Spotting a fake job offer

However elaborate the pretext, a fraudulent job offer is trying to obtain money or documents. Money arrives disguised as a fee — registration, training, equipment, visa processing, background check. Documents are gathered for identity theft, often as an ordinary-looking onboarding pack.

This single observation is the most useful filter available. When a process begins moving towards either, treat everything preceding it as unverified regardless of how professional it appeared. Scams invest heavily in looking legitimate precisely because the request that follows will not.

It also means you do not need to identify the specific scam. You do not have to know whether this is an advance-fee scheme, an identity harvest or a money-laundering recruitment — noticing that it has begun asking for money or documents is sufficient to stop.

Individually these can have innocent explanations. Together they are conclusive, and in practice most fraudulent offers show several at once.

The strongest single indicator is an offer arriving with little or no assessment. Organisations do not make real employment commitments to people they have not evaluated, because hiring the wrong person is expensive. An offer without genuine interviews is not a lucky break.

Generated text has made the written signals less reliable than they were. Poor grammar used to be a giveaway and largely is not any more, which shifts the weight onto the structural signals — the absence of assessment, the payment request, the unverifiable channel — rather than how the message reads.

• Any request for payment, for any reason, at any stage
• An offer made without meaningful interviews or assessment
• Communication only through personal email or messaging apps
• Pay significantly above market with vague responsibilities
• Urgency — sign today, the position closes tonight
• Requests for identity documents or bank details before an offer is verified
• An offer letter with inconsistent formatting, wrong legal entity or odd language

The essential principle is that verification must not use any channel the sender provided. A fraudulent operation controls its own phone numbers, domains and reference contacts, so checking those confirms nothing.

Find the company yourself. Locate its official site through a search engine rather than a link in the email, call the switchboard number listed publicly, and ask to be connected to the person who contacted you. A real employer handles this routinely; a fraudulent one cannot survive it.

Check the email domain character by character rather than at a glance. Lookalike domains are the standard technique — a swapped letter, an added hyphen, a different top-level domain — and they are designed to survive exactly the quick glance most people give them.

• Search for the company independently — never use links you were sent
• Compare the email domain against the official one, character by character
• Call the publicly listed number and ask for the person by name
• Check the company register for the legal entity named in the letter
• Look up the recruiter on professional networks and check account age

It is tempting to assume only the careless are caught. In reality these succeed against experienced people, because they exploit circumstance rather than intelligence. Someone recently made redundant, or on a visa with limited time to find a sponsor, is under pressure that distorts judgement.

Scams are built for that pressure. Urgency is manufactured deliberately so there is no time to verify. Recognising urgency itself as the warning sign, independent of the content, is the most transferable defence.

The practical countermeasure is a rule made in advance. Deciding now that you will never send money to an employer and never share documents before an independently verified offer removes the decision from the moment when your judgement is worst.

A common pattern deserves specific mention. After an apparent hire, you are sent a cheque or transfer to buy equipment from a specified supplier. The payment is fraudulent and will be reversed, but the money you forward to the supplier — controlled by the same people — is gone, and it is yours.

The rule is simple: a legitimate employer never sends you money to pass to a third party. Any variation on this, however reasonably explained, is fraud.

The same logic covers the money-mule variant, where the "job" itself consists of receiving payments and forwarding them on. That is not merely a scam against you; participating in it is a criminal offence in most jurisdictions even when you believed it was employment.

The approach increasingly arrives through a channel that feels safe. A message on a professional network, a reply to an application you genuinely submitted, a contact who appears to work at a company you actually applied to — all of which lower suspicion before anything is asked.

Job boards are also targeted directly. A fraudulent posting on a legitimate board inherits the board’s credibility, which is why "I found it on a real site" is not verification of anything.

The defence does not change with the channel. Wherever the approach came from, the same two questions apply: has there been real assessment, and can I verify this through a route they did not give me.

Act quickly, and do not let embarrassment delay you. If you sent money, contact your bank immediately — rapid reporting is what makes recovery possible at all. If you shared identity documents, treat it as an identity theft risk: alert your bank, monitor your credit record and consider a fraud flag.

Report it. Fraud reporting feels futile individually and is what allows patterns to be identified and networks disrupted. Report to your national cybercrime or fraud authority, to the platform where you were contacted, and to the real company being impersonated, which usually wants to know.

Keep everything. Messages, email headers, account names, payment references and phone numbers are what an investigation works from, and deleting the thread out of frustration removes the only evidence that exists.