Avoiding Hiring Scams

One of the most devious forms of phishing is where miscreants pose as well-known brands looking to hire new employees. They show up on popular job hiring websites (e.g., LinkedIn, Monster, Indeed, ZipRecruiter, etc.), pose as potential employers, and then trick a job applicant into revealing too much personal information or into downloading trojan horse malware. In the worst cases, they have tricked applicants into sending money in search of a good job.

These types of scams have been around for nearly as long as job sites. Some of the sites make it fairly easy for the scammers to pull off because they do not strongly verify that a contact claiming to be a hiring manager for a particular brand really is an official employer for that brand. Here is a recent article involving LinkedIn: https://blog.knowbe4.com/cybercriminals-can-post-jobs-on-linkedin-posing-as-any-employer-they-want.

The fake employers, once engaged by a possible victim, ask a few questions to get to know the victim. Then they offer that dream job…one where they overpay you, you can work from home or from the office (your choice), have flex hours, travel when and where you want, get state of the art tech equipment, maybe get a company vehicle, get automatic first-class flights, basically write your own job description and be your own boss. They may throw in that they plant CO2-replacing trees in your name. Whatever it is that you are seeking, as learned by reading your resume/profile and interacting with you, they deliver. It is your dream job! There are other types of job-seeking scams, including scammers posing as resume writers, job hunters, security clearance application services, background check agencies and services whom will get you that desired dream job.

It seems too good to be true because it is.

Note: Here is the FTC’s site on job scams: https://www.consumer.ftc.gov/articles/job-scams.

Solution

So how do you figure out if that job is truly your dream job or just a scam?

Be Suspicious of High-Risk Claims

Job scammers like to use particular claims, jobs and job attributes to attract applications. Any work from home (even though often legitimate) immediately raises risk. If the job says or implies “easy money”, that is an unusual phrase to use in a legitimate job description. Even if a real job pays well, they rarely say “easy”. Those two things are usually mutually exclusive of each other. If the job is centered around envelope stuffing, claims processing, mystery shopping, buying goods or check processing, be beyond suspicious.

Check for Job Position on Vendor’s Website

If the vendor or headhunter has a specific job in mind, that job is likely posted up on the vendor’s website. Go to the vendor’s website and see if you can find the same position being offered. If not, it is a little suspicious. If the vendor is a well-known vendor and the job is posted on their legitimate job’s website, that at least confirms the job is real. But you still need to confirm the person you are dealing with is authorized to be involved with that particular job fulfillment.

If the vendor is not well known, even if you go to the vendor’s website and the job is there, research the vendor and their website. How long has the vendor been around? Do search engine results pull up people complaining of scams? How long has the vendor’s website been around? Do a WHOIS lookup (there are dozens of free Whois lookup sites on the Internet) on the vendor’s domain name. Look for the “creation date”, which will show when the domain name was first registered. If the original domain name registration is less than a year old, then it is highly suspicious. Does the vendor’s website look legit, or is it unprofessional and skimpy-looking? Does the hiring manager’s emails or the website have typos in them? Basically, if you are seeing unprofessional clues that make you nervous, pay attention to those clues.

Or Send an Email to Company’s HR Email Address

You can always send an email to the company’s advertised HR email address asking if a particular job is being advertised and if a particular job site or headhunting firm is legitimately involved.

Tell the Hiring Manager To Prove It

Tell the hiring manager that you are worried about job scams and ask them to prove to you that the job is legitimate and that they are a legitimately-involved party. This can include having them send you an email from the vendor’s email system (and making sure the email’s DMARC check passes). If they do not work directly for the involved company and cannot send an email from that company’s email system, ask them to get someone within HR in that company to send you a valid email. Receiving an email from the involved company’s valid email domain is decent evidence of proof of involvement.

Note: If you do not know what DMARC is, check out: https://info.knowbe4.com/dmarc-spf-dkim-webinar.

Ask if You Can Call the Hiring Manager

Ask the hiring manager if you can call them on a verified phone number tied to the advertised vendor. It is not enough that they tell you which number to call, but can you find that number associated with the real vendor? If the hiring manager works for a headhunting firm, can you call them through a publicly known number that you can find associated with that headhunting firm and ask to speak to or be redirected to them?

