8 ms·

Here's a heretical thought: Remote hiring is a massive achilles heel. I've been duped simply by hiring a great engineering candidate who then farmed out the ac

Here's a heretical thought: Remote hiring is a massive achilles heel. I've been duped simply by hiring a great engineering candidate who then farmed out the actual work to remote workers in Pakistan and India. We caught on fairly quickly thanks to one of them forgetting to login to one of our backend systems via vpn a few times. No idea how many companies he was "working for" but I'd bet we were one of many. Remote work has amazing upsides and tremendous security implications.

dboreham 1y ago
And yet: do the same thing with AI and you're a cutting edge genius.
ferguess_k 1y ago
Some people did this with in-office too I think, some years ago. Some people actually had two jobs, both sort of in-office. It's still possible to pull the tricks.
- financypants 1y ago
  The rate of this happening has got to be so low it's negligible.
  - ferguess_k 1y ago
    I agree. It's kinda hard to pull this off. Just saying.
- aoanevdus 1y ago
  The common pattern of requiring three days a week of in-office time makes it much harder.
pokstad 1y ago
Don’t forget remote workers who are required to work in one area and then travel to restricted areas and continue to work.
beezlebroxxxxxx 1y ago
I've heard through the grapevine of some designers (one who worked at Shopify) getting caught using Fiverr (or something similar) to farm out all of their work. Despite all the weird crazy dog and pony show and jumping through hoops that most companies do now, most companies are abysmal at hiring.
- criddell 1y ago
  What can you do during the hiring process to know that this amazing person, who aces every part of the interview, will farm out their work to cheap subcontractors?
  - darepublic 1y ago
    Nothing I guess? Except that they will continue to be vetted after being hired for the quality of their work. just spitballing but even if someone has a remote computer after getting hired, and is onboarded they should not have access to sensitive systems. So while you can't completely prevent the possibility of hiring a malicious actor security should not simply be on/off. The register article mentioned how after these devs were hired they were immediately able to kick off their plans. I think security is not structured properly if that is the case.
  - sanderjd 1y ago
    The thing I'm always curious about with this is: What is the actual bad thing happening here? Is the subcontracted work not good enough? Well, then the problem is that the work is not good enough. Is the person not contributing in other ways that you want them to contribute because they have other jobs? (eg. chat conversations, meetings, team building, etc.) Well, then the problem is that they aren't making those contributions. Or is it just that you're paying them more than you would have to pay the subcontractors if you found and managed them yourself? Well, then you are totally free to skip the middleman and do that yourself. But there is, actually, value in finding and managing freelance work. I certainly don't want to do that myself! If someone is good at doing that, and the quality of the work they are managing is acceptable to me, then it seems like they might be earning their paycheck? I do get that the dishonesty element is bad in and of itself, but I honestly wonder whether, if this is a problem a firm is having, they should consider hiring the work out to subcontractors, without any subterfuge.
corytheboyd 1y ago
How do weekly 1:1 meetings with a manager not catch this very quickly? Okay, maybe the original suave interviewer comes back for those… Still feels like a good EM would pick up on discrepancies between work done and how the suave person talks about it. It depresses me, but you’re probably right about in-office work being the only guarantee against this type of scam. I wish we could just have nice things.
- barbazoo 1y ago
  I also can’t imagine this not getting caught if not in the interview process surely during every day work. Maybe this says more about their work culture and not actually connecting with co workers. Perhaps the manager was just garbage who knows.
  - fhd2 1y ago
    On their first day, they will get a lot of accounts, if they syphon data and m set up backdoors quickly, one day could be enough to cause a good chunk of the damage. Saddens me a bit. I like to trust hires and give them pretty wide access to everything. For my own company, I've so far only hired people I worked with in the past, but when hiring strangers remotely, I'll probably have to rethink my trust-first model.
    - barbazoo 1y ago
      True, personally I have never gotten much of my access the first day, week or even month but it's certainly possible. Not sure though if syphoning data is the main goal here though as opposed to 1) syphoning money to NK or 2) planting backdoors.
- noitpmeder 1y ago
