As ProPublica has reported, cybercriminals are flooding the internet with fake job ads and even bogus company hiring websites whose purpose is to steal your identity and use it to commit fraud. It’s a good reminder that you should vet potential employers as closely as they vet you.
ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.
Here are ten tips on how to spot such scams:
1. Beware of abnormally high salaries
One of the ways criminals entice people is by advertising unusually generous pay. If the salary being offered in a job ad is way above what you see in other ads for similar positions, be wary. You can get an idea of average weekly earnings by industry using the Quarterly Census of Employment and Wages or check out salary calculators on websites such as Glassdoor.
2. Don’t accept jobs you didn’t apply for
Sometimes cybercriminals obtain the contact information of people who have submitted their résumés to job-seeking websites and then email them to say they are preapproved for a job. These are bogus messages whose main purpose is to get people to share additional information, which the scammers will use to commit fraud. The emails may also include malware that can infect your computer. Ignore such messages and don’t open any attachments.
3. Be wary of job ads touting the need to verify your identity at the outset
Ads that demand you share your driver’s license or Social Security number as part of an initial application, or very soon after, are a significant red flag. Legitimate employers rarely request such information until much later in the hiring process.
4. Take the text of the job ad and put it in Google
Cybercriminals sometimes reuse the same job ads over and over, posting them on LinkedIn, Facebook and other online platforms with only slight modifications. If you spot an ad that features virtually identical language to that used by various employers all over the country, it could be a scam.
5. Research the identity of the person posting the ad
Cybercriminals are creating fake profiles on LinkedIn and Facebook meant to resemble individuals at real companies who are posting job ads. One clue: a person claiming to work for a company in the U.S. while showing check-ins at locations in other countries. When in doubt, contact the companies directly to ask if they’re actually recruiting for the positions. If they’re not, report the suspect profiles to LinkedIn and Facebook.
6. Check the spelling and domains of company names
When you vet companies, be aware that cybercriminals sometimes steer potential applicants to fake websites they’ve created that mimic the sites of real companies — except that, say, an extra letter has been added to the company’s name. When job applicants can’t spell a company’s name right in a cover letter, recruiters are apt to toss those applications in the trash. Do the same with any companies that seemingly can’t spell their own names.
7. Avoid text-only interviews
The pandemic has made it necessary for many employers to conduct job interviews remotely via services like Zoom. But be cautious of hiring managers who insist on communicating only by email or text or using messaging platforms such as Telegram to conduct interviews. Sooner or later, a real employer will want to see and interact with a recruit, whether through a video call or in person. Cybercriminals typically don’t want you to hear their voices or see their faces, since it raises the chances you’ll realize they’re not who they say they are.
8. Don’t give out your credit card or phone account login
A real employer doesn’t need to know your credit card number, credit score or phone account login to process your job application. Cybercriminals sometimes ask for such information up front to commandeer your phone and finances, often under the pretense of needing to set you up with a company phone plan or purchase equipment you’ll need to do your job (see next item).
9. Don’t buy things on behalf of a potential employer
Beware of companies that, before you’re hired, offer to send you a check to purchase a computer or other equipment. It’s a variation on an old scam that involves criminals asking marks to send their own money to some third party with the promise that they will reimburse the marks. Inevitably, the reimbursement doesn’t come through, and the mark is left holding the bag.
10. If something feels suspicious, investigate — or walk away
If at any point in the job application or interview stage something feels wrong to you, don’t ignore the feeling. Ask yourself if you see any of the warning signs outlined above. Or pause and ask a trusted friend or relative for a reality check.
Scammers Are Using Fake Job Ads to Steal People’s Identities
It has become a ubiquitous internet ad, with versions popping up everywhere from Facebook and LinkedIn to smaller sites like Jobvertise: Airport shuttle driver wanted, it says, offering a job that involves picking up passengers for 35 hours a week at an appealing weekly pay rate that works out to more than $100,000 a year.
But airports aren’t really dangling six-figure salaries for shuttle drivers amid some sudden resurgence in air travel. Instead, the ads are cybercriminals’ latest attempt to steal people’s identities and use them to commit fraud, according to recent warnings from the FBI, the Federal Trade Commission and cybersecurity firms that monitor such threats. The U.S. Secret Service, which investigates financial crimes, also confirmed that it has seen a “marked increase” in sham job ads seeking to steal people’s personal data, often with the aim of filing bogus unemployment insurance claims.
“These fraudsters, they’re like a virus. They continue to mutate,” said Haywood Talcove, chief executive of the government division of LexisNexis Risk Solutions, one of several contractors helping state and federal agencies combat identity theft. (ProPublica subscribes to public records databases provided by LexisNexis.)
ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.
