Forty-one percent of IT, cybersecurity, risk, and fraud leaders say their company has hired and onboarded a fraudulent candidate, according to a GetReal Security report that puts a hard number on what used to look like a fringe scare story.

The figure lands as federal investigators widen their warnings about AI-generated impersonators slipping into U.S. payroll systems. On July 31, 2026, the FBI and U.S. State Department — joined by foreign-affairs counterparts abroad — issued a joint alert flagging North Korean government operatives using stolen U.S. identities to land remote IT contracts and funnel salaries back to Pyongyang's nuclear and ballistic missile programs.

What does the North Korea alert change for HR?

The advisory calls these contractors an insider threat tied to "data exfiltration, cryptocurrency theft and theft of sensitive information," per the joint alert text. North Korea is a sanctioned jurisdiction, so any U.S. employer paying such a worker faces OFAC exposure on top of the usual hiring damage.

The FBI has also confirmed that eight individuals drew prison sentences in 2026 alone for roles in these schemes — a sign the Justice Department treats fake hires as a national-security matter, not just résumé padding.

Which incidents put the trend on the map?

Cybersecurity training vendor KnowBe4 learned the lesson from the inside. The company hired a North Korean government operative as a software engineer; the candidate used a stolen U.S. identity, sat through four AI-deepfake video interviews, and then routed his employer-issued laptop to an "IT mule laptop farm" before trying to plant malware over a VPN traced to North Korea or China.

A separate case in Hong Kong drove the financial stakes higher: a finance employee wired roughly $25 million after a video call populated by deepfake replicas of the company's CFO and colleagues, one of the largest publicly disclosed deepfake heists to date.

What should HR teams do this quarter?

Whiteford Taylor & Preston labor partner Lisa Brauner, who wrote the source analysis, frames deepfake hiring as both a security and a legal exposure. Her practical checklist for recruiters and HR leaders reads as follows:

• Run candidate interviews in person whenever you can.
• Layer identity checks at every hiring stage, not just at offer.
• Verify references by phone and cross-check LinkedIn histories.
• Match the shipping address for new-hire laptops to verified candidate addresses.
• Add post-hire safeguards for anyone touching backend systems.
• Require an in-person HR or supervisor meeting during onboarding.
• Train recruiters to flag off-sync audio and video, scripted answers, and candidates who refuse real-time gestures.
• Pull in employment counsel the moment identity checks fail or a sanctions nexus surfaces.

Where does compliance go from here?

The federal drumbeat started on December 19, 2025, when the FBI issued a public service announcement on the rise in AI deepfake impersonation; the July alert has now sharpened the focus onto state-sponsored schemes. Expect background-screening vendors to pitch more liveness-proving tools and OFAC counsel to start auditing contractor pipelines before the next enforcement push hits.

Brauner's bottom line for HR: remote-first recruiting, outsourced screening, and generative AI have minted a new insider threat — someone you never actually intended to hire.