Every year, Cybersecurity Awareness Month ends on the one night when millions of people put on masks, knock on strangers' doors and get handed something of value without anyone asking who they are. This year's awareness month theme from the National Cybersecurity Alliance is "Don't Make It Easy for Them," and a lot of what crossed our desks this October involved people wearing someone else's face, someone else's brand or someone else's name, and finding it far easier than it should be.
A client called us recently with a problem that, a few years ago, would have sounded like the plot of a bad spy novel. A remote employee they had recruited, interviewed and brought on board wasn't real. The face on the video interviews had been produced with deepfake technology, and the person actually doing the work was a North Korean IT worker. We won't get into how it came to light, but it's no longer a hypothetical.
They're far from alone. On October 13, the Justice Department charged 14 people and announced the shutdown of more than 40 "laptop farms" in Texas tied to the same kind of scheme. Here's what three of this season's costumes look like from where we sit at 221B Partners.
The new hire who isn't
According to DOJ, more than 70 U.S. companies hired remote workers who were actually North Korean operatives using stolen or fabricated identity documents and VPNs to pass as Americans. U.S.-based facilitators kept the company laptops in their homes, installed remote-access software and helped route roughly $3 million in pay toward sanctioned North Korean entities.
Ironically, a stolen identity is often the cleanest background check you’ll run all year. The real person behind it has a credit history, a valid Social Security number, often not so much as a parking ticket, and no idea their name is on somebody else’s payroll. The check tells you the person exists. It doesn't tell you the person on the video call is that person. That's what identity resolution is for, and a few checks tend to surface these schemes:
• Does the history fit the person? Address history, phone and email age, and a digital footprint that matches the claimed career.
• Where's the laptop going? A shipping address that never appears in the candidate's history, or one tied to a string of unrelated names, deserves a phone call before the box goes out.
• Test the face. Ask the candidate to turn their head to the side or wave a hand in front of their face. As of this fall, those are still two of the better tells against real-time face swaps, but it’s an arms race, not a guarantee. Then verify their ID live, or better yet in person, at onboarding.
The store that isn't
Black Friday is November 27, and the copycats are already open for business. Brand-protection firms are warning about lookalike domains one character off from the real thing or padded with "sale" and "outlet," promoted through paid ads and social media giveaways, with checkout pages cloned to collect card numbers.
This month we've been working a version of this problem for a national retailer: someone using lookalike domains, email addresses and phone numbers to pass themselves off as the company. One lookalike domain is a nuisance. Tie it to the person who registered it, and to the half-dozen others they registered the same week, and you’ve got something a lawyer can work with. A few of the threads we pull:
• Registration history. Privacy services hide today's registrant, but historical records and registration patterns tend to cluster when one operator runs several domains.
• Shared infrastructure. Hosting, name servers, SSL certificates and reused tracking IDs can tie a dozen lookalikes together.
• Phone numbers and email. Line-type lookups, reverse searches and email headers often point somewhere the display name doesn't.
• Documentation. Attribution is only as good as the memo behind it, written to support a takedown, a cease-and-desist letter or a subpoena.
Delete me (mostly)
California's Delete Request and Opt-out Platform, DROP, lets residents send one deletion request to every registered data broker. More than 500,000 people had signed up by late August, and since August 1 the state's 654 registered data brokers have had to process requests at least every 45 days. Those of us outside California still get to do it one opt-out form at a time.
Executives and other high profile individuals often need it more than most. The Security Executive Council's Executive Targeting Report counted twice as many incidents against executives in 2025 as in 2024, with residential targeting on the rise. But when we build an Executive Risk Profile, data broker listings are one piece of one section. A DROP request doesn't take into consideration:
• Breach data. The marketing list leaked in 2019 isn't processing deletion requests. Neither is whoever used my information to order $400 worth of Taco Bell.
• Property records. The county recorder isn't a data broker, and deeds have a way of naming the trustee along with the trust.
• Political giving. FEC records list a donor's name, city, ZIP code, employer and occupation.
• SEC filings and the jet. Proxy statements often disclose spending on personal security and personal use of the corporate jet, and the FAA registry ties that jet to a tail number.
• The family. Spouses and kids aren't covered by the company's media policy.
Unmasking
Every scheme here is contingent on a borrowed or stolen identity, and most of the borrowing/theft is easier than it should be. Cybersecurity Awareness Month ends with October, and the costumes go back in the closet on November 1. The imposters never take theirs off, so don't make it easy for them.