What we found
The FBI says North Korean state-controlled remote "IT Workers" are paying Americans to help them obtain and keep jobs at western companies, and that they strategically target those under financial stress. According to the advisory, the paid tasks include appearing on camera, participating in job interviews or meetings, vouching for fraudulent identities, handing over personal social media or professional networking accounts, shipping packages, completing urinalysis tests or fingerprint submissions, and keeping employment-related devices connected to the Internet from personal residences — arrangements the FBI calls "laptop farms". The FBI states plainly that these actions are illegal and put individuals at risk of law enforcement scrutiny. The advisory describes fake job openings posted on well-known job boards, often as freelance gigs with simple requests such as interviewing on someone's behalf or receiving and hosting laptops in your home, backed by invented companies and official-looking documentation. Common backstories named by the FBI include claiming to be Chinese or East Asian nationals needing a temporary U.S. presence, or Eastern Europeans displaced by the Russia-Ukraine war. The FBI says it has observed these workers use threats of physical violence to demand payments, including death threats against former managers and their families after termination, and has seen paid facilitators sent in person to victim companies and to the residences of laptop farm operators for intimidation. The advisory also reports that some facilitators are paid solely for the use of their identities, which the workers then use without permission or to apply for more jobs than were agreed. The FBI advises calling 911 if you or someone you know receives a threat to life or is concerned about physical safety. Refuse any paid request to host a work laptop at your address, sit an interview for someone else, or lend out your ID, logins or job-board profile — and report the offer to ic3.gov. We do not know from our harvested material how many Americans have accepted these offers, what they were paid, or which job boards carried the fake listings. The advisory text we hold was cut off partway through its section on impersonations, so any later detail — including further reporting instructions — is not in front of us. LIVEFRAUD ALERTS is independent and not affiliated with the FBI, IC3 or any organisation named here, and this alert rests on the single official advisory cited above.
- The sole source is an official FBI/IC3 public service announcement published 2026-10-13, carrying first-person agency observations rather than second-hand reporting.
- The advisory is specific about the recruitment tasks, the targeting of people under financial stress, and the escalation to threats of violence.
- Only one source was harvested, so nothing here is corroborated by a second document.
- The source text was truncated before its end, so later sections could not be read.
- Reviewed by 4 models, 3 from independent houses.
THE RULE
An easy-sounding freelance gig — keep a laptop plugged in, take one interview — can mean illegal activity, law enforcement scrutiny, and, the FBI says, threats of violence if you try to stop.
What we don’t know
- How many Americans have accepted facilitation offers, and how many have faced charges.
- What sums facilitators are typically offered or paid.
- Which job boards or messaging platforms the fake listings and recruitment approaches appear on.
- How an approached person can tell a fraudulent freelance offer from a legitimate one before accepting.
- What the truncated closing sections of the advisory say about impersonations and reporting.
The bench — who voted
4 INDEPENDENT AI MODELS REVIEWED THIS. ALL 4: HIGH RISK.
The card names a count. Here are the seats behind it, with what each one said.
ANTHROPICclaude-opus-5 · HIGH
The single evidence row supports only a narrow core: payment of financially stressed Americans to host laptops, sit interviews, appear on camera and lend identities; illegality; and threats of physical violence to compel cooperation. The finding adds a long list of specifics that appear nowhere in the evidence before us — urinalysis tests, fingerprint submissions, shipping packages, handing over social media/professional networking accounts, the 'laptop farms' label, invented companies with official-looking documentation, and facilitators paid solely for use of their identities. These may well be in the advisory, but on the record supplied they are unverified elaboration.
DISSENT, PRESERVEDThe core pattern — criminal recruitment of people in financial distress, dressed as freelance work, with coercion once they are implicated — is genuinely high-risk for an ordinary reader, and the alert's protective advice (refuse the request, report to ic3.gov, call 911 on a threat to life) is sound regardless of my sourcing objections. I would not want sourcing criticism read as a reason to downgrade the danger grade.
DISSENT, PRESERVEDThe alert deserves credit for naming its own unknowns and for disclosing the truncated capture and its lack of affiliation with the FBI. My objection is to the gap between the one row offered and the breadth of detail asserted, not to the alert's good faith. The fix is to add evidence rows for the disputed specifics or trim them, then republish at the same grade.
