Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAmazon says it stopped more than 1,800 suspected North Korean operatives from joining the company since April 2024. That is the wording used by Amazon chief security officer Stephen Schmidt—not a confirmed count of North Korean nationals or individual application forms. Schmidt also said Amazon detected 27% more DPRK-affiliated applications quarter over quarter in 2025, without publishing the underlying counts.
What Amazon reported
In a December 2025 post, Schmidt said Amazon had stopped more than 1,800 suspected Democratic People’s Republic of Korea (DPRK) operatives from joining since April 2024. He also reported a 27% quarter-over-quarter increase in DPRK-affiliated applications detected during 2025. Both figures are Amazon’s claims; the post does not provide an independent audit, quarterly totals, or a comparison denominator. Schmidt’s post describes people Amazon suspected of being operatives, not confirmed nationalities or a count of application forms.
Schmidt said the activity was “likely happening at scale across the industry.” That is his assessment, not a measured industry-wide total.
How Amazon says it screens applicants
Amazon says its process combines AI-powered screening with human verification. Schmidt described the following elements:
#1 Best Overall
- Pattern analysis: Amazon’s AI model analyzes connections to nearly 200 high-risk institutions, anomalies across applications, and geographic inconsistencies. Amazon has not disclosed the institutions or how it defines this group.
- Identity and credentials: The company says it uses background checks, credential verification, and structured interviews.
- Signals considered together: Schmidt mentioned inconsistencies in resumes, education histories, emails, and phone numbers. He cautioned that a phone-number format or other single clue “means nothing” on its own.
These are Amazon’s description of its own controls, not a published independent evaluation of their accuracy.
What methods and indicators Schmidt described
Schmidt said suspected operatives may use stolen identities connected to real software engineers, compromised or paid-for LinkedIn accounts, and changing education histories. He also said the company has seen attempts to obtain roles in artificial intelligence and machine learning.
What a laptop farm means
A laptop farm is a location in the United States where computers are set up to make remote work appear to be performed domestically. Schmidt described equipment being received at U.S. locations while the person using it operates from abroad. The presence of such a setup may be one indicator for an employer to examine, but it is not by itself proof of wrongdoing.
These examples are reported tactics and indicators, not evidence against any particular applicant. A mismatch or unusual account detail should prompt careful verification rather than an automatic conclusion about a person.
What employers can take from Amazon’s account
Schmidt recommended that employers look for patterns across resumes, emails, phone numbers, and education histories; verify identity at multiple stages of hiring; and monitor for anomalous technical behavior, such as unusual remote access or unauthorized hardware. He also advised reporting suspected DPRK IT workers to the FBI or local law enforcement. These are his recommendations, not a universal diagnostic checklist.
- Use human review alongside automated screening rather than treating a single flag as decisive.
- Check identity and credentials at more than one hiring stage.
- Consider geographic and application inconsistencies in context, and document why additional verification is needed.
- After hiring, monitor access and hardware for unusual activity under the organization’s security policies.
A separate DOJ case provides legal context
On June 30, 2025, the U.S. Department of Justice announced charges against four North Korean nationals in a separate case. Prosecutors alleged that remote IT work was used in a scheme involving more than $900,000 in virtual currency theft and laundering. DOJ said two defendants were hired by companies using false identification. The case is not evidence for Amazon’s count. The DOJ release states that an indictment contains charges and defendants are presumed innocent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Amazon’s reported controls are not a guarantee
ITPro reported on December 22, 2025, that Amazon acknowledged one imposter got through in a recent campaign; the outlet referenced Bloomberg’s reporting about a fake systems-development contractor. This reported incident is distinct from the more than 1,800 suspected operatives Amazon says it stopped and underscores that screening can miss cases. ITPro’s report does not establish how frequently such cases occur.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
