Hiring a contract software engineer used to be a skills question. Could this person write the code, fit the team and deliver on time? Those questions still matter, but remote hiring has added a new one: is the person on the call who they claim to be, and will they be the one doing the work? Federal agencies now warn that contract IT roles are a common target for identity fraud, and AI tools have made polished answers easy to produce.
This guide covers 8 interview red flags that matter most when you bring in a contract software engineer. Some are about fraud and identity. Others are about contract terms and delivery risk that are specific to contractors. Each section explains why the red flag matters and how to test for it during a technical interview without treating every candidate as a suspect.
TL;DR
• Remote contract roles now face real identity fraud risk, and the FBI has named contract IT work as a common entry point.
• Watch for mismatched identity details and answers that sound read or fed to the candidate.
• A contract software engineer who resists signing an IP assignment may leave you without ownership of the code.
• Unclear answers about who will do the work and unusual device requests are signals to dig deeper.
• Build checks into the interview process itself, and apply them the same way to every candidate.
Why Interviewing a Contract Software Engineer Carries Extra Risk
A contract software engineer usually gets access to code and data faster than a permanent hire. Contracts are often signed quickly to meet a project deadline, and onboarding may be lighter because the engagement is short. That speed is the reason companies use contractors, and it’s also what makes weak screening costly.
Contract roles also sit outside many of the checks built for employees. Permanent hires often go through HR onboarding with formal identity checks and background screening. A contractor may be hired by an engineering manager through a platform or a third-party firm, with less structured vetting. If the interview is the main screen, it has to catch more than skill gaps.
The legal relationship is different too. A contractor isn’t an employee, so questions of code ownership and work control need to be settled in writing. Those issues often surface first in the interview, through how a candidate responds to your terms. A red flag here can be as costly as a failed coding test, because it can leave you without clear rights to the work you paid for.
Speed also affects who spots problems. On a permanent hire, several people meet the candidate over several weeks. On a contract hire, 1 or 2 interviews may be the whole process, so interview red flags have fewer chances to surface. Each conversation has to carry more of the screening load, which is why the checks later in this guide are designed to fit into interviews you already run.
Finally, contractors often work fully remote. Remote hiring removes the in-person contact that once made identity fraud hard. Every step from the first screen to the final technical interview may happen over video, which is exactly where the newest fraud methods operate.
What Has Changed in Remote Hiring
The volume of fake and assisted candidates has grown fast enough that research firms now measure it. A Gartner survey of job candidates conducted in 2025 found that 6% of 3,000 candidates admitted to interview fraud. Gartner defined that as posing as someone else or having someone else pose as them. The firm predicts that by 2028, 1 in 4 candidate profiles worldwide will be fake. That’s a forecast, not a measured figure, but it shows where analysts think the trend is heading.
AI use in applications is now common. Gartner research reported by Personnel Today found that 39% of 3,290 surveyed candidates used AI during the application process. Much of that use is legitimate, such as polishing a résumé. It does mean a strong résumé and a smooth first screen tell you less than they used to.
Hiring managers are noticing. A Forbes analysis published in August 2026 cited a Checkr survey in which 59% of 3,000 hiring managers said they had suspected a candidate of using AI to misrepresent themselves. The same article cited an analysis of 19,368 AI-powered interviews in which 38.5% of candidates were flagged for AI-cheating behavior. That figure came from an interview technology vendor, so treat it as a signal of scale.
State-backed fraud adds a security dimension. On July 31, 2026, the State Department, the FBI and 10 allied governments issued a joint alert on North Korean IT workers. It says these workers impersonate nationals of other countries to obtain work through online platforms for employment and contracting of services. It also warns that contracting with these workers and paying them may violate the laws of several countries, including the United States. That makes a bad contract hire a potential sanctions problem as well as a security one. Together, these findings change which interview red flags deserve attention, and they explain why identity now sits alongside skill on the checklist.
Identity Details That Don’t Line Up
The first red flag is any mismatch in basic identity details. Remote hiring makes these mismatches easier to hide, because nobody checks a physical ID at a front desk. This includes names, locations, contact information and documents that don’t agree with each other or change during the process.
