# Fake job offer emails: how recruitment scams work and how to stop them

URL: https://iblockspam.com/blog/fake-job-offer-recruitment-scam-emails
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake recruiter and job offer emails work, from equipment check scams to stolen IDs, the FTC's red flags, and what to do when scammers pose as your company.

## Short answer

A fake job offer email comes from a 'recruiter' offering quick, often remote work, then asks for your ID, bank details or money for equipment, sometimes with a check to deposit. Real employers don't charge you or send checks to forward. Verify the job on the company's own website, and report scams at ReportFraud.ftc.gov and ic3.gov.

Job seekers expect emails from strangers about jobs, which makes recruitment one of the easiest disguises for a scammer. A fake recruiter offers fast, well-paid, often remote work, and then the "onboarding" begins: your ID, your bank details, a check to deposit, equipment to buy. Businesses get caught in it too, both when staff receive fake HR emails and when criminals pose as the company's own recruiters.

## How common are job scams?

The FBI's [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 24,688 complaints of employment fraud in 2025, with $362,934,762 in reported losses. The IC3 defines employment fraud as when "an individual believes they are legitimately employed and loses money, or launders money/items during their employment." Those are only the cases people reported.

The FBI saw the pattern years ago. A [January 2020 IC3 announcement](https://www.ic3.gov/PSA/2020/PSA200121) said criminals "pose as legitimate employers by spoofing company websites" and post "fake job openings on popular online job boards," then contact applicants "by email to conduct an interview using a teleconference application." It reported "the average reported loss was nearly $3,000 per victim, in addition to damage to the victims' credit scores."

Big brands are a favorite cover. In April 2025, Amazon said it was "alerting consumers about the increasing prevalence of employment impersonation scams" using its name ([Amazon](https://trustworthyshopping.aboutamazon.com/amazon-scam-trends)). If your company is well known, assume someone will eventually recruit in its name.

## How does a fake job offer scam work?

Most follow the same arc: fast contact, fast offer, then a request for money or data.

### The fake recruiter

The FTC's [July 2025 alert](https://consumer.ftc.gov/consumer-alerts/2025/07/job-scammers-are-looking-hire-you) describes scammers who claim to recruit for a big-name employer and reach out by email or text with a remote job offer, sometimes from a personal phone number or email account. The offer arrives quickly, often with official-looking paperwork asking for your driver's license, Social Security number or bank account number. The FTC says real employers won't ask for that "before they've actually interviewed and hired you."

The FTC's [April 2026 alert](https://consumer.ftc.gov/consumer-alerts/2026/04/job-offer-text-probably-scam) describes a newer twist on text and chat apps: the message asks you to reply "YES" or "INTERESTED" rather than click a link. The FTC says that reply is the first step, and that "Real employers will never contact you that way."

### The equipment and fake check scam

The FTC's [August 2023 alert](https://consumer.ftc.gov/consumer-alerts/2023/08/scammers-impersonate-well-known-companies-recruit-fake-jobs-linkedin-other-job-platforms) describes the classic version: "You'll get an invoice (it's fake) for equipment like a computer they'll order for you," paid "using cash, Zelle, or PayPal." They promise to reimburse you, but they "won't because it's a scam."

A variant sends you a check first. You deposit it, keep your "first week's pay," and send the rest to an equipment "vendor." The FTC's [job scams page](https://consumer.ftc.gov/articles/job-scams) explains the ending: the check bounces, and "the bank will want you to repay the full amount of the fake check."

### The task scam

The FBI's [June 2024 announcement](https://www.ic3.gov/PSA/2024/PSA240604) describes "fake work-from-home jobs, typically involving a relatively simple task," such as rating restaurants. The job has "a confusing compensation structure," and victims are told to pay in, often in cryptocurrency, to unlock earnings. In reality "the payments go directly to the scammer."