GOOGLEgemini-flash-latest · HIGH
The finding introduces extensive narrative detail not present in the single evidence row provided, including specific tasks like urinalysis and fingerprinting, specific recruitment backstories (e.g., Eastern Europeans displaced by the Russia-Ukraine war, Chinese/East Asian nationals), and specific allegations regarding in-person intimidation visits and death threats against former managers.
GROQopenai/gpt-oss-120b · HIGH
The finding adds many details (shipping packages, urinalysis/fingerprint tests, "laptop farms", specific job‑board backstories, in‑person intimidation, facilitators paid solely for identity use) that are not present in the single evidence row, which only mentions payment, financial‑stress targeting, hosting laptops, interview sitting, identity lending, illegality, and threats of violence.
OPENROUTERopenrouter/free · HIGH
Raised no objection; read the evidence as holds.
Reviewed by 4 independent models: 1 found it carried by the evidence, 3 did not.
▼ Protocol & challenge record
Objection (medium): Nationality cue repeated without the FBI's own counterweight. The finding reproduces 'claiming to be Chinese or East Asian nationals' and 'Eastern Europeans displaced by the Russia-Ukraine war' as backstories, but drops the advisory's explicit warning that identity-based filtering is unreliable, 'can block qualified applicants, and risks negatively impacting potential victims of identity theft', and that aggressive controls carry 'unusually high risks of generating false positives'. In a mass-audience alert, the nationality detail travels further than the caveat. The source text supports including both; publishing one without the other is a source-to-claim framing distortion, not just an omission.
Not resolved — preserved on the record.
Objection (medium): Victim categories are conflated in the headline claim. The claim asserts the ITWs 'have used threats of violence against those who stop cooperating' and the finding then packs in 'death threats against former managers and their families after termination'. In the source these are two distinct bullets about two distinct victim sets: (a) threats/intimidation to compel Americans (facilitators) to continue illicit activity, and (b) post-termination extortion of the ITW's former employer-side managers to collect additional payments. A reader of an alert addressed to 'AMERICANS UNDER FINANCIAL STRESS' will plausibly read the death-threat line as something that happened to facilitators. Also, 'after termination' is ambiguous as to whose termination — in the source it is the ITW's.
Not resolved — preserved on the record.
Objection (medium): The single most specific targeting fact in the advisory is absent from the finding: 'ITWs target active-duty U.S. military members to host laptops' and 'target positions with cleared defense contractors' / 'positions requiring U.S. government security clearances'. The draft runs a targeting callout and a targeting-dropped rule, carries 'ATTENTION: ACTIVE-DUTY U.S. MILITARY' in callout_options and 'Show this to any service member asked to keep a company laptop at their home' in directive_options — both squarely in evidence — yet share_directive is null and the finding never mentions military or clearance-holder targeting at all. Either the omission or the empty directive is wrong; an evidenced, named target group is being silently dropped.
Not resolved — preserved on the record.
Objection (medium): 'Witting and unwitting' is flattened. The source says ITWs 'increasingly rely on the help of witting and unwitting Americans'. The draft's framing ('paying Americans to help them', 'these actions are illegal and put individuals at risk of law enforcement scrutiny') presents a uniformly knowing-collaborator picture. The advisory's own construction contemplates people who do not know what they are enabling — which is precisely the readership the callout targets. Dropping 'unwitting' both overclaims culpability and weakens the alert's usefulness to the person who has already said yes.
Not resolved — preserved on the record.
Objection (low): 'Laptop farms' label is attached to the wrong scope. The finding appends '— arrangements the FBI calls "laptop farms"' to a nine-item list of paid tasks (camera work, interviews, urinalysis, fingerprints, shipping, account handover, device hosting). In the source the term applies only to the last of these: keeping employment-related devices connected from non-alerting locations such as personal residences. Grammatically the dash may attach to the final item, but 'arrangements' (plural) after a list invites the wider reading.
Resolved: Reword to attach the term precisely: '...and keeping employment-related devices connected to the Internet from personal residences — the last of these being what the FBI calls a "laptop farm".' Sourced to the same row.
Objection (low): The Americans-only frame omits that much facilitation is subcontracted abroad. The source states ITWs are 'in some cases subcontracting entire jobs to foreign nationals in South Asia or West Africa', hire freelancers 'usually in Pakistan, India, Nigeria', and pay them 'to conduct interviews on their behalf'. The claim sentence reads as though interview-sitting is primarily an American-facilitator activity; the source locates a large share of that specific task offshore. Not false, but a skewed picture of the scheme's shape.