Federal guidance lists specific patterns. According to a New York State Bar summary of prior FBI advisories, red flags include incorrect or frequently changing contact information and requests to ship company devices to an address that doesn’t match the candidate’s ID. The same guidance flags identity documents that appear altered, including those edited with image software. The scale is real. In March 2025, the Justice Department announced actions that included searches of 29 laptop farms in 16 states and evidence that more than 130 US companies had been tricked into hiring North Korean IT workers.
Profiles can be convincing. At a 2025 security conference briefing covered by ASIS International, the FBI and private security partners described North Korean workers using well-polished LinkedIn profiles to find well-paid positions. A professional-looking profile is a starting point for checks, and it proves little on its own.
Contact details can reveal patterns across candidates. The FBI’s January 2025 data extortion alert notes that these workers have reused phone numbers, especially voice-over-IP numbers, and email addresses on résumés for different supposed applicants. If your applicant tracking system shows the same phone number on 2 unrelated profiles, that deserves a closer look.
How to Test for It
Build simple checks into your process. Compare the contact details on the résumé against the platform profile and any documents. Ask the candidate to confirm their current city and time zone early, then check that it matches their availability and later answers. Verify past employment by contacting former employers directly, using contact details you find yourself instead of ones the candidate supplies.
None of these checks alone proves fraud. People move and change numbers for good reasons. The red flag is a pattern of mismatches, or a candidate who becomes evasive when asked to clear one up. Strong identity verification works because it’s routine, applied to every contract software engineer the same way.
Video Behavior That Suggests a Fake or a Stand-In
The second red flag is video behavior that doesn’t fit a normal live call. This includes cameras that stay off, blurred or fake backgrounds used to hide a room, lip movement that lags the audio and faces that glitch or look unnaturally smooth.
The FBI has confirmed that these tactics are in use. Its data extortion alert states that North Korean IT workers have used AI and face-swapping technology during video job interviews to hide their true identities. Stand-ins are another risk. A law firm analysis by Holland & Knight notes that facilitators may attend virtual interviews on the worker’s behalf or coach them through interviews.
There are simple ways to test for this. The FBI’s July 2025 hiring guidance offers direct tests. It recommends in-person meetings where possible. For virtual interviews, it suggests requiring video with an unobscured background and asking the person to point the camera out a window while answering questions about their claimed location. It also suggests asking the individual to wave a hand in front of their face, since that can cause a malfunction in AI-generated video.
Applying These Checks Fairly
Use these checks with care. Many honest candidates use background blur for privacy or have weak internet connections. Explain your video rules before the interview so nobody is surprised. Apply the same requests to every candidate, and treat a single glitch as a reason to ask a follow-up question, not as proof.
Another useful step is continuity. Make sure the person in the final technical interview is the same person from the first screen. Some fraud schemes use a skilled stand-in for the hardest round and a different person for others. A short, friendly recap question about an earlier conversation can reveal a mismatch quickly.
Answers That Sound Read or Fed
The third red flag is answers that sound scripted or delayed in a way that suggests outside help. Common signs include long pauses before every answer, eyes tracking text off screen and polished answers to standard questions that fall apart at the first follow-up.
AI tools make this easy for a candidate to attempt. Real-time assistants can listen to a question and display a suggested answer within seconds. In a technical interview, that can produce a correct-sounding explanation of a concept the candidate doesn’t actually understand. When that happens, the interview ends up measuring the tool instead of the person you’re about to pay.
How to Test for It
A single pause isn’t enough to act on. Many people think before they speak, and nerves slow some candidates down. Interview red flags in this area come from a pattern: every answer delayed, polished openings and no depth on follow-up.
Follow-up questions are the most reliable defense. Ask the candidate to explain why they chose a specific approach, then change one constraint and ask what they’d do differently. Real understanding adapts quickly. A fed answer usually doesn’t.
Live problem-solving helps too. Ask the candidate to share their screen and talk through a small change to real or realistic code. Watch how they reason and how they recover from mistakes. These behaviors are hard to outsource in real time.
It also helps to set expectations upfront. Gartner advises employers to explain how they define acceptable AI use and to emphasize their fraud detection efforts, including the consequences if fraud is found. Many engineers use AI coding tools daily, and banning them outright may not reflect how the work gets done. Decide which parts of your process allow AI and say so clearly. Then judge candidates against that rule.