### The package and payment forwarding scam

Some "jobs" ask you to receive parcels or payments and send them on. The IC3's definition of employment fraud explicitly covers people who "launder money/items during their employment." Forwarding stolen goods or money can make you part of a crime, even if you believed the job was real, and your bank account may be closed.

### The identity theft scam

Some fake jobs never ask for money. They collect your Social Security number, a photo of your ID and your bank details for "direct deposit," which is everything needed to open accounts in your name.

## What are the red flags?

| Red flag | What the FTC or FBI says |
|---|---|
| You must pay for equipment, training or a background check | "Honest employers will never ask you to pay" (FTC) |
| A check arrives and you're asked to send part of it on | No honest employer will ask this (FTC) |
| ID and bank details requested before an interview | Legitimate companies ask for these "AFTER hiring employees" (FBI) |
| The recruiter uses Gmail, Yahoo or a chat app | Recruiters "will generally email from a corporate email account" (FTC) |
| The interview is chat-only or text-only | The FBI lists interviews "not conducted in-person or through a secure video call" as an indicator |
| The job isn't on the company's own website | The FBI lists "Job postings appear on job boards, but not on the companies' websites" |
| Two websites for the same company | Results like "abccompany.com and abccompanyllc.com" "may indicate fraudulent job listings" (FBI) |

Check the sender's real domain, not the display name. Our guide on [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email) shows how, and the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) reveals which server sent a message. Watch for [lookalike domains](https://iblockspam.com/blog/lookalike-domain-phishing) such as an extra word or a swapped letter in the company name.

## How do you check whether a job offer is real?

1. **Find the job yourself.** Go to the company's website by typing its address, open the careers page, and look for the role. A [February 2022 FBI announcement](https://www.ic3.gov/PSA/2022/PSA220201) advises verifying postings "on the hiring company's own website or through legitimate HR representatives at the hiring company."
2. **Contact the company independently.** The FTC says to use a phone number or website you already know is legitimate, not one the "recruiter" gave you.
3. **Search for complaints.** The FTC suggests searching the company or recruiter's name with words like "scam," "review" or "complaint."
4. **Insist on a real interview.** A video call with someone you can match to the company's staff is a reasonable ask.
5. **Never pay to get paid.** No fees, no equipment purchases, no forwarding part of a check.
6. **Hold back sensitive details** until you've accepted a verified offer.

## What if you've already responded?

- **You sent money:** contact the bank, card issuer or payment app you used right away and ask to reverse the transaction, as the FTC advises.
- **You deposited a check:** tell your bank immediately and don't spend or forward the funds.
- **You shared your Social Security number or ID:** visit IdentityTheft.gov for a recovery plan and consider a credit freeze.
- **You gave a password or clicked a link:** follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).
- **Report it:** to the FTC at ReportFraud.ftc.gov and the FBI at [ic3.gov](https://www.ic3.gov), and to the real company through its official website.

## What about fake HR emails sent to your staff?

Recruitment lures have an internal cousin: emails that pretend to come from your own HR team. Common themes include an "updated salary schedule," a benefits enrollment deadline, a new handbook to sign, or a performance review. The goal is usually a password on a fake sign-in page or a change to someone's payroll bank details.

- Tag external email so a message "from HR" that arrived from outside stands out.
- Tell staff that HR announces changes through your HR system or intranet, and never asks for passwords.
- Require a phone or in-person check for any direct deposit change. Our guide to [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails) has a full procedure.
- Watch for [fake Microsoft 365 login pages](https://iblockspam.com/blog/fake-microsoft-login-phishing) behind "HR document" links.

## What can a business do when scammers pose as its recruiters?

If your company is well known, someone may already be using its name to recruit. You can't stop a criminal from typing your name into a Gmail display name, but you can make the fakes easier to spot and harder to send.

### Publish how you really hire

Put a short notice on your careers page and in genuine job ads. It might say:

- Every genuine opening is listed on this page.
- Our recruiters email only from addresses ending in our domain.
- We never ask candidates to pay for anything, buy equipment, or deposit checks.
- We don't interview by text message or chat app alone.
- Report suspicious offers to a named address, such as `recruiting-fraud@` your domain.