  This isn't necessarily the issue here -- this attempt seemed to be fairly motivated and had access to resources (AI, coaches, ...) to help them get through the process. IF they can get such a 'candidate' hired... whats to say they couldn't continue the sham. One could imagine a team of hackers could easily pass of work that a single IC could reasonably have produced. If their goal is exfiltration (or some other hack) of a {bitcoin exchange, govt, ...} actually putting in {weeks/months/year[s]} of actual work to insert someone into the right position at the right company is insanely worth it.
mattlondon 1y ago
Yep. It started with COVID where understandably 100% of interviews were remote. But now with COVID a thing of the past, for "fairness" reasons (DEI?) we still do 100% remote interviews, but now have the ludicrous situation where we're asking interviewers to do absurd things like look for the reflections in the candidates' eyes/glasses to see if they're using ChatGPT, ask the candidate to swing the webcam around to make sure there are not other people in the room, ask them to hold their hands up to the camera to show they're not typing a prompt (which is even more stupid than it sounds because voice recognition is amazing these days), or ask them not to look away from the camera when answering questions (so not reading answers from another monitor) and other stupid things. How ridiculous. The sooner we get back to in-person interviews the better. Get them to come to the office (which they'll need to do one day if they get the job) and sit next to them while they code on a work laptop). Sorry to all those folks who want 100% remote, but this is why we can't have nice things.
- Espressosaurus 1y ago
  My suspicion is that it's purely monetary and driven by the finance people. a) Don't have to pay to fly candidates out, pay for their hotel, etc. b) Don't have to pay relocation c) Get access to a larger pool of candidates, so can price the wages lower than local wages would require My last company there was a top down directive that in-person interviews were straight up not allowed, everything had to be over Zoom. Even for local candidates, for a job that was supposed to be in-person! Completely crazy IMO.
  - sanderjd 1y ago
    The advantage of a larger pool of candidates is not mostly a financial benefit, IMO. The benefit is mostly the ability to hire from a larger pool of people especially with a specialized skillset, and also to have less of an echo chamber. But yes, that directive to interview local candidates over zoom does seem very silly.
    - Espressosaurus 1y ago
      My experience is that yes it opens up the wider pool, but it makes the filtering process much more difficult in trade. Opening up the wider pool without the in person interview is where things hit the wall since the filtering criteria everyone learned over their careers went out the door thanks to the online interview process. And the online interview process is much more subject to cheating--not exactly a huge concern in-person.
sam-cop-vimes 1y ago
Totally agreed. The number of "engineers" who try to cheat their way through interviews, juggle multiple jobs without disclosing them makes it a total nightmare.
causal 1y ago
So that's probably a sign that your team culture and management isn't the best... Healthy teams communicate a lot and really get to know each other, whether in person or remote. Ideally with regular in-person meetups to reinforce those working relationships. If you're just throwing work over the fence and it takes network analysis to figure out who's doing it...then maybe you should just be hiring a contractor anyway.
- sanderjd 1y ago
  Yeah I similarly find this baffling. This very flatly would not work in any job I've had, whether in person or remote.
  - skippyboxedhero 1y ago
    I have worked in places where this would work...all terrible places that usually had someone with a "maverick" view of how organizations worked derived from reading Warhammer books or something.
    - herculity275 1y ago
      > with a "maverick" view of how organizations worked derived from reading Warhammer books or something Did they want to serve the god emperor of SAAS?
      - lcnPylGDnU4H9OF 1y ago
        We all believe that using recruitment software is sufficient to prevent fraudulent candidates from being hired and that's what makes it true.
whatnow37373 1y ago
Hate to be that guy, but.. what’s the problem? The work is getting done for the price you agreed on. You care how it’s done suddenly? If AI does it, it’s the best thing since sliced bread. I’m sorry but capitalists that want to have it both ways annoy me. Agree on what gets delivered for how much and get out of the way. The “employer” mindset doesn’t jive with capitalism ya’ll are so fond of.
- badmintonbaseba 1y ago
  If you don't want to be an employee then don't sign an employment contract.
  - whatnow37373 1y ago
    Ah, now suddenly you not only need to deliver work but you need to behave in a certain non-specified way. The contract then should arrange for that and perhaps pay extra because it’s a sign of dysfunction.
