verifying employment using contact details the candidate provided.
- Treating an identity trace as proof of identity, when it only links a name to records.
- Shipping equipment to an address that is not on the identification.
- Interviewing with cameras off, or accepting a static or obscured video feed.
- Restricting hiring by citizenship, which is unlawful and catches none of the actual fraud.
- Screening employees but not contractors who hold deeper access.
For Job Seekers in Technology
- Expect more identity verification than you used to. Live video, document checks, and equipment shipped to your registered address are now normal and are not aimed at you personally.
- Keep your address current with your bank and other institutions, since a mismatch between your stated address and your records will stall onboarding.
- Give a full address history. Criminal searches are jurisdictional, and gaps mean either delay or an incomplete check.
- List former names. Court records are indexed by name, and an omitted name is a jurisdiction searched incorrectly.
- Watch for identity theft. These schemes use real people’s identities. If you find earnings reported to tax authorities that are not yours, that is a serious matter to act on quickly.
- A citizenship restriction in a posting may be unlawful where the role involves export controlled technology.
- If the report is wrong, dispute it. Our guide to disputing a background check covers the process.
Best Practices
- Verify identity rigorously for every candidate rather than filtering by nationality
- Use unobscured live video and ask questions requiring movement or local knowledge
- Contact employers and schools through details you sourced independently
- Ship equipment only to the address on the identification document
- Withhold system access until screening completes, and treat exceptions as a documented decision
- Tier screening by privilege and access rather than by employment status
- Put screening requirements for contractors and vendors into the contract
- Assess export control at the role and individual level, never by citizenship