Not resolved — preserved on the record.
Objection (low): Internal tension between the advice line and the stated limitation. The draft says 'any later detail — including further reporting instructions — is not in front of us', then directs readers to 'report the offer to ic3.gov' with no row_ids. The only reporting instruction actually in the held text is 'call 911' for threats to life. The ic3.gov direction is inferred from the publisher's domain, not from the captured text; it is almost certainly correct but is currently unmarked as inference.
Resolved: Mark the ic3.gov direction as an inference from the publishing domain rather than from the captured text, or drop it and keep only the sourced 911 instruction plus a neutral 'report it to the FBI'.
Objection (low): Confidence label versus its own reasons. Two of the four confidence_reasons are disconfirming ('Only one source was harvested, so nothing here is corroborated' and 'The source text was truncated before its end'), yet the label is 'high'. 'High' is defensible for attribution fidelity — the attributed statements track the official text closely — but the artefact does not distinguish 'we are confident the FBI said this' from 'we are confident this is the full picture'. As written the label reads as the latter.
Not resolved — preserved on the record.
Objection (low): Pipeline residue in the targeting_dropped note: 'DIRECTIVE NOT IN EVIDENCE: stranger — no harvested source describes this group.' No directive_option mentions a stranger; the obviously ungrounded options are 'Send this to any teamviewer you know' (TeamViewer is remote-desktop software named as a business-side indicator, not a person or group) and the two 'facilitator' directives, which would imply the reader's acquaintances are North Korean facilitators. The rejection log does not match the candidate set and should not be published in this state.
Resolved: Regenerate or delete the targeting_dropped entry so the published rejection log names the candidates actually rejected ('teamviewer', 'facilitator'). Keeping share_directive null is correct on current evidence only if OBJ-3 is resolved by addition to the finding instead.
Preserved dissent
ON THE RECORDI do not think this should publish with the Chinese / East Asian and Eastern European backstories included while the FBI's own warning — that identity-based filtering is unreliable, blocks qualified applicants, and risks harming identity-theft victims — is left out. The advisory puts those two things in the same document for a reason. An alert that carries the nationality cue to a mass audience and leaves the caveat on the cutting-room floor is doing something the source does not do.
ON THE RECORDThe finding's one unambiguous, named target population is active-duty U.S. military members asked to host laptops. It is in the evidence, it is in the callout options, it is in the directive options, and it appears nowhere in the finding. That is the detail a reader could act on, and it was dropped silently. I register that as a substantive editorial failure, not a formatting nit.
ON THE RECORD'High' confidence sitting directly above two reasons that say 'single source' and 'truncated before the end' is not a defensible label as presented. I would read it as high-fidelity-to-source, medium-completeness, and I think the public record should say which one is meant.
ON THE RECORDOn the death threats: the source puts them in the extortion-of-employers bucket. The draft moves them into a sentence addressed to financially stressed Americans. I accept the Desk's view that the attribution line is technically accurate; I do not accept that the ordinary reader will parse it correctly, and I think that is the kind of accuracy that is not worth much.
The sources
Official sourceNorth Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment2026-10-13
The FBI says North Korean state-controlled remote IT workers pay Americans under financial stress to host employer laptops, sit interviews, appear on camera and lend identities, that these acts are illegal, and that the workers have used threats of physical violence to compel continued cooperation.
Authority: official. Retrieved 2026-10-13.
Limitation: Single official advisory, captured truncated at 11,817 of 12,884 characters; it gives no counts of affected individuals, no payment figures and no named job boards or platforms.
Open the original source →Other checks
Published under standing founder pass (A9) — every claim source-mapped by the machine.
▼ What the machine checked
- ✓ Not a community submission.
- ✓ No entity is named.
- ✓ All 8 material sentence(s) map to FBI/IC3.
- ✗ anthropic returned "overstated"; google returned "overstated"; groq returned "overstated" — published on the receipt, not blocking (A9 amendment).
- ✓ No audience band is set.
No human affirmed these. They were verified by the classifier described in Amendment A9, on 2026-10-14.
Something wrong here? Tell us and we'll correct it — corrections are published, not quietly edited.
Phishy? Send it → sharelivefraud.com/squire-it
Not affiliated with any government agency, credit bureau, bank, platform, or law-enforcement agency. Informational only — not legal or financial advice.
Naming a source is not an endorsement, and being named here is not an accusation against any company.
Powered by SquireIt™
Verify this receipt at squireit.com