When you hire a virtual assistant, how do you know the person you interviewed is the person actually doing your work?
The sensible approach is to confirm identity at more than one point: during hiring, before granting access, and while the working relationship continues. No video call, reference, identification document, or work sample proves everything on its own. The aim is to build reasonable confidence without turning ordinary remote work into a constant investigation.
That distinction matters following an October 13, 2026 warning from the FBI about identity fraud involving North Korean remote IT workers. The warning concerns a specific employment-fraud scheme, not virtual assistants generally. However, some of the tactics described, including interview stand-ins, borrowed professional accounts, and undisclosed subcontracting, could also affect other remote hiring arrangements.
For a founder or small business hiring a freelance VA, the useful lesson is about verifying who is doing the work, who receives access, and whether any additional person has been approved to participate.
What the FBI Actually Warned About in October 2026
The FBI’s public service announcement, numbered I-101326-PSA, describes how North Korean remote IT workers have used increasingly elaborate methods to obtain jobs at Western companies while concealing their involvement.
According to the advisory, some individuals involved in these schemes pay other people to attend interviews, appear on camera, provide professional networking accounts, or help establish fraudulent identities. Some have also obtained positions and then passed the actual work to other freelancers.
These arrangements are part of a specific, organized fraud problem. The FBI describes stolen identities, concealed remote access, and activity intended to generate revenue for the North Korean government.
The U.S. Department of Justice also announced enforcement actions on October 13, 2026, against North Korean remote IT worker schemes affecting more than 70 American companies.
Neither announcement establishes that identity fraud is widespread among virtual assistants. It would be misleading to use the cases as evidence that an ordinary overseas freelancer is likely to be dishonest.
Why one identity check is not enough
The FBI describes an approach called identity in depth. Instead of relying on one document, interview, or suspicious behaviour, organizations use multiple checks throughout the working relationship.
For a large employer, this may involve separate human resources, security, and technical teams.
For a small business working with one part-time VA, the principle can be much simpler.
You speak with the candidate, verify relevant professional information, agree who will perform the work, and ensure that access belongs to the person you have engaged. If something significant changes later, you confirm the reason rather than assuming the original screening covers everything indefinitely.
Even a successful paid work sample has limits. It can demonstrate that someone understands the assignment and can produce acceptable results. It doesn’t independently establish who completed that sample.
Identity verification and skills evaluation therefore serve different purposes.
Why the FBI also warns against overreacting
The same advisory cautions that aggressive detection measures can produce false positives, potentially excluding legitimate remote workers.
That warning deserves as much attention as the examples of fraud.
Freelancers may have unusual working hours, travel between locations, use privacy tools, experience connectivity problems, or work with clients across several time zones. None of these circumstances proves that a person is misrepresenting their identity.
Demanding a particular passport, insisting on constant camera access, or collecting unnecessary sensitive documents can also introduce privacy and fairness problems.
The FBI discusses measures such as E-Verify and identification checks in the context of U.S. employers. Those should not be presented as universal requirements for independent contractors, particularly international freelancers.
The better question is whether the verification is appropriate to the relationship and the access involved.
Does This Apply When You’re Hiring a Virtual Assistant?
Partly, but the distinction between the FBI’s findings and their application to VA hiring must remain clear.
The FBI investigated remote IT worker schemes. It did not publish evidence establishing the prevalence of fraudulent virtual assistant hiring.
Still, the underlying hiring question is relevant beyond IT: is the person representing themselves to the client the same person receiving access and completing the contracted responsibilities?
Consider the difference between two arrangements.
In the first, a freelance VA interviews with you, agrees to manage your CRM, and performs the work using their own authorized account.
In the second, someone interviews with you but secretly passes your CRM work and login details to a third party you have never met or approved.
The second arrangement creates questions about identity, confidentiality, responsibility, and access. That remains true even if the work happens to be completed correctly.
The risk also depends on the assignment. Research using public information presents different exposure from managing customer records, accessing financial systems, or handling administrator permissions.
Verification should reflect that difference rather than treating every VA contract as a high-security investigation.
Two Different Problems: False Identity and Undisclosed Subcontracting
Fraudulent identity and undisclosed subcontracting can occur together, but they are not the same problem.
False identity means someone materially misrepresents who they are. They may use another person’s identity, pretend to own a professional profile, or have someone else participate in a hiring process on their behalf.
