# Email security for staffing and recruiting agencies: the risks and the fixes

URL: https://iblockspam.com/blog/email-security-for-staffing-recruiting-agencies
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for staffing firms: temp payroll diversion, fake recruiters using your name, deepfake candidates and résumé malware, with a recruiter checklist.

## Short answer

Staffing agencies are targeted because recruiters open résumés from strangers, payroll pays many temporary workers, and the agency's name is easy to borrow for fake job offers. The main risks are payroll diversion, recruiter impersonation, fraudulent candidates and malicious attachments. Use MFA, verify every pay change by phone, publish DMARC and filter inbound mail.

Recruiters are paid to open email from strangers. Résumés arrive as attachments, candidates send links to portfolios, and placements depend on replying fast. Behind that inbox sit payroll for hundreds of temporary workers and files full of Social Security numbers. This guide covers the email threats specific to staffing and recruiting firms, with the FBI's and FTC's own descriptions, and a checklist your recruiters and payroll team can follow.

## Why are staffing agencies targeted by email attacks?

Staffing agencies are targeted because they process a large volume of email from unknown people, run payroll for many short-term workers, and hold sensitive identity data on every candidate. Each of those is a separate way in.

- **Unknown senders are the job.** A recruiter can't refuse attachments from people they've never met, so "don't open unexpected files" doesn't work as a rule on its own.
- **High-volume payroll.** Temporary and contract workers start, stop and change bank details often, so a fake direct deposit change looks routine.
- **Valuable records.** Applications, I-9 documents and background check forms contain names, dates of birth, Social Security numbers and ID scans.
- **A borrowed brand.** Job seekers trust an agency's name, which makes it ideal cover for fake job offers.
- **Remote placements.** Agencies that place remote IT staff can unknowingly deliver a fraudulent worker into a client's network.

## What email threats do staffing firms face?

Staffing firms face payroll diversion, recruiter impersonation, fraudulent candidates, malicious attachments and client invoice fraud.

| Threat | What arrives | Who it targets | Main defense |
|---|---|---|---|
| Payroll diversion | A "worker" asks to change direct deposit, or a phish steals a payroll login | Payroll, branch staff | Phone verification; MFA on payroll |
| Recruiter impersonation | Fake offers in your name sent to job seekers | Candidates, your reputation | DMARC; public hiring policy |
| Fraudulent candidates | Stolen identity, deepfake interview, coached applicant | Recruiters, clients | Identity checks; in-person steps |
| Résumé malware | An attachment or link that installs malware | Recruiters | Block risky file types; filter mail |
| Client invoice fraud | "Please pay our invoice to a new account" sent to your clients | Accounts receivable, clients | DMARC; call-back policy |

### Payroll diversion

**Payroll diversion** is when a criminal redirects an employee's pay to an account they control. The FBI described the pattern in 2018: criminals phish employees for their payroll logins, change the bank details, and add rules "preventing the employee from receiving alerts regarding direct deposit changes", with deposits sent to "an account controlled by the cybercriminal, which is often a prepaid card" ([IC3 PSA](https://www.ic3.gov/PSA/2018/PSA180918)). The FBI's advice includes scrutinizing employee requests to change direct deposit details and requiring two-factor authentication.

For an agency, the simpler version is just as common: an email "from" a temp worker asks for their next check to go to a new account. Our guide to [payroll diversion scam emails](https://iblockspam.com/blog/payroll-diversion-scam-emails) has the full verification procedure. The short form:

1. Never change bank details because of an email or a reply to one.
2. Call the worker on the number in your records from before the request.
3. Have a second person approve the change.
4. Send a confirmation notice to the worker's old contact details.
5. Flag any request to move pay to a prepaid card or a newly opened account.

### Fake recruiters using your agency's name

Criminals pose as recruiters for real companies to steal money and identities from job seekers. The FTC warns of scammers "posing as 'recruiters' for well-known companies", sending an "official-looking offer letter, complete with the company's name and logo", then billing candidates for equipment or asking for driver's license, Social Security or bank account numbers ([FTC](https://consumer.ftc.gov/consumer-alerts/2023/08/scammers-impersonate-well-known-companies-recruit-fake-jobs-linkedin-other-job-platforms)). The FTC flags a company recruiter writing from a personal email address as a warning sign.