- mr_mitm 1y ago
  An arrangement like that is probably violating data protection rules that everybody agreed on. In my company, customer data must not leave company systems, let alone the country.
  - whatnow37373 1y ago
    I get the security issues, but let’s be honest. It’s not about that. The poster included a sneer about “work”. This is about something else.
- triceratops 1y ago
  It may cause the company to violate data protection, privacy, labor, and tax laws.
woah 1y ago
The funny part is that in these stories about fake candidates using a whole team of people, it sounds like they are actually successful in doing the work, something that had not been achieved in software dev outsourcing before
- bluGill 1y ago
  Are they? I suspect someone I used to work with was outsourcing. They did great on the interview but their on the job performance wasn't nearly as good.
- InitialLastName 1y ago
  It's only "successful" because there's an alternative, presumably-nefarious funding stream from a third party who wants to gain access to IP/user data/influential functionality. It's essentially a subsidy heavily distorting a very specific market.
tomrod 1y ago
Unless you're in a regulated industry, you might just have a new cost reduction strategy presented to you.
eloisant 1y ago
Between this and legit candidates cheating with AI, I think we'll soon see the return of on-site interviews - even for remote positions.
qingcharles 1y ago
I had a colleague doing this in 2006, and he wasn't remote. He would just sit playing games on his phone all day yet he would check in code. I could never figure it out, so I just asked him and he showed me the chat window to his friend back in the Czech Republic that he paid 25% of his wages to each month.
- ryandrake 1y ago
  I'm not sure I'm really against this! --IF-- the company is happy with the results and code being delivered, and the compensation they are paying for that code, what is the actual, meaningful business difference between whether your colleague wrote it or the Czech guy wrote it? I'm not asking what the moral or ethical difference is. They're paying for engineering output, and if they are getting that output, why does it really matter whose fingers are typing it in?
  - herculity275 1y ago
    I can think of a few reasons, most obviously that it's a security nightmare - you've got a non-employee accessing and modifying your company's code and possibly having access to customer data. Some shops might not care about this, but it's ridiculously irresponsible in principle.
    - ryandrake 1y ago
      What if, instead, the guy was 100% honest and up front about it, and offered to enroll the Czech guy in all security checks that any other contractor would get, and treat them legally as any contractor would be treated? I wouldn't see anything wrong with this, but I would be willing to bet that 99% of companies would not go along with it--for reasons I'm not sure I understand.
      - rtkwe 1y ago
        If they were ok with doing the work to bring in the overseas person in the first place why should they hire their onshore cutout? To do it legally would be a whole mess of getting involved in business in a new country.
ryandrake 1y ago
I don't think this has anything to do with remote vs. onsite work. It has more to do with remote vs. onsite interviews. A thorough onsite interview should catch all of these fake candidates. Companies should be doing at least one onsite interview regardless of whether the role itself is remote or onsite.
- hughes 1y ago
  A very easy way to verify a remote candidate's identity is to buy them a plane ticket to an in person interview. If they cannot board a plane using their claimed identity from their claimed city of origin, you can stop there.
  - bluGill 1y ago
    Only if they are 100% fake as opposed to farming out work to someone else. I can turn up to an interview in person no problem. When hired I just have the person in India use my name/picture and do the work. Of course if they hire me as opposed to that person in India directly there is likely a reason they wanted someone in the US. Often those reasons are legal and somewhere a law is being broken.
  - alexandre_m 1y ago
    Easy, but expensive way. Are you really going to do this for all candidates that make it to the final round of interview? Are you also going to compensate the time for the candidate if he doesn't get selected? Unless what you're proposing is more a formality, and that unless the person doesn't show up he's guaranteed to get the job.
    - ryandrake 1y ago
      By the time someone gets to the on-site interview, the job should be "theirs to lose." You wouldn't be spending the cost of an on-site trip for every candidate that shows some promise during the distance interviews--you'd do it for those very few you're ready to give offers to already, but just want to double check a few in-person soft-skills things (and now, want to double check that he is who he says he is).

