Assessment protocol

Active Assessment Protocol

Screen observed fraud indicators before access increases.

Evidence first. Vibes are not evidence. USDC payroll is normal in Web3 and is not suspicious by itself.

Identity and documents Facts that should reconcile across independent records. Name, address, education, work history, photo, phone, or email do not match across records. Weight 20 Background check, victim contact, or official notice suggests stolen or borrowed identity. Weight 35 / critical Candidate refuses live video, in-person, fingerprinting, or equivalent identity verification. Weight 18 Different applicants reuse the same resume text, phone number, email, profile photo, portfolio, or payout details. Weight 18 Candidate claims South Korea education, employment, residence, or work authorization but cannot support direct independent verification. Weight 14

Location, device, and access path Where the person, laptop, and network path actually appear to be. Candidate asks for company equipment to ship somewhere other than the address on verified identity records. Weight 24 Candidate cannot receive equipment or mail at the address shown on identity documentation. Weight 20 Company device shows unauthorized remote desktop, KVM, proxy, VPN, VPS, or remote-control tooling. Weight 28 One account logs in from multiple countries or implausible locations within a short period. Weight 20 Candidate cannot answer neutral, claim-specific questions about claimed current location, school, employer, or local work setup. Weight 12 Profile locale, device language, timezone, stated location, or working hours conflict without a credible explanation. Weight 10

Payment and payroll Payroll, wallet, and payout behavior that should match verified identity. Candidate or vendor requests crypto payment outside approved payroll/KYC rails, before identity verification, or to a wallet inconsistent with verified identity. Weight 8 Payment account belongs to a third party, changes frequently, or overlaps with another applicant. Weight 18 Payment routing or profile data creates unresolved sanctions or cross-border compliance concerns. Weight 12

Interview and account behavior Live-interview consistency, liveness, and account-control signals. Interview shows signs of face-swapping, AI video, hidden assistance, or a different person controlling the session. Weight 22 The person appears materially different across official ID, live interview, onboarding, or later meetings. Weight 20 Candidate cannot complete a neutral live liveness challenge, such as reading a random phrase and explaining a work sample on camera. Weight 16 Candidate gives generic, scripted, or inconsistent answers to open-ended questions about their own resume, project history, or claimed location. Weight 12 Live-video, background, timestamp, or location check does not match the candidate's claimed current location or onboarding address. Weight 16 Accent, dialect, writing style, vocabulary, terminology, or live technical explanation is inconsistent with claimed education, work history, or language background. Weight 8 Candidate pushes hiring, communication, code review, or payment onto separate unapproved platforms. Weight 8 Portfolio or company website is unusually thin, recently created, template-like, or inconsistent with claims. Weight 8

Post-hire security behavior Signals that may mean the environment is already exposed. Worker copied repositories, secrets, wallet material, source code, or internal data to personal accounts. Weight 35 / critical Evidence suggests credential, session-cookie, MFA, wallet-key, or signing-key collection. Weight 32 / critical Worker or related account threatens to leak data, code, customer records, or wallet information. Weight 45 / critical

Vendor and staffing controls Third-party controls for staffing, subcontracting, and sanctions checks. Staffing or outsourcing vendor cannot prove identity, location, sanctions, and subcontractor checks. Weight 15 The person doing the work appears different from the person vetted by the vendor or employer. Weight 20

Soft interview prompts

Use these only when they are tied to the candidate's own claims.

These prompts test consistency, liveness, and verifiable work history. They are not nationality tests.

If the person claims South Korea location, school, or work history

Ask them to walk through their claimed current work setup in practical terms: workspace, normal work hours, network/phone carrier, payroll/KYC route, and how equipment can be delivered to the verified address.
Ask for consent to verify the claimed Korean school or employer through independently sourced contacts, not through contacts supplied only by the candidate.
Ask one neutral follow-up tied to their own claim, such as a nearby transit stop, office district, public service, or institution process. Treat this as a consistency check, not a nationality test.

Live-video consistency checks

Keep the camera on with an unobscured background when policy allows, then ask the person to explain a recent work sample without screen-reading or long pauses.
Ask the person to briefly show a live timestamp source or surroundings that match the claimed location, without collecting unnecessary private details.
Compare the same person across official ID, interview, onboarding, and later meetings when company policy allows. Do not score fashion, grooming, attractiveness, ethnicity, or whether someone 'looks' like a nationality.
Repeat one harmless factual question later in the process and compare the answer with the earlier record.

Psychology-aware fraud probes

Prefer open-ended memory questions over yes/no questions: real candidates usually answer with specific, messy details; coached answers often stay generic.
If accent, wording, or technical vocabulary seems inconsistent with claimed education or work history, ask neutral follow-ups about the claim. Do not score accent alone.
For Korean-language concerns, ask a native South Korean reviewer to compare dialect, vocabulary, and professional terminology against the person's claimed background. Treat it as one corroborating clue only.
Do not accuse during the interview. Ask for documentation, pause access, and compare claims across HR, device, payment, and source-control records.
Use the same structured prompts for similarly situated candidates so the process stays fair, repeatable, and legally defensible.