The interview went well. The background story held. The company shipped a laptop to the address on the forms and put the new engineer on the payroll. US prosecutors say that in one version of this hire, the person doing the work was not in the country the payroll system thought they occupied, and the wages were on their way to North Korea. The laptop was real. It sat in a flat in the United States, next to other companies' laptops, with remote-access software so someone else could use it.
The employee on the badge was a name. The work happened somewhere else.
How it works
- A company advertises an IT job that can be done from home. Remote work is what makes the rest possible. Nobody is expecting a desk.
- The applicant uses a stolen or invented identity. A VPN and a proxy make the connection look domestic. The video interview, if there is one, is the hard part, and it is managed.
- A person in the United States receives the company machine, sets it up and installs remote-access software. The Justice Department calls these flats laptop farms. The facilitator is local. The worker is not.
- The person doing the work logs in from elsewhere. Salary is paid, then sent on. The company has bought labour. Prosecutors say it has also paid a sanctions target.
Signs and red flags
A candidate who will not appear on camera without a heavy filter or a long delay, or who will only interview by chat. A laptop that must be shipped to a different address from the one on the identity documents, with a last-minute "move" or a tale of a stolen machine so a replacement goes elsewhere. A new hire who wants payment split, or who routes wages through a facilitator. Several company laptops in one residential address is the pattern the FBI went looking for. One laptop at a home is ordinary. A room of them, each logged into a different employer, is the farm.
Cases and figures
On 13 October 2026 the Justice Department said an indictment in the Northern District of Ohio charged 14 people over remote IT work that touched more than 70 US companies and generated about $3 million. Two US nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested. Prosecutors say the conduct ran from 2019 to about July 2025, using stolen or fabricated documents and US facilitators who hosted the laptops. The revenue is alleged to have gone to sanctioned entities. An indictment is a charge, not a finding of guilt. The two arrests are of the people prosecutors say hosted the machines, which is a different role from the person typing the code.
From 21 to 25 September 2026, in an effort the FBI called Operation Lonestar Roundup, agents searched more than 40 residences in Texas and seized about 187 laptops and keyboard-video-mouse devices. A keyboard-video-mouse device is the box that lets one set of hands drive several machines. One hundred and eighty-seven laptops is what a farm looks like when it is counted. The FBI's note for employers is on ic3.gov.
What to do and where to report
Hire as if the person might not be who the CV says. Match the shipping address to the identity check. Do not send a laptop to a "friend" who will set it up. If you already suspect a contractor, cut access, keep the machine, and call the FBI field office you look up yourself, or file at ic3.gov. Do not confront the worker on the same chat you think they control. That chat is how they still have the laptop.
If your company paid wages or a fee into this and you need a place to start, use Get help.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.