Shallow Knowledge of Their Own Past Work
The fourth red flag is a candidate who can’t go deep on projects listed on their own résumé. This shows up as vague answers about their specific role and an inability to explain trade-offs they supposedly made.
This matters more than it once did. When about 4 in 10 candidates use AI in their applications, a résumé can describe experience in convincing detail without reflecting what the person actually did. A contract software engineer is often hired to contribute from the first week, so gaps between the résumé and real experience show up fast and cost money.
How to Test for It
Pick 1 or 2 projects from the résumé and go deep. Ask what the system did and what the candidate personally built. Ask about a decision they’d change now, and why. Ask what broke in production and how they fixed it. Engineers who did the work usually answer these questions with specific, sometimes messy detail. Candidates who didn’t tend to stay general.
Use the answers to check consistency. If the candidate describes leading a database migration, ask which database they used and how they handled downtime. If details shift between rounds, or don’t match what a former employer confirms, that’s a red flag worth raising directly.
Keep the tone fair. Some strong engineers are modest about their role, or worked under confidentiality rules that limit what they can share. A candidate who says they can’t discuss a client’s system but can walk through the general design is behaving professionally. The concern is an inability to discuss any real technical detail.
Resistance to IP Assignment and Contract Terms
The fifth red flag is specific to contractors: pushback on intellectual property assignment or other core contract terms. A candidate who hesitates to confirm that your company will own the code they write is raising a real business risk, whatever their reason.
Copyright law explains why. The US Copyright Office’s guide to works made for hire says a work is made for hire in 2 situations. The first is when an employee creates it as part of their regular duties. The second is when certain types of work are specially ordered or commissioned under an express written agreement. That second path only applies to a short list of statutory categories, and software isn’t one of them. For an independent contractor’s code, companies usually rely on a written assignment of rights. Without one, the contractor may keep the copyright in code you paid for.
This makes the IP conversation part of the interview as well as the contract stage. Ask the candidate early whether they’re comfortable assigning all rights in work created for you. Ask whether they plan to reuse any of their own libraries or code, and how they’d like to handle that. A reasonable contractor may want to keep ownership of general tools they built before your project, and a clear license can cover that. The red flag is refusal to assign rights in project work, or vague answers about what they’d reuse.
Other Terms to Raise in the Interview
Confidentiality and security terms belong in the same conversation. Ask whether the candidate will follow your code review and data handling rules. Ask whether they carry professional liability insurance if your contract requires it. A contract software engineer who treats these as normal business terms is a lower risk than one who resists all of them.
Raising these points in the interview also saves time. If a candidate won’t accept your core terms, it’s better to learn that before a week of legal back-and-forth. Share a plain summary of the key clauses before the final round, so the conversation is about real terms instead of hypotheticals.
Vague Answers About Who Will Do the Work
The sixth red flag is uncertainty about who will actually write the code. This includes candidates who mention a “team” behind them without explaining it, agencies that can’t confirm the interviewed engineer will be assigned and signs that work will be passed to someone else.
Subcontracting isn’t always a problem. Some freelancers run small studios and say so openly. The risk comes when it’s hidden. The State Department’s joint alert says North Korean IT workers use identity documents supplied by third parties, such as proxies in other countries, to register platform accounts while the North Korean workers do the actual work. In that setup, the person you vetted and the person with access to your code are different people.
Third-party firms need scrutiny too. The FBI data extortion alert advises companies to verify that third-party staffing firms run strong hiring practices and to audit those practices routinely. The FBI’s July 2025 guidance goes further. It tells companies whose contracted IT workers are hired by a third party to share its guidance with that firm, noting that contract IT work is a common way North Korean IT workers get hired.
How to Test for It
Ask direct questions. Will the person in this interview be the only one writing code for us? Will anyone else have access to our systems? If you’re hiring through an agency, ask how it handles identity verification and whether it guarantees the interviewed engineer is the one assigned. Write the answers into the contract, including a rule that no one else may access your systems without written approval.
Watch for the answer to change later. A contractor who confirms solo work in the interview and later asks to add “a colleague” to the repository has raised a new red flag, even if the request sounds routine.
