How to Vet Foreign IT / Engineering Candidates

It has also become considerably riskier. Identity fraud in remote IT recruitment, fabricated references, and candidates using AI tools to pass technical interviews are no longer edge cases; they are a documented and growing problem across the industry. For a Polish company building a distributed team, the question is not whether to vet a foreign candidate remotely — it is how to do it properly.

Below is a short, practical guide covering the checks that genuinely matter confirming the person is real, verifying their work history, and validating their technical claims — before the contract is signed, not after.

Why Does Remote Vetting Matter More in 2026?

Three trends have converged.

First, the volume of fully remote applications has grown sharply, meaning recruiters now meet far fewer candidates face-to-face than they did five years ago. Second, generative AI has made it trivial to fabricate polished CVs, LinkedIn histories, and even live interview answers. Third, there has been a wave of well-documented cases of fraudulent IT workers — including state-sponsored operators — using stolen or synthetic identities to obtain remote developer jobs at Western companies.

This last point is not speculation. The FBI issued public advisories in May 2024 and January 2025 warning that North Korean nationals were posing as legitimate remote IT workers to obtain employment at Western firms, using stolen identities, AI-generated personas, and US-based intermediaries to appear credible. In a November 2025 announcement, the US Department of Justice reported that facilitators had helped such workers fraudulently obtain remote roles at more than 136 US victim companies, generating over USD 2.2 million for the regime. The scale is such that Mandiant’s Chief Technology Officer told a 2025 security briefing that essentially every Fortune 500 company has received applications from North Korean IT workers.

None of this means foreign hiring should stop. Poland and the broader CEE region remain one of Europe’s strongest engineering talent pools, and most cross-border candidates are exactly who they say they are. It means the vetting process needs to catch up with the threat.

💡 The takeaway: The risk is not that foreign candidates are untrustworthy — they overwhelmingly are trustworthy. The risk is that remote-only hiring removes the informal checks that catch the small minority who are not. A structured process closes that gap.

How Do You Confirm a Foreign IT Candidate Is a Real Person?

Start with identity, not skills. A candidate can be technically brilliant and still not be who they claim to be.

• Require a live, unscripted video call. Ask the candidate to turn on their camera, show a government-issued ID next to their face, and answer a few unplanned questions about their background. Scripted or heavily edited “interviews” are a red flag.
• Watch for inconsistencies in real time. Audio-to-lip-sync delays, a background that does not match the claimed location, or a refusal to share a second camera angle can indicate a proxy interviewee or an AI-assisted deepfake.
• Cross-check the identity across platforms. Compare the name, photo, and career timeline on LinkedIn, GitHub, and the CV. Small inconsistencies — different name spellings, mismatched dates, a LinkedIn profile created only weeks ago — deserve a direct question, not an assumption.
• Verify address and invoicing details independently. For B2B contracts, ask for a company registration number (or local equivalent) and check it against the relevant national business registry rather than trusting a PDF the candidate sends over.
• Use a paid identity-verification service for higher-risk hires. For senior roles with access to sensitive systems or code, a lightweight KYC (Know Your Customer) check — the same kind used in fintech onboarding — is a low-cost way to confirm that a passport or ID document is genuine.

How Do You Check References Without Being Fooled?

A reference list supplied by the candidate is a starting point, not proof. Fraudulent candidates increasingly provide “references” that are friends — or fake companies with a working phone number staffed by an accomplice.

• Verify the referee’s identity independently. Do not call the number printed on the CV. Search for the company on LinkedIn or its official website and find the referee’s profile or the general switchboard yourself.
• Ask questions only a real former manager could answer. Specific project names, team size, sprint cadence, or the reason the candidate left. Vague, generic praise (“great team player, no issues”) without specifics is a signal to dig deeper.
• Cross-reference the company’s existence. Confirm that the employer exists, has a real website and a registered business address, and — where available — appears in a national company registry. In Poland this is the KRS or CEIDG check; for foreign entities, the local business register.
• Look for a corroborating digital footprint. Genuine former colleagues will usually appear as LinkedIn connections, in old GitHub commit histories, or in public communities relevant to the technology stack.
• Be cautious with references from very small or newly founded companies. These are far easier to fabricate than a reference from an established, well-known employer.