dboreham 1y ago

And yet: do the same thing with AI and you're a cutting edge genius.

ferguess_k 1y ago

Some people did this with in-office too I think, some years ago. Some people actually had two jobs, both sort of in-office. It's still possible to pull the tricks.

financypants 1y ago
The rate of this happening has got to be so low it's negligible.
- ferguess_k 1y ago
  I agree. It's kinda hard to pull this off. Just saying.
aoanevdus 1y ago
The common pattern of requiring three days a week of in-office time makes it much harder.

pokstad 1y ago

Don’t forget remote workers who are required to work in one area and then travel to restricted areas and continue to work.

beezlebroxxxxxx 1y ago

I've heard through the grapevine of some designers (one who worked at Shopify) getting caught using Fiverr (or something similar) to farm out all of their work. Despite all the weird crazy dog and pony show and jumping through hoops that most companies do now, most companies are abysmal at hiring.

criddell 1y ago
What can you do during the hiring process to know that this amazing person, who aces every part of the interview, will farm out their work to cheap subcontractors?
- darepublic 1y ago
  Nothing I guess? Except that they will continue to be vetted after being hired for the quality of their work. just spitballing but even if someone has a remote computer after getting hired, and is onboarded they should not have access to sensitive systems. So while you can't completely prevent the possibility of hiring a malicious actor security should not simply be on/off. The register article mentioned how after these devs were hired they were immediately able to kick off their plans. I think security is not structured properly if that is the case.
- sanderjd 1y ago
  The thing I'm always curious about with this is: What is the actual bad thing happening here? Is the subcontracted work not good enough? Well, then the problem is that the work is not good enough. Is the person not contributing in other ways that you want them to contribute because they have other jobs? (eg. chat conversations, meetings, team building, etc.) Well, then the problem is that they aren't making those contributions. Or is it just that you're paying them more than you would have to pay the subcontractors if you found and managed them yourself? Well, then you are totally free to skip the middleman and do that yourself. But there is, actually, value in finding and managing freelance work. I certainly don't want to do that myself! If someone is good at doing that, and the quality of the work they are managing is acceptable to me, then it seems like they might be earning their paycheck? I do get that the dishonesty element is bad in and of itself, but I honestly wonder whether, if this is a problem a firm is having, they should consider hiring the work out to subcontractors, without any subterfuge.

corytheboyd 1y ago

How do weekly 1:1 meetings with a manager not catch this very quickly? Okay, maybe the original suave interviewer comes back for those… Still feels like a good EM would pick up on discrepancies between work done and how the suave person talks about it. It depresses me, but you’re probably right about in-office work being the only guarantee against this type of scam. I wish we could just have nice things.

barbazoo 1y ago
I also can’t imagine this not getting caught if not in the interview process surely during every day work. Maybe this says more about their work culture and not actually connecting with co workers. Perhaps the manager was just garbage who knows.
- fhd2 1y ago
  On their first day, they will get a lot of accounts, if they syphon data and m set up backdoors quickly, one day could be enough to cause a good chunk of the damage. Saddens me a bit. I like to trust hires and give them pretty wide access to everything. For my own company, I've so far only hired people I worked with in the past, but when hiring strangers remotely, I'll probably have to rethink my trust-first model.
  - barbazoo 1y ago
    True, personally I have never gotten much of my access the first day, week or even month but it's certainly possible. Not sure though if syphoning data is the main goal here though as opposed to 1) syphoning money to NK or 2) planting backdoors.
noitpmeder 1y ago
This isn't necessarily the issue here -- this attempt seemed to be fairly motivated and had access to resources (AI, coaches, ...) to help them get through the process. IF they can get such a 'candidate' hired... whats to say they couldn't continue the sham. One could imagine a team of hackers could easily pass of work that a single IC could reasonably have produced. If their goal is exfiltration (or some other hack) of a {bitcoin exchange, govt, ...} actually putting in {weeks/months/year[s]} of actual work to insert someone into the right position at the right company is insanely worth it.