This particular mutation is an emerging threat, Talcove and others said. The numbers are small so far, but they’re rapidly increasing. In March, LexisNexis detected around 2,900 ads touting unusually generous pay, using suspicious email domains and requiring that one verify one’s identity upfront. The total had grown to 18,400 by July, and then to 36,350 as of this month. Talcove said these figures are based on a small sample of job ads and that the real number is likely much higher.
This form of scam is surging at a moment when targets for job application fraud abound. Millions of Americans are quitting jobs and looking for new ones. An all-time high percentage of workers — 2.9% — quit their jobs in August, according to the U.S. Department of Labor. Meanwhile, huge numbers of laid-off workers are still looking for work, making for a historic churn in the labor market.
The ads reflect a tactical adjustment by cybercriminals. A massive wave of unemployment insurance fraud during the pandemic prompted authorities to heighten identity verification requirements. In most U.S. states, cybercriminals can no longer simply input stolen identity information into government websites and frequently collect unemployment insurance aid. Now, applicants whose names are used to apply for unemployment benefits often need to verify on their phones that they’re the ones seeking assistance, a process similar to two-factor authentication.
That means scammers may need help from their victims — and sometimes they go to elaborate lengths to mislead them. Some fraudsters recreate companies’ hiring websites. One fake job application site uses Spirit Airlines’ photos, text, font and color code. The phony site asks applicants to upload a copy of both sides of their driver’s license at the outset of the process and sends them an email seeking more information from a web address that resembles Spirit’s, with an extra “i” (spiiritairline.com). Spirit Airlines did not respond to requests seeking comment.
Other job scams are less elaborate and have more visible signs of inauthenticity. One fake ad for airport shuttle drivers on Facebook was posted by a woman who purported to be working at Denver International Airport. Diligent readers may have noticed that the only location linked from the woman’s Facebook profile was a Nigerian city called Owerri. (A spokesperson for the Denver airport reported the profile to Facebook after an inquiry by ProPublica, and the ad is no longer active.)
In other instances, unsolicited job offers simply land in applicants’ inboxes after they’ve uploaded their résumés to real job search sites, which scammers can access if they pose as potential employers. Jeri-Sue Barron has received a slew of emails since the start of the pandemic informing her that she was preapproved for a variety of jobs she hadn’t even applied for. Barron, a retiree in suburban Dallas, had uploaded her résumé to several job hunting sites in hope of finding some part-time work to supplement her Social Security income. She then received multiple job offers with nary a request for an interview. One email originated from a school in India’s Kerala state; another came from a Croatian website she’d never heard of. “They started coming in from places that were weird,” said Barron. “You almost don’t want to find out the next stage.” She ignored the offers.
As with fake unemployment claims more broadly, the fraud is being facilitated by an underground infrastructure, including online forums where cybercriminals share advice on how to perfect their techniques. A person using the handle “cleverinformation” on a U.K. forum called Carder put together a how-to video that recommends posting fake job ads using a generic job application that can be modified to collect personal data. In September, someone going by “mrdudemanguy” on another forum, known as Dread, offered this advice to a person seeking stolen identities: “Pretend to be a local business and post some job ads. When they send in their résumé, call them and ask some basic job application questions. Make them think they’ve got the job as long as they can do a background check. For the background check request they send you photos or scans of ID documents.”
In response to a query from ProPublica, mrdudemanguy did not answer questions about sharing fake ads and instead focused on explaining the source of his recommended technique and its success. “I have not tried this method myself,” he wrote. “It’s just a method that I know other people do and it does work. It can be done in any part of the world, the country does not matter. As long as the job ad looks legitimate, a person looking for a job will be likely to apply.” Questions sent to cleverinformation yielded a similar response. “It’s effective,” the person said, noting that it’s an underused technique. The person added: “Trying to start a group chat where we share our knowledge.”
The ubiquitous ad for airport shuttle drivers was discussed in a similar forum. One version of it was posted in a Telegram channel of a Nigerian scam group called Yahoo Boys Community, along with instructions on what to tell applicants to get them to share their Social Security number, photographs of their driver’s license and other personal details. The post urged the group’s 5,000 members to ask applicants generic questions via email and offer them the gig — but only if they first shared their personal documents to land the plum job. “Once the client gives you the details, buzz me on WhatsApp and let start work on it Asap,” read the July message, whose initiator could not be identified.
Job application scams have been around in various forms for years. Some entice applicants to buy equipment or software from the scammers in preparation for a nonexistent job. Others try to trick victims into working for free or reshipping goods bought with stolen credit cards. But, according to law enforcement agencies, using fake job ads to steal identities and using them to cash in on government benefits is a new wrinkle.
