20 October 2026 · State-sponsored IT worker payroll infiltration
The remote developer on the payroll
In March 2026 the US Treasury sanctioned six individuals and two entities over North Korean IT worker fraud, citing schemes that funnelled close to $800m to the regime in 2024 alone.
The method is mundane. Operatives obtain remote technical roles at ordinary companies using stolen or fabricated identities, frequently through intermediaries who front the relationship. They do the work — competently, by most accounts — and the salary is routed onward.
For a bank, none of this presents as financial crime. It presents as payroll. A contractor is paid monthly by a legitimate employer, into an account in the contractor's name, and the money moves on afterwards. Every leg is small and every leg is plausible.
The pattern
This is state-sponsored IT worker payroll infiltration: salary payments to workers whose stated identity or location does not match reality, routed onward to a sanctioned regime.
Which pattern across a set of contractor accounts would concern you most?
One tap. The answer appears straight away.