Remote Worker Fraud Schemes Posing New Insider Risks for Organizations

The expansion of remote and hybrid work has introduced a new risk for organizations across all industries: fraudulent employees who use stolen identities, artificial intelligence (AI) tools, and concealed remote-access technology to obtain jobs and infiltrate sensitive systems. Morgan Lewis wrote about these remote worker fraud schemes in an article on its website.

Insider threats are uniquely difficult to detect because threat actors use legitimate credentials and authorized access. Fake remote worker schemes typically begin with AI-generated profiles and fabricated credentials. Companies may face compliance consequences without knowledge of a worker’s true identity because US sanctions on North Korea operate on a strict liability basis.

Drawing from a Morgan Lewis Technology Marathon webinar, the article outlines the mechanics of fake remote worker schemes, warning indicators, and a multi-layered mitigation framework.

The article also covers strengthening insider risk programs, improving remote hiring, and onboarding verification. It examines US state breach notification laws, Office of Foreign Assets Control (OFAC) sanctions requirements, and international frameworks, including the Digital Operational Resilience Act and the EU Artificial Intelligence Act.

Legal teams should be aware that OFAC enforcement trends signal strict liability exposure for organizations that unknowingly employ sanctioned individuals. Multinational organizations will need to navigate overlapping United States, European Union, and United Kingdom regulatory notification and operational resilience obligations.

Managing legal operations across multiple legal systems requires coordinated incident response planning that simultaneously addresses cybersecurity, employment, privacy, and sanctions considerations.

To learn more about how to stop remote work scams, read this exclusive Today’s General Counsel article.