How Do You Verify Technical Skills Remotely?

• Use a live coding session, not a take-home test alone. Take-home assignments can be outsourced or AI-generated. A live session — where the candidate shares their screen and explains their reasoning — is far harder to fake.
• Ask about their own past projects in detail. A genuine engineer can explain architecture decisions, trade-offs, and mistakes made along the way. Someone reciting a memorised answer typically cannot go deeper than the surface.
• Check the GitHub or portfolio commit history for authenticity. Look at commit patterns, code-style consistency across repositories, and whether the contributions match the seniority claimed on the CV.
• Involve a technical interviewer who works in the same stack, not only an HR generalist. Domain-specific follow-up questions are one of the fastest ways to expose a fabricated skill set.

What Are the Warning Signs of a Fraudulent Candidate?

• Reluctance to turn on the camera, or repeated technical “issues” that prevent a live video interview.
• A CV, portfolio, or GitHub history that was created or heavily updated only in the last few weeks.
• References that are difficult to reach through independent channels, or that respond only via chat or email and never by phone or video.
• Requests to route payment through a third party, a different name, or a country unrelated to the one claimed as their residence.
• A mismatch between the claimed location and the candidate’s actual working hours or IP-based login patterns once onboarded.
• Pressure to skip standard onboarding steps or to sign contracts unusually quickly.

What Should a Vetting Checklist Look Like Before You Sign?

Step	What to Verify	How
Identity	Real person, matches CV/LinkedIn	Live video call + ID check
Legal entity	Candidate/company is registered	National business registry lookup
Employment history	Roles and dates are accurate	Independent reference calls
Technical skill	Claimed seniority is genuine	Live coding session
Digital footprint	Consistent, long-standing presence	GitHub, LinkedIn, community activity
Payment/banking	Details match verified identity	Cross-check invoicing entity

📍 Building a distributed team and want the vetting handled before candidates ever reach your inbox? At Optiveum, every candidate is screened, referenced, and technically assessed by our founding team before presentation — which is one reason our replacement rate sits under 1%. Book a call with Marek Wróbel to discuss your roles.

Frequently Asked Questions (FAQ)

Can a Polish company legally ask a foreign candidate for ID verification?

Yes. Requesting an ID document for identity-verification purposes, with the candidate’s consent and under GDPR-compliant data handling, is standard practice in EU recruitment and is not, in itself, discriminatory or unlawful.

Is it enough to check a candidate’s LinkedIn profile?

No. LinkedIn profiles can be fabricated or purchased, and endorsements can be exchanged between contacts. LinkedIn should be one data point among several — never the sole verification method.

Should we vet foreign candidates differently from local ones?

The core principles are the same, but a remote-only relationship removes the informal checks that happen naturally with local hires — mutual industry contacts, in-person meetings, easy access to physical documents. Remote vetting therefore needs to be more structured and more deliberate to reach the same level of confidence.

Is it worth using a specialised recruitment partner for this?

For companies without an in-house process for cross-border verification, working with an IT recruitment agency that already screens, references, and technically tests candidates before presenting them significantly reduces both the risk and the time spent on it.

---

Sources: FBI Public Service Announcements (May 2024, January 2025); U.S. Department of Justice enforcement announcements (June 2025, November 2025); Mandiant / Google Cloud threat reporting (2025). Figures cited reflect publicly reported enforcement data as of late 2025.

Read also:

How to Build a Nearshore IT Team in Poland

Average Time-to-Hire for Senior Developers in Poland

How to Hire AI & Python Developers in Poland

Why Mandatory Hybrid Work Limits Your IT Recruitment