Fake LinkedIn message emails: how to spot them and what to do

"You have 1 new message from Sarah Chen, Procurement Director." LinkedIn notification emails look harmless, arrive at work addresses all day and invite a quick click, which makes them an easy disguise for phishing. This guide shows what fake LinkedIn emails look like, how to check one against LinkedIn's own guidance, and what IT should do if someone already signed in on a fake page.

What is a fake LinkedIn message phishing email?

A fake LinkedIn message phishing email is an email made to look like a LinkedIn notification, such as a new message, InMail, connection invitation or "your profile appeared in searches", that leads to a fake LinkedIn sign-in page or a malicious file. The fake page steals your LinkedIn password, and sometimes your work Microsoft 365 or Google password when the page claims you must "sign in with your company account" to read the message.

LinkedIn itself says plainly that it never asks for your password or asks you to download programs (LinkedIn Help).

Common versions of the lure

LinkedIn lists "Falsely communicating a policy violation" and "Impersonating brands or trusted organizations by using company logos" among the signs of a phishing message (LinkedIn Help).

Example of a fake LinkedIn message email

This is an example written for this guide. It is not a real LinkedIn email.

From: LinkedIn <messages-noreply@linkedin-notify-mail.com>
Subject: Sarah Chen sent you a message

You have 1 new message

Sarah Chen
Procurement Director at Northfield Supply Group
"Hi, following up on the purchase order we discussed. The updated
quote is ready for your review before Friday."

[ View message ]

You are receiving LinkedIn notification emails.

What gives it away: the sender domain isn't one LinkedIn names, there is no security footer with your own name and headline, and the "message" pushes a deadline and a document. The real check is simpler still: the message won't be in your LinkedIn inbox.

How do I tell a real LinkedIn email from a fake one?

Check LinkedIn directly. LinkedIn's advice is to open a new browser window, go to LinkedIn.com yourself and look at your inbox there (LinkedIn Help). If the message or invitation isn't there, the email is fake.

Then use these checks, in this order:

1. Sender address. LinkedIn's phishing page says emails from linkedin_support@cs.linkedin.com, linkedin@e.linkedin.com and linkedin@el.linkedin.com "are not phishing emails", and notes that "LinkedIn has several email domains, which are determined by our email service provider (ESP)." A lookalike such as linkedln.com (with an "l" for the "i") or linkedin-notify-mail.com is not LinkedIn. Our guide to lookalike domain phishing explains the common tricks.
2. Security footer. Real LinkedIn emails include your name and professional headline in a footer. LinkedIn says "the presence of this security footer message alone doesn't guarantee that an email is legitimate" (LinkedIn Help), but a missing or generic footer is a strong warning sign.
3. Link destination. Hover over the button on a computer, or long-press on a phone. The domain should end in linkedin.com. Read it right to left from the first single slash. See how to check if a link is safe.
4. What it asks for. A LinkedIn message never needs your Microsoft 365 or Google password. A page that asks for one is phishing, whatever the logo says.
5. Headers, if you want proof. Paste them into the Email Header Analyzer to see the real sending domain and whether SPF, DKIM and DMARC passed.

Can a scam come through LinkedIn itself?

Yes. Some of the most damaging LinkedIn attacks don't fake the email at all. The attacker builds a real LinkedIn profile, sends a real message through LinkedIn, and LinkedIn's genuine notification email lands in your inbox. Every sender check passes, because LinkedIn really did send it. The danger is the person.

The FBI described this in its September 2024 public service announcement on North Korean social engineering. It says the actors "scout prospective victims by reviewing social media activity, particularly on professional networking" sites, may pose as recruiters, and work "to build rapport and deliver malware in situations that may appear natural and non-alerting." Its warning signs include "Offers of employment from prominent cryptocurrency or technology firms that are unexpected", and it advises staff to "Avoid taking pre-employment tests or executing code on company owned laptops or devices."