The FBI's advice to applicants is to verify postings on the company's own website, so make that website the single source of truth.

### Protect your sending domain

Publish a DMARC policy at enforcement (`p=quarantine` or `p=reject`) so mailbox providers reject or quarantine mail that spoofs your exact domain. Check your record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and see [how to stop spoofing of your domain](https://iblockspam.com/blog/stop-email-spoofing-of-your-domain). DMARC won't stop free webmail accounts or lookalike domains, so pair it with the other steps.

### Watch for lookalikes and fake listings

- Monitor for newly registered domains that contain your brand name, and report abusive ones to the registrar.
- Ask job boards to take down fake listings and recruiter profiles using your name.
- Brief your own HR and reception teams, because victims will call them. A short, kind script helps.

## Next steps

- Share the red-flag table with anyone in your family or team who is job hunting.
- Add a recruitment fraud notice to your careers page this week.
- Run an [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your domain enforces DMARC.
- Brief payroll on the [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) pattern behind fake HR and payroll requests.
- iBlockSpam filters phishing, spoofing and impersonation emails before they reach your staff, with a personal quarantine for every user. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Do real recruiters email from Gmail or Yahoo addresses?

Rarely. The FTC says recruiters will generally email from a corporate email account, not a personal address like @gmail.com or @yahoo.com. A personal address isn't proof of a scam on its own, but combined with a fast offer, no real interview, or requests for your ID or bank details, treat it as one.

### Why would a new employer send me a check to buy equipment?

It's a classic fake check scam. You deposit the check, buy 'equipment' from a vendor the scammer controls, and the check later bounces. The FTC says the bank will want you to repay the full amount. Honest employers never ask you to pay for equipment or send part of a check back.

### When is it safe to give an employer my Social Security and bank details?

After you've been hired by an employer you have verified. The FBI says legitimate companies ask for personal and bank details for payroll purposes after hiring. The FTC warns that fake recruiters ask for your driver's license, Social Security number or bank account number before they've interviewed and hired you.

### What can a company do when scammers pose as its recruiters?

Post a notice on your careers page explaining how you really recruit, list every genuine opening there, enforce DMARC on your domain, and give applicants an address to report fakes. Ask job boards to remove fake listings, and watch for lookalike domains using your name.

### Where do I report a fake job offer?

In the US, report it to the FTC at ReportFraud.ftc.gov, and to the FBI's IC3 at ic3.gov if you lost money or shared financial details. Tell the real company too, through contact details on its official website. If you sent money, call your bank or payment app immediately.

## Sources

- [FTC Consumer Advice: Job scams](https://consumer.ftc.gov/articles/job-scams)
- [FTC Consumer Alert: Job scammers are looking to hire you (July 2025)](https://consumer.ftc.gov/consumer-alerts/2025/07/job-scammers-are-looking-hire-you)
- [FTC Consumer Alert: Scammers impersonate well-known companies, recruit for fake jobs on LinkedIn and other job platforms (August 2023)](https://consumer.ftc.gov/consumer-alerts/2023/08/scammers-impersonate-well-known-companies-recruit-fake-jobs-linkedin-other-job-platforms)
- [FTC Consumer Alert: That job offer text is probably a scam (April 2026)](https://consumer.ftc.gov/consumer-alerts/2026/04/job-offer-text-probably-scam)
- [FBI IC3 PSA: Cyber Criminals Use Fake Job Listings to Target Applicants' Personally Identifiable Information (January 2020)](https://www.ic3.gov/PSA/2020/PSA200121)
- [FBI IC3 PSA: Scammers Defraud Individuals via Work-From-Home Scams (June 2024)](https://www.ic3.gov/PSA/2024/PSA240604)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [Amazon Trustworthy Shopping: The latest scam trends from Amazon](https://trustworthyshopping.aboutamazon.com/amazon-scam-trends)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-job-offer-recruitment-scam-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt