The person being impersonated. Someone is out there pretending to be them. This person is known to be willing to do unethical things. (Who knows, maybe they're also infiltrating the client's network and stealing data, installing ransomware, etc.?) Furthermore, how does the person in the US pretending to be the developer get paid? Do they actually get paid, or is that a scam, too? At any point does someone write a check to fake developer in their name? Does the IRS see that? Is the real developer now on the hook for taxes on that? There are numerous things that could go wrong and hurt the developer being impersonated, the person doing the impersonation, and the client.