LinkedIn's own scam guidance lists related red flags, including "Urgent requests to move off-platform (e.g. Whatsapp/Telegram/external forms)" and "Emails from generic addresses (Gmail/Yahoo) instead of @company.com." Job scams aimed at applicants are covered in our guide to fake job offer and recruitment scams.

For a business, the rule is the same either way: no files, no coding tests and no sign-ins on a company device because of a LinkedIn conversation, unless the person has been verified through a separate channel.

Why are LinkedIn lures dangerous for businesses?

LinkedIn is where attackers do their research. Job titles show who approves payments, who runs IT and who's new. The FBI notes that actors study professional networking activity before they make contact, and the same research feeds spear phishing and business email compromise.

A stolen LinkedIn account also does damage of its own. The attacker can message your colleagues, clients and suppliers from a profile they trust. And people reuse passwords: if the LinkedIn password matches a work password, the click becomes a mailbox takeover.

What should I do if I clicked a fake LinkedIn link?

If you only opened the page, close it and don't type anything. If you entered a password or downloaded a file, act now.

If you're the user

1. Change your LinkedIn password from a trusted device by typing linkedin.com yourself. Change it anywhere else you used the same password.
2. Tell IT immediately, especially if the page asked for your work password, you typed a two-factor code or you opened a file.
3. Turn on two-factor authentication on LinkedIn if it isn't already on (steps below).
4. Report it. Forward the email to phishing@linkedin.com (LinkedIn Help) and use your mail app's report button. For a scam message inside LinkedIn, select More > Report/Block, then It's spam or a scam, and answer the questions that follow (LinkedIn Help).

If you're the admin

1. Reset the work password and revoke sessions if the user typed it anywhere.
2. Check for new MFA methods, inbox rules and forwarding. Our guide to signs an email account is compromised lists where attackers hide.
3. Isolate the device if a file was opened or code was run, and scan it.
4. Search for the same email in other mailboxes and remove it.

The full recovery checklist is in what to do after clicking a phishing link.

How do I turn on two-factor authentication on LinkedIn?

LinkedIn's help pages call the feature two-step verification in some titles, but the setting itself is labeled two-factor authentication at the time of writing (October 2026). On desktop, LinkedIn's instructions are:

1. Click the Me icon at the top of your LinkedIn homepage and select Settings & Privacy.
2. Click Sign in & security, then Two-factor authentication.
3. Click Set up, choose a method and click Continue.

The methods offered are an authenticator app or a phone number for text messages. LinkedIn says it "recommends the authenticator app as the preferred two-factor authentication method" (LinkedIn Help). A code from either method can still be typed into a fake page, so the habit of opening LinkedIn yourself still matters. Two-factor authentication mainly stops someone who has only your password.

How can a business block fake LinkedIn emails?

1. Teach one habit. Read LinkedIn messages in LinkedIn, never from the email button. CISA's advice for any message that might be real is to avoid clicking links in it and contact the sender through a separate, verified channel (CISA).
2. Set a rule for recruiter contact. No coding tests, installers or "assessment" files on company devices, in line with the FBI's advice. The FBI adds that if a pre-employment test requires running code, staff should "insist on using a virtual machine on a non-company connected device, or on a device provided by the tester."
3. Require MFA on work accounts, ideally phishing-resistant methods for admins and finance, so a stolen password alone doesn't open the mailbox.
4. Make reporting easy with a report button, so one report lets IT pull every copy.
5. Filter before delivery. Microsoft 365 and Google Workspace catch many lookalike-domain notices on their own. If they still reach your users, an MX-level filter adds phishing, spoofing and link checks before mail reaches the mailbox. Our Microsoft 365 built-in vs gateway comparison sets out honestly when the built-in protection is enough.

Next steps

1. Tell staff: if a LinkedIn email says you have a message, open LinkedIn yourself to read it.
2. Ask everyone to turn on two-factor authentication on LinkedIn and to use a password there they use nowhere else.
3. Write down your rule on recruiter files and coding tests on company devices.
4. Check your domain with the free Email Health Check, and if fake notices keep getting through, compare built-in Microsoft 365 filtering with a gateway.

Browse our other phishing and threat guides.