Undisclosed subcontracting means the person or business you engaged passes some or all of the agreed work to another person without telling you or obtaining the approval required by your arrangement.
The second problem doesn’t automatically establish the first.
Someone may genuinely be who they say they are but still delegate client work without permission. Equally, an agency may openly assign work to several team members as part of an arrangement the client knowingly accepted.
What matters is the agreement, the disclosure, and who is authorized to handle the work and information.
When subcontracting is legitimate
Subcontracting isn’t inherently dishonest.
An agency may explain that a named account manager handles communication while another team member carries out research or production. An independent VA might ask for permission to bring in a specialist for a defined assignment.
Those arrangements can be legitimate when the client understands and accepts them.
Before approving a handoff, clarify:
- Which tasks another person may perform.
- Whether the person will receive confidential information or account access.
- Who remains responsible for the deliverables and corrections.
- What confidentiality and data-handling conditions apply.
- Whether further delegation requires separate approval.
For sample agreement language, the existing virtual assistant contract template includes alternatives for prohibiting subcontracting without approval or permitting specifically authorized subcontractors.
The important point is to settle the arrangement before work or access is transferred.
What Upwork says about subcontracting and account sharing
If you hire through Upwork, its rules provide a clearer platform-specific boundary.
Under Upwork’s guidance on authentic representation, freelancers must obtain the client’s consent before subcontracting agreed work. The platform also prohibits letting another person use an individual’s Upwork account to work or communicate on their behalf.
Those are Upwork policies. They should not be described as laws applying to every freelancer or every hiring platform.
For direct engagements, the applicable contract and legal requirements matter. Either way, written agreement about who will do the work reduces ambiguity.
What to Check, and When
Rather than treating verification as a single hurdle during recruitment, divide it across the three stages when the business makes different decisions.
| Stage | What to confirm | Why it matters | What the check cannot prove |
|---|---|---|---|
| Before the offer | Candidate identity and professional consistency through a live conversation, relevant references, and a suitable paid work sample | Helps establish who you are dealing with and whether the candidate can handle the work | One conversation or work sample cannot guarantee the same person will complete future tasks |
| Before access | Who is authorized to work, whether subcontracting is permitted, and which individual accounts or permissions are needed | Connects the agreed person or team to the access being granted | Account ownership alone cannot prove who is physically using a device at every moment |
| During the work | Consistent communication, agreed participation, and explanations for meaningful changes in people or access | Helps identify unapproved handoffs and resolve discrepancies | Unusual hours, location changes, or communication differences are not proof of fraud |
This is a practical way to adapt the FBI’s layered-verification principle to a small contractor relationship. It is not an official FBI checklist for hiring virtual assistants.
Before you make an offer
Start with an ordinary professional conversation.
Speak directly with the candidate about the tasks you need completed. Ask them to explain a relevant piece of past work, how they would approach a specific assignment, and what information they would need to get started.
Where appropriate, independently contact references rather than relying only on screenshots or written testimonials supplied by the candidate.
You can also use a small paid assignment with a clear deliverable. Our guide to the qualities of a great virtual assistant explains the value of testing practical ability rather than relying only on credentials or promises.
Keep the sample proportionate, paid, and free of unnecessary confidential information.
The goal isn’t to catch someone making a mistake. It’s to understand how they think, communicate, and work.
For a more structured starting point, the virtual assistant job description template helps define the role and develop task-relevant screening questions before applications arrive.
Before you grant business access
Once you’ve chosen someone, confirm the working arrangement in writing.
For an independent VA, that might mean naming the person responsible for the work and stating that they must obtain your approval before involving another worker.
For an agency, identify who will communicate with you, who may complete assignments, and which team members need access.
Then match access to the agreed arrangement.
Where a platform supports individual users, invite the appropriate person to their own account with permissions suited to the task. Avoid using one shared login when separate access is available.
If the VA needs WordPress, CRM, email, or another business platform, the existing guide to sharing passwords safely with a virtual assistant covers safer credential-sharing and permission practices in more detail.
You don’t need to repeat the entire hiring interview at this stage. You need to know whose account is being authorized and whether anyone else is expected to handle the work.
Once work is underway
Ongoing verification should fit naturally into normal communication.
