How to Protect Yourself from Fake Job Postings

As cybercriminals become more sophisticated, their schemes and techniques are getting more and more complex - and clever. The latest? Preying on job seekers by using fake job postings and employment scams. This variation on “Phishing” has increased since people started working from home, many looking for new opportunities as part of the Great Resignation. If you believe this only impacts candidates, think again!

This scheme affects business owners too because it damages the company’s reputation and burns potential hires - making it even harder to fill positions and attract talent.

The Framework of an Employment Scam

Think about the application process for a minute, and you can see why this is a lucrative endeavor ripe for abuse. Applications, interviews, offers and onboarding can all be done online - and because of COVID, it’s pretty common practice.?

The scammers create an appearance of legitimacy by posting fake jobs on legitimate job boards - like Indeed. Then they link applicants to fake websites, sometimes even pretending to be large, well-known companies )like Amazon or Quest Diagnostics). It starts by having candidates fill out an application which leads to arranging and conducting fake interviews.

Or, they might send out messages on LinkedIn claiming to be a recruiter representing a legitimate company, having a LinkedIn profile that matches their claim.

Once they get unsuspecting candidates on the hook, they’ll schedule interviews and sometimes introduce the applicant to multiple criminals impersonating personnel - from HR to department heads. They’ll suck them in with emotional manipulation - tell them what a great candidate they are and how they’re such a perfect fit for the job - because we all want to feel validated when we’re on a job hunt.

Next, they’ll request the same kind of information that legitimate employers do - which is the tricky part. For example, they’ll ask candidates to sign an employment contract - not an unusual request. But they’ll take it one step further and ask for personally identifiable information (PII) in the contract before the candidate is “hired.” Or they might ask for credit card information to pay for things like background checks, training or start-up equipment with the goal of getting PII to apply for loans and credit cards, make purchases, drain people’s bank accounts, or just sell the info on the dark web. Often they disappear once they get the information, leaving the candidate feeling lost and confused.

Warning Signs of a Fake Job Posting Scam

Here are some tips, from the FBI, for job seekers that can help detect if a potential employer is really a criminal perpetrating employment fraud:

• Interviews not conducted in person or through a secure video call.
• Interviews conducted via teleconference applications that use email addresses instead of phone numbers.
• If potential employer contacts victims through non-company email domains and teleconference applications.
• If potential employers require employees to purchase start-up equipment from the company.
• If potential employers require employees to pay upfront for background investigations or screenings.
• If potential employers request credit card information.
• If potential employers send an employment contract to physically sign asking for PII
• Job postings appear on job boards but not on the companies’ websites.
• Recruiters or managers do not have profiles on the job board, or the profiles do not seem to fit their roles.

Next Steps for Candidates After Receiving an Online Job Offer

Cyber security professionals and the FBI also suggest you take the following actions if you receive a job offer online:

• Conduct a web search of the hiring company using the company name only. Results that return multiple websites for the same company (GreatCompanyLLC.com vs. GreatCompany.com) may indicate fraudulent job listings.
• Legitimate companies will ask for PII and bank account information for payroll purposes AFTER hiring and during the onboarding of new employees.?
• Never send money to someone you meet online, especially by wire transfer.
• Never provide credit card information to any employer!
• Never provide bank account information to employers without verifying their identity. Most companies today use a payroll provider which allows you to set this up on your own through their secure payroll platform.
• Do not accept any job offers that ask you to use your own bank account to transfer their money. A legitimate company will not ask you to do this.
• Never share your Social Security number or other PII that can be used to access your accounts with someone who does not need to know this information.
• Before entering PII online, ensure the website is secure by looking at the address bar. The address should begin with “https://”, not “https://”. However, criminals can also use “https://” to give victims a false sense of security. A decision to proceed should not be based solely upon the use of “https://”.

How to Protect Yourself if You Are a Business Owner

So, how do you protect yourself and your company? The FBI’s Crime Complaint Center (IC3) and other cyber security experts suggest the following:??

• Conduct a web search of your organization using your company name only - A red flag can be if you see multiple websites for your company with a variation on your domain name (GreatCompanyLLC.com vs. GreatCompany.com). This is a sign there may be fake job listings out there using your company as a front.
• Regularly search for jobs using your company name on all the major job boards - Indeed, Monster, LinkedIn, CareerBuilder, etc. Make sure those listings line up with your actual open positions.??
• Funnel all your job applications through your applicant tracking system with your jobs posted on your website career page -? Do not allow candidates to submit applications through other databases like LinkedIn Apply or Indeed. If you are unsure how to do this, we can help!
• Include application and hiring process information on your website - Let candidates know what to expect and what information you will and will not ask for. Be clear that you will not request credit card information. Also, that other PPI will only be requested after an applicant gets hired. Your website is also a great place to communicate if your company is ever a victim of this kind of crime. You can notify job seekers on your home page and warn them about the fraudulent activity.
• Make sure your website uses SSL/TLS certificates - These certificates ensure secure encrypted connections and assert your organizational identity. An easy way to confirm that your certificate is valid is by clicking on the little padlock icon next to your web address in the search field. If your certificate is expired, you will want to get it up to date right away.

Lastly, if you are the victim of an employment or fake job posting scam, the Federal Trade Commission (FTC) recommends you report it to the FBI’s Crime Complaint Center (IC3). The FTC also encourages job seekers involved in the scam to forward related emails to the Anti Phishing Working Group (APWG).

We are all in this together, so spread the word. Stay alert. Do not let your company, or your candidates, be a victim of fake job postings and offers.

If you found this article helpful, please give it a like! We also encourage you to share your experiences in the comments.

For help creating a safe and secure application and hiring process, contact our team of experienced talent consultants!