Alexandra Mateus Vásquez fell for one such scam in December 2020. An aspiring painter, Vásquez was thinking of quitting her sales job at a suburban mall near New York City. She applied for a graphic designer position at the restaurant chain Steak ‘n Shake via the widely used job website Indeed. She was elated when what appeared to be a Steak ‘n Shake representative invited her via Gmail to participate in an email screening test for the job.
Conducting an interview via email initially struck Vásquez as odd, but she proceeded because the questions seemed standard. They included queries like “How do you meet tough deadlines?” according to emails she shared with ProPublica, and she provided earnest answers. Hours later she received an email offering her the job and asking for her address and phone number so a formal offer letter could be dispatched. The offered pay was attractive: $30 per hour. When the letter arrived, it sought her Social Security number, too. Vásquez provided all the requested information.
Soon Vásquez was invited for a background check, via online chat, with a supposed hiring manager. She found herself trading messages with an account that had a blurry photograph of an old man and the name “Iran Coleman” attached to it. (Several other applicants described similar experiences in a discussion about the Steak ‘n Shake job on the hiring site Glassdoor.)
The person claiming to be the Steak ‘n Shake’s hiring manager requested copies of Vásquez’s personal records to verify her identity. She shared photographs of her New York state ID and her green card but grew suspicious when the person asked for her credit card number, too. As Vásquez hesitated, she got a call from ID.me, an identity verification vendor used by 27 states to safeguard their unemployment insurance programs. The company asked if she was applying for jobless aid in California. That’s when she realized she was being scammed. “I was so disappointed,” Vásquez said. “I really believed that that position was real.”
Steak ‘n Shake did not respond to messages seeking comment. (ProPublica was able to reach Iran Coleman, the purported Steak ‘n Shake manager cited in the scam. He said the Louisville Steak ‘n Shake he used to manage is closed and he hasn’t worked there since at least 2014. He said he hadn’t updated his cursory LinkedIn profile, which lists him as a Steak ‘n Shake restaurant manager, in years. Coleman said he now manages three Waffle House restaurants. “I feel for that person,” he said of Vásquez when informed of her experience.)
Vásquez reported the incident to the police and contacted the Social Security Administration, which informed her that it had denied multiple requests to create an account in her name. (A spokesperson for the agency said privacy laws preclude it from discussing individual cases.) She then gave up on her job search. “I started doubting if all the jobs I’m applying for are real,” she said. Vásquez recently launched a website to begin selling paintings online and still hopes to become a design professional.
Blake Hall, chief executive of ID.me, said the company has rolled out language on its systems that informs users when their identities are being used to apply for unemployment insurance benefits and warns them not to proceed if they are being offered a job. Hall said it’s ultimately up to users to heed such warnings. “We will do as much as we can to make it clear that they’ve been scammed,” he said, “but ultimately protecting somebody from themself is a really tall order.” He compared his company to a goalkeeper who also needs help from other members of the team, in this case the job websites where criminals post fake ads.
The Better Business Bureau said in an alert last month that Indeed, LinkedIn and Facebook topped the list of online platforms where users reported spotting fraudulent job advertisements that duped them.
Indeed removes tens of millions of job listings that do not meet its quality guidelines each month, according to a company spokesperson, and it declines to list employers’ jobs if they do not pass those guidelines. In July, the site published a blog post detailing how to spot scam job ads. “Indeed puts job seekers at the heart of everything we do,” the spokesperson said.
LinkedIn removed 10 fake airport shuttle job postings after they were pointed out by ProPublica. A spokesperson said that posting bogus job ads is a “clear violation” of LinkedIn’s terms of service and said the company is investing in new ways of spotting them, such as hiring more human reviewers and expanding a work-email verification system for potential employers.
Facebook took down some of the airport shuttle posts after ProPublica alerted the service, but the company did not respond to questions about its processes for spotting and removing fake ads.
In recent months, the social media platform has also been plagued with fraudulent pages masquerading as state unemployment agencies. Some states complained to the U.S. Department of Labor that Facebook was slow to act on their requests to remove such pages, according to a March email from the department to state workforce agencies disclosed under a public records request. A Department of Labor official said that in March the agency set up a new process for states to report fake unemployment insurance websites to Facebook and that “to date, Facebook has been responsive in taking down fraudulent pages” reported by states.
New ones, however, keep popping up: A fake version of California’s Employment Development Department Facebook page was live as of Oct. 12. The agency confirmed the page was not its own, and it was removed from Facebook shortly after ProPublica’s inquiry.
Even if online platforms clean up their job postings, other identity theft scams are proliferating. On Oct. 15, the FBI issued an alert warning about fake websites that cybercriminals created to resemble the state unemployment websites of Illinois, Maryland, Nevada, New Mexico and Wisconsin. Criminals use the sites to steal victims’ sensitive personal information, according to the FBI.