Scheduled conversations, task reviews, and a clear process for introducing additional collaborators can provide enough continuity for many routine assignments.
Pay attention when something materially changes. For example, a previously identified contractor might suddenly say that another person will handle your customer records. That is worth discussing before the new person receives access.
Similarly, if a new individual starts contacting you from the same freelance profile, ask who they are and what role they have.
Routine virtual assistant check-in questions can help keep responsibilities and communication clear without introducing constant monitoring.
There is no need to treat every difference in writing style, availability, or response time as a warning sign. Workload, illness, travel, connectivity, and changing assignments can all affect those things.
Signals That Are Innocent Alone but Worth a Question Together
The FBI’s identity-in-depth approach relies on context and combinations of indicators rather than treating one unusual detail as conclusive.
That distinction is especially important for smaller businesses, where a founder may have little technical information and can easily misinterpret ordinary remote-work behaviour.
| Observation | Why it may be innocent | When to ask further questions |
|---|---|---|
| Working location or login region changes | Travel, a VPN, or network routing may explain it | The change is unexplained and appears alongside account-identity discrepancies |
| Communication style becomes different | Task type, stress, language choices, or editing assistance can change writing | A different person appears to be communicating or approving work without an introduction |
| Payment details change | The contractor may have switched banks or payment providers | Repeated unexplained changes conflict with the agreed payee identity |
| Another person contributes to a task | An agency or approved subcontractor may legitimately assist | The person receives confidential work or access without the required consent |
| Remote-access software is used | Legitimate remote support may require approved remote-access tools | Unexpected remote-control activity conflicts with the agreed setup or security policy |
These are prompts for clarification, not a fraud-detection score.
For instance, a VA working late is not suspicious merely because their hours differ from yours. But if you unexpectedly discover that another individual has taken over communication, is accessing a sensitive account, and was never part of the agreed arrangement, those facts deserve a direct conversation.
The response should follow the evidence and the seriousness of the access involved.
Don’t use country of residence, accent, nationality, or time zone as a shortcut for deciding whether someone is trustworthy. They cannot establish whether identity information is genuine or subcontracting has been disclosed.
Likewise, the presence of common software or a single unfamiliar login location does not establish that someone is participating in the particular scheme described by the FBI.
If Something Doesn’t Add Up
If you notice a meaningful inconsistency, begin by separating what you know from what you suspect.
An unexplained account event deserves a different response from a minor difference in writing style.
First, protect access where necessary. If a sensitive account appears to be used by an unauthorized person, temporarily restrict the affected permissions while you establish what happened. Follow your organization’s normal security and continuity procedures.
Next, ask a specific question. Rather than accusing someone of fraud, explain what you observed. Ask whether another individual has been involved, whether an account was shared, or whether an approved working arrangement has changed.
Keep relevant records. Preserve agreements, access notifications, communications, and other information you may need to understand or report the issue. Avoid collecting unrelated personal information.
Decide what needs to change. Some situations may be resolved with clarification, written consent, and corrected permissions. Serious identity deception or unauthorized access may require ending the arrangement and reviewing affected systems.
If access must be removed, the virtual assistant offboarding guide covers the broader process of closing out responsibilities and permissions.
For suspected criminal activity connected to the North Korean IT worker schemes described in its advisory, the FBI asks victims to contact a local FBI field office and file a report through the Internet Crime Complaint Center. Other situations may require the relevant platform, local authorities, legal adviser, or incident-response professional.
Don’t make public accusations based on a handful of ambiguous signals. Establish the facts, protect what needs protection, and use the appropriate reporting process.
Verification Is Part of a Healthy VA Relationship
Knowing who handles your work is a reasonable business expectation. It doesn’t have to create an adversarial relationship.
Clear introductions, proportionate checks, written subcontracting expectations, and access tied to the correct individuals help both sides understand the arrangement.
The larger lesson from the FBI’s October 2026 warning isn’t that every remote worker deserves suspicion. It’s that one successful interview shouldn’t be treated as permanent proof of who will handle every assignment.
For a small business, the practical standard is straightforward: confirm who you are hiring, agree who may participate, grant appropriate access, and clarify material changes when they arise.
If you’re considering ongoing virtual assistant support and want to discuss the responsibilities, tools, and access involved, you can get in touch about your project. We can start with the actual work you need handled and establish an appropriate scope before getting started.