mattlondon 1y ago

Yep. It started with COVID where understandably 100% of interviews were remote. But now with COVID a thing of the past, for "fairness" reasons (DEI?) we still do 100% remote interviews, but now have the ludicrous situation where we're asking interviewers to do absurd things like look for the reflections in the candidates' eyes/glasses to see if they're using ChatGPT, ask the candidate to swing the webcam around to make sure there are not other people in the room, ask them to hold their hands up to the camera to show they're not typing a prompt (which is even more stupid than it sounds because voice recognition is amazing these days), or ask them not to look away from the camera when answering questions (so not reading answers from another monitor) and other stupid things. How ridiculous. The sooner we get back to in-person interviews the better. Get them to come to the office (which they'll need to do one day if they get the job) and sit next to them while they code on a work laptop). Sorry to all those folks who want 100% remote, but this is why we can't have nice things.

Espressosaurus 1y ago
My suspicion is that it's purely monetary and driven by the finance people. a) Don't have to pay to fly candidates out, pay for their hotel, etc. b) Don't have to pay relocation c) Get access to a larger pool of candidates, so can price the wages lower than local wages would require My last company there was a top down directive that in-person interviews were straight up not allowed, everything had to be over Zoom. Even for local candidates, for a job that was supposed to be in-person! Completely crazy IMO.
- sanderjd 1y ago
  The advantage of a larger pool of candidates is not mostly a financial benefit, IMO. The benefit is mostly the ability to hire from a larger pool of people especially with a specialized skillset, and also to have less of an echo chamber. But yes, that directive to interview local candidates over zoom does seem very silly.
  - Espressosaurus 1y ago
    My experience is that yes it opens up the wider pool, but it makes the filtering process much more difficult in trade. Opening up the wider pool without the in person interview is where things hit the wall since the filtering criteria everyone learned over their careers went out the door thanks to the online interview process. And the online interview process is much more subject to cheating--not exactly a huge concern in-person.

sam-cop-vimes 1y ago

Totally agreed. The number of "engineers" who try to cheat their way through interviews, juggle multiple jobs without disclosing them makes it a total nightmare.

causal 1y ago

So that's probably a sign that your team culture and management isn't the best... Healthy teams communicate a lot and really get to know each other, whether in person or remote. Ideally with regular in-person meetups to reinforce those working relationships. If you're just throwing work over the fence and it takes network analysis to figure out who's doing it...then maybe you should just be hiring a contractor anyway.

sanderjd 1y ago
Yeah I similarly find this baffling. This very flatly would not work in any job I've had, whether in person or remote.
- skippyboxedhero 1y ago
  I have worked in places where this would work...all terrible places that usually had someone with a "maverick" view of how organizations worked derived from reading Warhammer books or something.
  - herculity275 1y ago
    > with a "maverick" view of how organizations worked derived from reading Warhammer books or something Did they want to serve the god emperor of SAAS?
    - lcnPylGDnU4H9OF 1y ago
      We all believe that using recruitment software is sufficient to prevent fraudulent candidates from being hired and that's what makes it true.

whatnow37373 1y ago

Hate to be that guy, but.. what’s the problem? The work is getting done for the price you agreed on. You care how it’s done suddenly? If AI does it, it’s the best thing since sliced bread. I’m sorry but capitalists that want to have it both ways annoy me. Agree on what gets delivered for how much and get out of the way. The “employer” mindset doesn’t jive with capitalism ya’ll are so fond of.