The scale is large. The FBI's IC3 recorded 24,688 employment fraud complaints in 2025, with $362,934,762 in reported losses ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). When your name is used, the victims call you. Our guide to [fake job offer emails](https://iblockspam.com/blog/fake-job-offer-recruitment-scam-emails) covers what candidates should check and what a firm can publish to help them.

Here's an example of the kind of message criminals send in an agency's name:

> Example: "Congratulations! Following your interview with Example Staffing, you've been selected for a remote data entry role at $32/hour. Please send a copy of your driver's license and your bank details for direct deposit setup. Equipment will be purchased by check, which you'll deposit and forward to our approved vendor."

### Fraudulent and deepfake candidates

Some applicants aren't who they say they are. In 2022 the FBI warned of a rise in complaints about people using deepfakes and stolen personal data to apply for remote IT, programming, database and software jobs, some with access to customer data and financial systems. Interviewers reported voice spoofing and lip movements that didn't match the audio, and background checks found applicants using other people's identities ([IC3 PSA I-062822-PSA](https://www.ic3.gov/PSA/2022/PSA220628)).

In January 2025 the FBI warned that North Korean IT workers placed in remote jobs were stealing source code and extorting employers, and had used AI and face-swapping during video interviews. Its recommendations speak directly to staffing: "Verify third-party staffing firms" conduct strong hiring practices, check whether email addresses and phone numbers appear on multiple résumés, watch for changes of address or payment platform during onboarding, and complete as much hiring and onboarding as possible in person ([IC3 PSA I-012325-PSA](https://www.ic3.gov/PSA/2025/PSA250123)).

Email is where many of those signals show up first. Keep candidate email addresses searchable in your applicant tracking system so a recruiter can see when the same address or phone number appears on two "different" people.

## How do recruiters handle résumés safely?

Handle résumés safely by narrowing which file types you accept, blocking the dangerous ones before they reach a recruiter, and opening unusual files in a viewer rather than desktop software. A "résumé" is a good lure precisely because opening it is part of the job.

- **Ask for PDF or DOCX only** in job ads and on your careers page.
- **Block what candidates never need to send:** macro-enabled Office files, scripts, executables, disk images and password-protected archives. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) and [Office macros blocked from the internet](https://iblockspam.com/blog/office-macros-blocked-from-internet).
- **Prefer uploads through your applicant tracking system** to direct email, so files are handled in one place.
- **Treat portfolio links with care.** Sign-in prompts after clicking a "shared résumé" link are a phishing sign. See [file sharing notification phishing](https://iblockspam.com/blog/file-sharing-notification-phishing).

## How do you stop criminals impersonating your agency?

Stop exact-domain impersonation by publishing SPF, DKIM and DMARC, and moving DMARC to enforcement so that mail faking your domain fails and can be rejected. **DMARC** is a DNS record that tells receiving servers what to do with mail that claims to come from your domain but fails authentication. CISA's joint phishing guidance asks organizations to "ensure DMARC is set to 'reject' for sent emails" ([CISA](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)). A record at enforcement (example domain):

```
_dmarc.example-staffing.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-staffing.com"
```

DMARC can't stop a criminal using Gmail or a lookalike domain. For those:

1. **Recruit only from company addresses**, and say so on a public "How we hire" page.
2. **State plainly that you never charge candidates** or send checks to deposit.
3. **Watch for lookalike domains** of your agency name. See [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).
4. **Report fake listings** to the job board and to ReportFraud.ftc.gov.

The same records protect your clients from fake invoices sent in your name, which our [vendor invoice fraud guide](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) covers.

## Is built-in email filtering enough for a staffing agency?

For a single-office agency, Microsoft 365 or Google Workspace filtering plus MFA, DMARC and attachment rules is a sound baseline. Be realistic: no filter can tell a real candidate's résumé from a well-made fake every time, so payroll verification and identity checks still matter most.

An MX-level filter in front of your mailboxes helps when:

- **Recruiters need to find held mail fast.** Each user gets a personal quarantine with scheduled digests, so a candidate's résumé caught as suspicious can be reviewed and released without a ticket.
- **You run several brands or branch domains.** Per-domain pricing with unlimited mailboxes (mailbox count, not message volume) keeps seasonal recruiters and branch staff from changing the bill.
- **You want attachment rules in one place.** Attachment-type filters, a Microsoft Office macro filter and geographic filters apply before mail reaches any mailbox.

