FBI warns of fake job postings used to steal money, personal info

Scammers are trying to steal job seekers’ money and personal information through phishing campaigns using fake advertisements posted on recruitment platforms.

The warning was published today as a public service announcement (PSA) on the Bureau’s Internet Crime Complaint Center (IC3).

“The FBI warns that malicious actors or ‘scammers’ continue to exploit security weaknesses on job recruitment websites to post fraudulent job postings in order to trick applicants into providing personal information or money,” the FBI says.

“These scammers lend credibility to their scheme by using legitimate information to imitate businesses, threatening reputational harm for the business and financial loss for the job seeker.”

Such scams have been around since early 2019, with average reported losses of almost $3,000 per victim besides the damage inflicted on victims’ credit scores.

The federal law enforcement agency issued a similar warning in January 2020, saying that cybercriminals also began spoofing legitimate companies’ sites to steal job applicants’ money and personally identifiable information (PII).

Crooks are taking advantage of the lack of strong security verification standards on recruitment websites to post fake job openings indistinguishable from those published by the companies they’re impersonating.

As BleepingComputer reported last year, anyone could have created job listings on behalf of almost any company on the LinkedIn recruitment platform without any verification.

“Fraudulent job listings include links and contact information that direct applicants to spoofed websites, email addresses, and phone numbers controlled by the scammers where the applicant’s personal information can be stolen and then sold or used in additional scams,” the FBI explained.

How to protect yourself from hiring scams

The FBI advises job seekers to verify job ads found on networking sites by reaching out to the company’s HR department or on its official site.

They’re also recommended to only provide PII and financial info in person or a video call, only after verifying their identity.

One or more of the following indicators should give away fake job scammers:

• Interviews are not conducted in-person or through a secure video call.
• Interviews are conducted via teleconference applications that use email addresses instead of phone numbers.
• Potential employers contact victims through non-company email domains and teleconference applications.
• Potential employers require employees to purchase start-up equipment from the company.
• Potential employers request credit card information.
• Job postings appear on job boards, but not on the companies’ websites.
• Recruiters or managers do not have profiles on the job board, or the profiles do not seem to fit their roles.

The Federal Trade Commission (FTC) also provides info on how such job scams work, as well as the signs job applicants should look for to identify when they’re being targeted.

“The COVID-19 pandemic has drastically changed interview and hiring processes making it imperative that businesses and job applicants verify the legitimacy of postings and employment opportunities,” the FBI added.

“The FBI urges the American public to use caution when applying for and accepting positions through an entirely remote process that has limited or no in-person meetings, contact, and onboarding.”

If you fall victim to such a scam, you should report it to IC3 at www.ic3.gov or to your local FBI field office (you can find a list at www.fbi.gov/contact-us/field-offices).