Unusual Requests About Access and Payment
The seventh red flag is any unusual request about devices or payment. This covers pushback on company laptops, requests to use personal machines, requests to ship equipment to a different address and payment instructions that point to someone else’s account.
These patterns appear in official guidance. The FBI’s data extortion alert warns that North Korean IT workers may try to harvest credentials and session cookies to start work sessions from non-company devices. It also notes they often log in several times in a short period from IP addresses in different countries. The State Department’s joint alert adds that these workers often try to avoid direct deposit and in some cases give employers a third party’s bank account.
Remote access tools need care as well. A law firm update from Alston & Bird advises extra caution when working with freelance developers through remote collaboration applications, such as remote desktop tools. These tools can hide where the work is actually coming from.
How to Test for It
Raise device and access rules during the interview and see how the candidate reacts. Explain that work happens on managed devices or through your approved access methods, with multifactor authentication and logging. A professional contract software engineer will usually accept these rules, even if they ask practical questions.
Ask about payment early too. Confirm that payment will go to an account in the name of the contractor or their registered business. Requests to pay a different person, or to switch payment platforms suddenly, deserve a pause. The FBI’s January 2025 alert specifically advises educating hiring teams about changes in address or payment platforms during onboarding.
Unclear Availability and Competing Commitments
The eighth red flag is vague or shifting answers about availability. Contractors often work for more than 1 client, and that’s normal. The risk comes when a candidate can’t give a clear answer about weekly hours or other active contracts.
In some cases, this signals fraud. The FBI has warned that North Korean IT workers try to hold multiple remote jobs at once to generate revenue. In many more cases, it signals ordinary overcommitment. A contractor juggling several full-time loads will struggle to meet deadlines or give your project the attention you’re paying for.
How to Test for It
Remote hiring makes this harder to judge, because you can’t see when someone is at their desk. That’s why the answers need to be specific.
Ask specific questions instead of general ones. How many hours per week can you commit to this project? Which hours will overlap with our team’s working day? How many other active contracts do you have, and roughly how many hours do they take? Time zone overlap deserves its own question. A contractor whose working hours barely overlap with your team’s can still deliver, but only if you plan for it. Ask when they’d join standups and how quickly they’d respond to a production issue during your business hours. Clear, consistent answers are a good sign. Answers that stay vague after a follow-up are not.
Write availability into the contract, and treat it as part of the scope for every contract software engineer you bring on. Include expected hours, response times for urgent issues and the working window when the contractor will be reachable. Then compare the interview answers with early behavior on the project. A contractor who promised 30 hours a week and is rarely online during agreed hours has confirmed the red flag.
How to Structure an Interview That Surfaces These Flags
The best way to catch interview red flags is to build checks into the process, so they don’t depend on 1 interviewer’s instincts. A consistent structure also makes the process fairer to honest candidates.
Start with training. Law firm guidance from Ogletree summarizes the FBI’s recommendation that employers educate HR staff and hiring managers about these threats. Engineering managers who run technical interviews need the same briefing, since they’re often the only people who speak with a contract candidate at length.
Then layer the checks. A Security Magazine article on this threat recommends multi-layered identity verification during interviewing and onboarding, and for the whole time the remote worker is engaged. It also recommends training HR staff and development teams to recognize these tactics. For contract roles, that means identity verification doesn’t end when the contract is signed.
A practical structure looks like this:
1. Screen the profile. Compare identity and contact details across the résumé and the platform profile.
2. Run the first call on video. State your video rules in advance and confirm location and time zone.
3. Hold a live technical interview with follow-ups on a realistic problem.
4. Go deep on 1 or 2 past projects from the résumé.
5. Discuss IP assignment and device rules before an offer.
6. Confirm who will do the work and how payment will be made.
7. Verify references and past employers independently.
8. Recheck identity at onboarding and watch early access patterns.
Keeping the Process Fair and Lawful
Fraud checks shouldn’t turn into bias. An accent or a degree from a non-US university isn’t a red flag on its own. The FBI has noted that North Korean IT workers often claim non-US education, but that’s a pattern to verify through records, not a reason to reject a candidate. Apply every check to every candidate in the same way, and document why any concern was raised.
Consistency is also what keeps remote hiring open to talented engineers anywhere. A fair process lets you hire across borders with confidence, instead of shutting out whole groups of candidates to reduce risk.