Compare the costs on our [pricing page](https://iblockspam.com/pricing).

## How should a staffing agency secure its accounts?

Secure accounts by giving every recruiter and payroll user their own login with multi-factor authentication (**MFA**), a second check at sign-in beyond the password. CISA's joint phishing guidance says to prioritize phishing-resistant MFA for administrator and privileged accounts, such as those with "broad access to customer or financial data". Treat payroll, applicant tracking system and background check portal logins the same way.

Recruiter turnover is high, so offboard quickly and check departing users' mailboxes for forwarding rules. See [employee offboarding email security](https://iblockspam.com/blog/employee-offboarding-email-security) and [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).

## Staffing agency email security checklist

1. Turn on MFA for every mailbox, payroll login and applicant tracking system account.
2. Write a direct deposit change procedure that never relies on email alone.
3. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
4. Publish a "How we hire" page: company addresses only, no fees, no checks.
5. Accept résumés as PDF or DOCX, and block risky attachment types.
6. Add identity checks that run from interview through placement, with in-person steps where possible.
7. Cross-check candidate email addresses and phone numbers for duplicates.
8. Give recruiters one easy way to report a suspicious email. See [how to report phishing email](https://iblockspam.com/blog/report-phishing-email).

## Next steps

- Check your agency's SPF, DKIM and DMARC with the free [Email Health Check](https://iblockspam.com/tools/email-health-check).
- Send your payroll team the five-step direct deposit procedure above.
- Put your "How we hire" statement on your careers page and in recruiter signatures.
- If you're adding a filtering layer, iBlockSpam's [pricing](https://iblockspam.com/pricing) is per domain, not per recruiter.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why are staffing agencies a target for email scams?

Staffing agencies combine three things criminals want: recruiters who must open attachments from strangers, payroll that pays many short-term workers who change bank details often, and a trusted brand that job seekers respond to. Candidate files also hold Social Security numbers and ID scans, which are valuable for identity theft.

### How do I stop scammers posing as my recruiters?

Publish DMARC at enforcement so criminals can't send from your exact domain, recruit only from company addresses, and post a public page saying how you really hire and that you never charge candidates. Then watch for lookalike domains and fake listings, and report them to the job board and to ReportFraud.ftc.gov.

### Can a résumé attachment contain malware?

Yes. Any document or archive can carry a malicious link, macro or embedded file, and a 'résumé' is a lure recruiters are expected to open. Ask for PDF or DOCX only, block macro-enabled Office files, scripts and archives from outside senders, and open anything unusual in a web viewer instead of desktop software.

### How can recruiters spot a deepfake job candidate?

A 2022 FBI alert says interviewers reported voice spoofing, and lip movements or coughs that didn't match the audio. A 2025 FBI alert advises cross-checking résumés and contact details against other applicants, verifying identity throughout employment, and completing as much hiring as possible in person. Treat a sudden change of address or payment platform during onboarding as a warning sign.

### How should a staffing agency verify a temp worker's direct deposit change?

Never accept a bank change from an email alone. Call the worker on the phone number in your records from before the request, or confirm in person, and send a notice to the old contact details after any change. Require a second person to approve changes, and watch for several workers' pay moving to prepaid cards.

## Sources

- [FBI IC3 PSA: Cybercriminals Utilize Social Engineering Techniques To Obtain Employee Credentials To Conduct Payroll Diversion (September 2018)](https://www.ic3.gov/PSA/2018/PSA180918)
- [FBI IC3 PSA I-062822-PSA: Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions (June 2022)](https://www.ic3.gov/PSA/2022/PSA220628)
- [FBI IC3 PSA I-012325-PSA: North Korean IT Workers Conducting Data Extortion (January 2025)](https://www.ic3.gov/PSA/2025/PSA250123)
- [FTC Consumer Alert: Scammers impersonate well-known companies, recruit for fake jobs on LinkedIn and other job platforms (August 2023)](https://consumer.ftc.gov/consumer-alerts/2023/08/scammers-impersonate-well-known-companies-recruit-fake-jobs-linkedin-other-job-platforms)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One (October 2023, PDF)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-staffing-recruiting-agencies (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt