How do you do that in practice though? You won't know the engineer is a con-man until after you have spent $$ and months into the process. Then you are in the position of trusting nobody.

Welcome to the problem of hiring and managing employees generally.