North Korean Job Fraud Now Targets Healthcare, Sales

North Korea’s remote-worker fraud scheme, long associated with software engineering roles, is now reaching into healthcare and sales positions, according to a joint alert issued July 31, 2026, by the U.S. State Department and FBI alongside partner agencies from Japan, South Korea, Australia, Canada, and several European governments.

The alert describes North Korean operatives using forged identification documents and third-party proxies, people in the target country who agree to front the fraudulent accounts, to pass identity checks and job interviews for online platforms that handle employment, procurement, and contracting. Salaries are typically redirected through proxy bank accounts or cryptocurrency rather than paid directly, and the agencies say the revenue funds North Korea’s nuclear and ballistic missile programs. The alert notes the workers increasingly use AI tools to obfuscate their identities as they expand into new job categories beyond IT.

The original insight is not that North Korea is doing this, it is that the fraud has outgrown the control most companies rely on to catch it. IT hiring pipelines at tech-forward employers have had years to build red-flag training around remote developer roles: VPN usage patterns, laptop farms, inconsistent time zones. A healthcare staffing coordinator or a sales operations manager screening a remote hire has none of that context, and the advisory’s own guidance, stricter identity-document review and in-person interview requirements, was written for platforms and employers who have never had to think about nation-state fraud before.

The advisory also carries legal exposure companies may not have priced in: contracting with a North Korean IT worker, even unknowingly, can violate sanctions law and UN Security Council Resolution 2397’s repatriation requirement, independent of whether any data was stolen.

Source: U.S. Department of State