A remote website developer sends a convincing CV, a professional-looking website and a competitive quotation. The references look reassuring. You approve the work.
Soon, someone you have never met can change your website, open customer records or administer business email. Before those permissions were granted, did anyone independently verify the person and business behind the proposal?
Remote work is an ordinary business arrangement. The concern is handing over access on the strength of paperwork that nobody has checked.
The warning has a real business example
On 29 October 2026, Australia, New Zealand and international partners issued a joint statement concerning sanctions targeting North Korea's overseas-worker operations and related activities. Australia had listed two people and two entities on 23 October.
The Australian Sanctions Office advisory, updated on 31 July 2026, warns of operatives using false identities to secure remote IT work, including website design and programming. It identifies cybersecurity, financial, reputational and sanctions risks.
New Zealand's NCSC provides a concrete example in its 2026 Cyber Threat Report. A large business questioned a remote IT contractor's identity and contacted NCSC and Police. Their investigation identified the worker as North Korean. The worker had used fake identity documents and a New Zealand contact address, recruiting a New Zealand citizen to receive and operate the company's laptop.
After termination and refusal of payment, the worker claimed to possess commercially sensitive information and threatened its release. The published case reports that claim; it does not confirm data theft. Its payment history is not a template for handling a suspicious engagement here.
The business had supplied equipment for legitimate work to someone whose identity proved false. That is why verification matters before access is approved, even when the proposed work is genuine.
Check the business, then verify the person
For a supplier claiming an Australian ABN, search the number or business name in the official ABN Lookup. Compare the result with the quotation and agreement:
- Is the ABN active, and does its legal entity match the contracting party?
- Is the business name associated with that entity?
- Does the main business location fit the claimed Australian location? Public details generally show state and postcode, not a street address.
- If an invoice includes GST, is the entity registered for GST? Legitimate contractors are not all required to register.
The service's explanation of public registration details helps interpret the result. For a company, also consider an appropriate ASIC company-register search.
An active ABN confirms registration status. It cannot prove the person emailing you controls that entity, is authorised to represent it, is competent or has passed security screening. Someone could borrow a real business's ABN.
Before granting access, independently contact the registered business using contact details you have verified separately from the applicant's proposal or emails. Confirm that the person is authorised to act for it and will perform the work. This connects the registration record to the actual engagement. Employment and overseas-supplier arrangements may work differently; an ABN is not universal proof of legitimacy.
A recruitment agency can assist, but the Sanctions Office cautions against relying exclusively on third-party screening. Ask what checks were performed, whether identity documents were independently verified, and whether references were contacted through independently established channels. Confirm the person doing the work is the person screened, whether subcontracting is allowed, and who approves and removes access.
Apply consistent, role-based checks. Nationality, ethnicity, location and remote working do not establish dishonesty.
When a police check is proportionate
Someone editing public website copy presents different risks from someone administering email, financial systems or sensitive infrastructure, accessing customer and employee records or confidential client documents, or holding administrator permissions across several systems.
For sensitive roles, an Australian National Police Check may form part of screening where lawful, relevant and appropriate. It is not universally required for IT contractors, and the Essential Eight does not mandate it.
First establish why the role justifies the check. Obtain informed consent and comply with applicable screening, privacy and spent-conviction requirements. Use an authorised provider, such as an Australian police agency or an ACIC-accredited checking service. ACIC explains the consent and identity-verification process.
The identity verification used to obtain the check is as important as the certificate. For higher-risk engagements, establish that the result belongs to the individual you are engaging. An official-looking document alone does not establish that connection.
Verify authenticity using the issuing provider's process, rather than relying on an unverified PDF or screenshot. Check whether the result's purpose and recency suit the engagement. There is no universal expiry period: it reflects disclosable criminal-history information at the time of issue.
Keep results confidential and retain them only where justified and legally appropriate. A clear result is not an ongoing clearance or guarantee of trustworthiness. An Australian check may also tell you little about an overseas contractor's history. None of these checks replaces limits on access.
Agree the work and limit the permissions
Before access begins, a written agreement should identify the contracting party, authorised workers and subcontracting conditions. Set out permitted systems, confidentiality, information handling, approved remote-access arrangements, incident notification, return or deletion of business information, and access removal. Keep this proportionate to the work; obtain legal advice where needed.
ASD's Essential Eight provides a foundation for technical safeguards. It is not a complete contractor-vetting framework or a universal legal requirement for every SME.
Personnel responsibilities and supplier arrangements are addressed more directly in the broader Information Security Manual's personnel-security and procurement guidance, alongside ASD's advice on engaging managed service providers.
A website designer may need content access without control of domains, email or billing. IT support may need administrator permission for one repair, rather than permanently. Give each worker an individual account, approve additional permissions and review them regularly. Avoid shared administrator passwords.
Protect important accounts with multifactor authentication, which requires an additional security check when someone signs in. Where available, security keys and passkeys can provide stronger protection against fraudulent login requests. These measures protect sign-ins; they cannot establish someone's real-world identity or suitability for the job.
Keep systems and applications updated, and control which software can run. Contractors should not install unapproved software or remote-support tools. Retain independent, recoverable backups, with someone in the business able to access and restore them. Your contractor should never be the only route to recovery.
Finish the access work when the contract finishes
Make the contract's end trigger a documented access review. Check business email, website administration, hosting, domains, cloud storage, financial and customer systems, remote-support software, contractor-held devices and any extra permissions granted during the project.
Disable obsolete accounts, end active sign-in sessions, and revoke passwords, access keys and software connections where appropriate. Change shared passwords the contractor knew. Confirm the return of company devices and agreed handling of business information. Deleting one login may leave other routes open; ensure the owner or replacement provider can still operate and recover the systems.
Solway Web Consulting's small-business cyber security review covers website, hosting, email, administrator access and backups when an independent assessment would help clarify who still controls what.
Material inconsistencies in identity, registration or payment information deserve investigation, not accusations. If credible sanctions concerns arise, follow current DFAT and Australian Sanctions Office guidance, seek appropriate advice and follow government reporting and payment directions. Consequences depend on the facts and applicable law; unknowingly engaging a fraudulent applicant does not, by itself, establish an offence. This article provides business guidance, not legal advice.
A contractor may be perfectly capable of doing the work. That does not remove the need to establish who they are, what they should be allowed to access and what happens to those permissions when the job is finished. Those decisions belong to the business engaging them.
Tags: security, small-business, australia