Is the Interview Normal?

We all know how normal interviews go. We do not know whether or not the job is ours until the end. Legitimate interviewers spend at least half the time telling you about the job, making sure you have enough details and are a good fit for the position. Then they listen to you. No one wants to hire someone who does not work out. Did they offer you the job after simply messaging, with no over the phone or face-to-face interviews? If they do a quick interview…too quick…and then offer you this dream job, then be very suspicious. If they cannot describe the job and benefits in detail, be suspicious.

Do Not Pay For the Promise of a Job

If anyone asks you to pay to get a job, run. Quality headhunters get paid on the backend for delivering highly qualified candidates. If they want your banking details, run. If they want you to pay a fee for a security background check, think long and hard. Usually, the hiring company pays for these sorts of things. If the hiring manager says they will send you a reimbursement check after you pay, run. This is not normal.

Check for Security Tips on Job Site

If the job is advertised on a job site, look for the “security tips” on that job site. They always have them. They will have warnings to look out for, recommendations and what to do if you think you are a possible victim of a job scam.

Report the Fraud

Report the fraud to the job site involved. Report the fraud to the FTC (https://reportfraud.ftc.gov/#/) or whatever government agency in your country is involved. In the U.S., you can also report job fraud to your state’s attorney general (https://www.naag.org/find-my-ag/). Report the job fraud to the brand company that the fraud was posing as. If the fraudster used an online email or social media service (e.g., Gmail, Facebook, etc.), report the account they used to that vendor as well. To be honest, this is not going to do much, but it might help the next victim a little and at least result in statistics collection. Law enforcement and the involved vendors cannot mitigate what they do not know about.

Note: I once had a friend, who once he identified a job scam artist, tried to waste as much of their time as possible. His thinking was that the more time that fraudster wasted on him, the less time that fraudster had to scam other real job seekers. For fun, he used to see just how insane his requests could be and still see if the fraudster would accept them. They always would. He would tell them that they HAD to always address him by strange, supposedly glorious titles, like “King El-Jarbar, Unground Titan of Los Angeles”. He would tell them they had to convince his dog that he would take the job and then angle toward his dog sleeping on the floor. I do not think most people should do this, but his stories often brought a tear to my eye.

Be Careful What You Post Online

Be aware that unscrupulous people could be mining your job seeking ad or resume for information to use against you. Be careful using your permanent personal email address. Instead, set up a temporary email account for resume purposes or use the job site’s contact method. Do not post your home, cell or work phone numbers in a job ad or on your resume. In general, realize that anything you post can be used against you by the scammer. A shorter resume is better anyway for the real employers.

Apply Using a Vendor’s Job Site

Want your dream job? Go to the vendor’s HR or job hiring website. For example, KnowBe4’s is https://www.knowbe4.com/careers. That way, you know you are getting your resume to the right people for consideration.

Do Not Become a Money Mule

This article does not discuss illegal, but real jobs, such as “money mules”. Money mules are people who accept checks from ransom strangers or show up at ransom locations to pick up shipping packages, and then re-distribute the money or re-ship the packages to somewhere else in exchange for a cut of the proceeds. I used to think that most money mules were innocent, na?ve people who were duped into the money mule role accidentally, but now it seems that it is the way that some unethical people like to work. Do not be a money mule! Do not become an unsuspecting money mule.

If It Is Too Good To Be True It Probably Is

In general, if you find yourself being offered your dream job…beyond your wildest dreams…beyond your most hoped for salary payment, with absolutely no negatives, start to be very suspicious.

I am not saying dream jobs do not happen. I am in my dream job now…really. But it did not start out with someone promising me the world, weird, skimpy websites, people saying yes to every question I had, and them telling me how it would be “easy money”. In fact, I was told it was going to be a hard job with lots of challenges. I had several remote and in-person interviews. No one asked me for my banking information. No one asked me to pay a fee upfront. Real jobs rarely do that.

It is a strange world we live in. Scammers lurk everywhere. If you or someone you care about is seeking a job, it cannot hurt to share this article with them.