Documenting Concerns
When an interviewer spots a possible red flag, write it down with the specific behavior and the question that followed. Note whether the candidate cleared it up. A short, factual note helps the hiring team make a consistent decision and shows why a candidate was advanced or declined. It also builds a record of which checks catch real problems, so you can improve the process over time.
Classification matters too. The Department of Labor proposed a rule in February 2026 that would judge contractor status mainly by control over the work and the worker’s opportunity for profit or loss. If your interview describes a role with set hours, daily direction and no independence, the person may be an employee under the law, whatever the contract says. Keep the interview consistent with a genuine contract relationship, and get legal advice if the role looks more like a job.
Final Thoughts
Interviewing a contract software engineer now means checking identity and contract fit alongside technical skill. The 8 interview red flags in this guide cover the full range, from mismatched identity details and scripted answers to resistance on IP assignment and vague availability. Some point to fraud. Many point to ordinary delivery risk. Both are worth catching before a contractor gets access to your code.
The strongest defense is a steady process. Train everyone who interviews, apply the same checks to every candidate and keep verifying after the contract starts. Handled that way, remote hiring stays a practical way to add skilled engineers quickly, and the checks protect honest contractors as much as your company.
Frequently Asked Questions
What Are the Biggest Red Flags When Interviewing a Contract Software Engineer?
The main interview red flags are mismatched identity details, odd video behavior, answers that sound fed, shallow knowledge of past work and resistance to IP assignment. Vague answers about who does the work, unusual device or payment requests and unclear availability also matter.
Why Are Contract Roles a Target for Hiring Fraud?
Contract roles are often filled quickly and with lighter vetting than permanent jobs. The FBI has said contract IT work is a common way North Korean IT workers get hired.
How Common Is Interview Fraud?
In a 2025 Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, such as having someone else pose as them. Gartner predicts 1 in 4 candidate profiles worldwide will be fake by 2028.
How Can I Tell If a Candidate Is Using a Deepfake?
Require video with an unobscured background. The FBI suggests asking the person to wave a hand in front of their face, since that can cause AI-generated video to glitch.
Is It a Red Flag If a Candidate Keeps Their Camera Off?
It’s worth asking about. Set clear video expectations before the interview and apply them to every candidate. A candidate who won’t turn on video for any reason needs extra identity verification.
How Do I Know If a Candidate Is Getting Real-Time Help?
Ask follow-up questions that change the problem, and hold a live coding session where they talk through their reasoning. Fed answers rarely hold up when the constraints shift.
Should Candidates Be Allowed to Use AI in a Technical Interview?
That’s your decision, but state the rule clearly in advance. Gartner advises employers to explain what AI use is acceptable and how they detect fraud.
Who Owns Code Written by a Contract Software Engineer?
Not automatically the client. Software written by an independent contractor usually needs a written assignment of rights for the client to own it. Settle this in the contract before work starts.
Is It a Red Flag If a Contractor Wants to Keep Their Own Tools?
Not necessarily. Many contractors reuse tools they built before your project. A clear license can cover that. The red flag is refusing to assign rights in work created specifically for you.
Can a Contractor Subcontract My Project?
Only if your contract allows it. Ask directly whether the interviewed person will be the only one writing code, and require written approval before anyone else gets access to your systems.
What Payment Requests Should Worry Me?
Requests to pay a third party’s account or to switch payment platforms suddenly deserve a pause. Federal guidance notes that fraudulent IT workers often avoid direct deposit to their own names.
Why Do Device Requests Matter?
Requests to work only on personal devices or to ship equipment to a different address can signal fraud. The FBI has warned about workers using stolen credentials to work from non-company devices.
Is It a Red Flag If a Contractor Has Other Clients?
No. Many contractors work for several clients. The red flag is vague or shifting answers about weekly hours or other commitments.
How Can I Avoid Bias When Screening for Fraud?
Apply the same checks to every candidate and document the reasons for any concern. An accent or a foreign degree isn’t a red flag by itself.
What Should Happen After a Contract Software Engineer Is Hired?
Keep verifying. Repeat identity verification at onboarding and watch early login patterns. Identity verification should continue for the whole engagement.