How can employers verify where remote employees actually work?

Last reviewed 20 October 2026

By combining identity checks with a location check that does not rely on the laptop, such as a signed verdict from the worker’s enrolled phone at sign-in and on sensitive actions, instead of the IP address of a company laptop that can be hosted anywhere and operated remotely.

Why the usual signals fail

An employer typically sees two things: the IP address of the company laptop and the address on file. Both can be arranged. In October 2026 the Justice Department described North Korean IT workers who used “virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States,” with U.S. facilitators hosting company-issued laptops at their homes and installing remote-access software. The FBI seized about 187 laptops and KVM (keyboard, video, mouse) devices (Justice Department).

The FBI’s advisory the same day says these “laptop farms” have let workers “obfuscate their locations for years,” using tools such as AnyDesk, TeamViewer and Chrome Remote Desktop, and KVM-over-IP hardware that controls a laptop remotely (FBI PSA).

What the FBI recommends

• In-person steps “to verify identity and claimed location,” such as fingerprinting (FBI PSA, July 2025).
• Video calls with unobscured backgrounds.
• Shipping equipment only to the address on the employee’s identification documents.
• Layered, continuous identity checks, because these workers “cannot be identified reliably with a single indicator” (FBI PSA).

Checking the phone as well as the laptop

A laptop farm works because the laptop is the device being checked. A location factor also asks the worker’s enrolled phone: at sign-in, and on actions such as a code push or a wallet transfer, the phone proves it is inside the permitted region, with the verdict signed in its secure hardware. A phone outside the region cannot produce that proof. Policy can also require a QR scan from the laptop’s screen at each sign-in, which ties the phone to that session. See LFA.