badmintonbaseba 1y ago
If you don't want to be an employee then don't sign an employment contract.
- whatnow37373 1y ago
  Ah, now suddenly you not only need to deliver work but you need to behave in a certain non-specified way. The contract then should arrange for that and perhaps pay extra because it’s a sign of dysfunction.
mr_mitm 1y ago
An arrangement like that is probably violating data protection rules that everybody agreed on. In my company, customer data must not leave company systems, let alone the country.
- whatnow37373 1y ago
  I get the security issues, but let’s be honest. It’s not about that. The poster included a sneer about “work”. This is about something else.
triceratops 1y ago
It may cause the company to violate data protection, privacy, labor, and tax laws.

woah 1y ago

The funny part is that in these stories about fake candidates using a whole team of people, it sounds like they are actually successful in doing the work, something that had not been achieved in software dev outsourcing before

bluGill 1y ago
Are they? I suspect someone I used to work with was outsourcing. They did great on the interview but their on the job performance wasn't nearly as good.
InitialLastName 1y ago
It's only "successful" because there's an alternative, presumably-nefarious funding stream from a third party who wants to gain access to IP/user data/influential functionality. It's essentially a subsidy heavily distorting a very specific market.

tomrod 1y ago

Unless you're in a regulated industry, you might just have a new cost reduction strategy presented to you.

eloisant 1y ago

Between this and legit candidates cheating with AI, I think we'll soon see the return of on-site interviews - even for remote positions.

qingcharles 1y ago

I had a colleague doing this in 2006, and he wasn't remote. He would just sit playing games on his phone all day yet he would check in code. I could never figure it out, so I just asked him and he showed me the chat window to his friend back in the Czech Republic that he paid 25% of his wages to each month.

ryandrake 1y ago
I'm not sure I'm really against this! --IF-- the company is happy with the results and code being delivered, and the compensation they are paying for that code, what is the actual, meaningful business difference between whether your colleague wrote it or the Czech guy wrote it? I'm not asking what the moral or ethical difference is. They're paying for engineering output, and if they are getting that output, why does it really matter whose fingers are typing it in?
- herculity275 1y ago
  I can think of a few reasons, most obviously that it's a security nightmare - you've got a non-employee accessing and modifying your company's code and possibly having access to customer data. Some shops might not care about this, but it's ridiculously irresponsible in principle.
  - ryandrake 1y ago
    What if, instead, the guy was 100% honest and up front about it, and offered to enroll the Czech guy in all security checks that any other contractor would get, and treat them legally as any contractor would be treated? I wouldn't see anything wrong with this, but I would be willing to bet that 99% of companies would not go along with it--for reasons I'm not sure I understand.
    - rtkwe 1y ago
      If they were ok with doing the work to bring in the overseas person in the first place why should they hire their onshore cutout? To do it legally would be a whole mess of getting involved in business in a new country.

ryandrake 1y ago

I don't think this has anything to do with remote vs. onsite work. It has more to do with remote vs. onsite interviews. A thorough onsite interview should catch all of these fake candidates. Companies should be doing at least one onsite interview regardless of whether the role itself is remote or onsite.

hughes 1y ago
A very easy way to verify a remote candidate's identity is to buy them a plane ticket to an in person interview. If they cannot board a plane using their claimed identity from their claimed city of origin, you can stop there.
- bluGill 1y ago
  Only if they are 100% fake as opposed to farming out work to someone else. I can turn up to an interview in person no problem. When hired I just have the person in India use my name/picture and do the work. Of course if they hire me as opposed to that person in India directly there is likely a reason they wanted someone in the US. Often those reasons are legal and somewhere a law is being broken.
- alexandre_m 1y ago
  Easy, but expensive way. Are you really going to do this for all candidates that make it to the final round of interview? Are you also going to compensate the time for the candidate if he doesn't get selected? Unless what you're proposing is more a formality, and that unless the person doesn't show up he's guaranteed to get the job.
  - ryandrake 1y ago
    By the time someone gets to the on-site interview, the job should be "theirs to lose." You wouldn't be spending the cost of an on-site trip for every candidate that shows some promise during the distance interviews--you'd do it for those very few you're ready to give offers to already, but just want to double check a few in-person soft-skills things (and now, want to double check that he is who he says he is).