For three years, a woman in Litchfield Park, Arizona, kept dozens of company laptops running in her home. Each one carried a note naming the company that issued it and the identity of the employee it belonged to. None of those employees were really there. The people logging in were overseas IT workers for North Korea, using the names of real Americans.
In July 2025, Christina Chapman was sentenced to 102 months in federal prison. According to the Justice Department, the scheme used 68 stolen identities, defrauded 309 U.S. businesses and generated more than $17 million. The victims included Fortune 500 companies, a top-five television network, a Silicon Valley tech company, an aerospace manufacturer, an American car maker and a luxury retailer.
The workers were real. The names on their paperwork belonged to someone else.
How the scheme worked
The workers applied for remote IT jobs under the names of real U.S. citizens and residents. Once hired, the employer shipped a laptop to the address on file. That address was Chapman's home. She kept the laptops online so the work appeared to come from inside the United States, and she shipped 49 more devices overseas, including to a Chinese city on the border with North Korea.
Pay went to the stolen identities. Chapman received and forged payroll checks, and wages were deposited directly into her bank accounts before she sent the money abroad. Much of the income was reported to the IRS and the Social Security Administration under the names of the people whose identities were used.
The workers also tried to get jobs at two U.S. government agencies. The Justice Department says those attempts were generally unsuccessful.
From the first laptop to the latest warning
- The laptop farm starts
Company laptops for remote hires begin arriving at a home in Arizona. The work behind them is done overseas.
- FBI search
Agents seize more than 90 laptops. Each carries a note naming the company and the stolen identity.
- Guilty plea
Wire fraud conspiracy, aggravated identity theft and money laundering conspiracy.
- 102-month sentence
68 stolen identities, 309 U.S. businesses defrauded, more than $17 million generated.
- A second laptop farm case
Two New Jersey men are sentenced in a separate scheme that reached more than 100 U.S. companies.
- FBI warning
The FBI says the schemes are spreading through more facilitators and smaller laptop farms.
309U.S. businesses hired workers under stolen identities in this one scheme
Three lessons for employers
1. A clean criminal record proves nothing about who is on the call
The identities in this case belonged to real people. A criminal search runs on the name, date of birth and SSN it is given. If those belong to someone else, the report comes back clean for that someone else. The first question is whether the candidate is the person on the ID.
2. Remote hiring needs identity checks built for remote hiring
In October 2026, the FBI warned that these schemes are spreading through more facilitators and smaller laptop farms, and that workers may buy verification accounts to pass background checks. The FBI's advice is "identity in depth": layered checks across hiring and employment, such as live verification and multiple forms of ID, rather than one test at the start.
3. Don't screen people out by name or nationality
The same FBI warning cautions against relying on ban lists or name filters. They miss the fraud, block qualified applicants and can harm the identity theft victims whose names are being used. The fix is to verify the person in front of you, the same way for every candidate.
