Key takeaways
- Every fraudulent offer is ultimately after money or identity documents — that filter catches nearly all of them.
- An offer made without meaningful assessment is the single strongest indicator of fraud.
- Verify only through channels you found yourself; a scam controls every channel it gave you.
- A legitimate employer never sends you money to pass on to a third party.
- If you have engaged, speed matters more than embarrassment — contact your bank first.
The two things every scam wants
However elaborate the pretext, a fraudulent job offer is trying to obtain money or documents. Money arrives disguised as a fee — registration, training, equipment, visa processing, background check. Documents are gathered for identity theft, often as an ordinary-looking onboarding pack.
This single observation is the most useful filter available. When a process begins moving towards either, treat everything preceding it as unverified regardless of how professional it appeared. Scams invest heavily in looking legitimate precisely because the request that follows will not.
It also means you do not need to identify the specific scam. You do not have to know whether this is an advance-fee scheme, an identity harvest or a money-laundering recruitment — noticing that it has begun asking for money or documents is sufficient to stop.
The signals that reliably identify a fake
Individually these can have innocent explanations. Together they are conclusive, and in practice most fraudulent offers show several at once.
The strongest single indicator is an offer arriving with little or no assessment. Organisations do not make real employment commitments to people they have not evaluated, because hiring the wrong person is expensive. An offer without genuine interviews is not a lucky break.
Generated text has made the written signals less reliable than they were. Poor grammar used to be a giveaway and largely is not any more, which shifts the weight onto the structural signals — the absence of assessment, the payment request, the unverifiable channel — rather than how the message reads.
- Any request for payment, for any reason, at any stage
- An offer made without meaningful interviews or assessment
- Communication only through personal email or messaging apps
- Pay significantly above market with vague responsibilities
- Urgency — sign today, the position closes tonight
- Requests for identity documents or bank details before an offer is verified
- An offer letter with inconsistent formatting, wrong legal entity or odd language
Verifying independently
The essential principle is that verification must not use any channel the sender provided. A fraudulent operation controls its own phone numbers, domains and reference contacts, so checking those confirms nothing.
Find the company yourself. Locate its official site through a search engine rather than a link in the email, call the switchboard number listed publicly, and ask to be connected to the person who contacted you. A real employer handles this routinely; a fraudulent one cannot survive it.
Check the email domain character by character rather than at a glance. Lookalike domains are the standard technique — a swapped letter, an added hyphen, a different top-level domain — and they are designed to survive exactly the quick glance most people give them.
- Search for the company independently — never use links you were sent
- Compare the email domain against the official one, character by character
- Call the publicly listed number and ask for the person by name
- Check the company register for the legal entity named in the letter
- Look up the recruiter on professional networks and check account age
| Stage | Legitimate | Fraudulent |
|---|---|---|
| Assessment | Several interviews over weeks | Brief chat, or none at all |
| Communication | Company domain, scheduled calls | Personal email or a messaging app |
| Money | Flows only to you, after you start | Requested from you before you start |
| Documents | Requested after a verified offer | Requested early, as onboarding |
| Pace | Slow, with waiting between stages | Urgent, decide tonight |
| Verification | Accepted without offence | Discouraged, deflected or resented |
Why professionals fall for these
It is tempting to assume only the careless are caught. In reality these succeed against experienced people, because they exploit circumstance rather than intelligence. Someone recently made redundant, or on a visa with limited time to find a sponsor, is under pressure that distorts judgement.
Scams are built for that pressure. Urgency is manufactured deliberately so there is no time to verify. Recognising urgency itself as the warning sign, independent of the content, is the most transferable defence.
The practical countermeasure is a rule made in advance. Deciding now that you will never send money to an employer and never share documents before an independently verified offer removes the decision from the moment when your judgement is worst.
The overpayment variant
A common pattern deserves specific mention. After an apparent hire, you are sent a cheque or transfer to buy equipment from a specified supplier. The payment is fraudulent and will be reversed, but the money you forward to the supplier — controlled by the same people — is gone, and it is yours.
The rule is simple: a legitimate employer never sends you money to pass to a third party. Any variation on this, however reasonably explained, is fraud.
The same logic covers the money-mule variant, where the "job" itself consists of receiving payments and forwarding them on. That is not merely a scam against you; participating in it is a criminal offence in most jurisdictions even when you believed it was employment.
Where these approaches come from now
The approach increasingly arrives through a channel that feels safe. A message on a professional network, a reply to an application you genuinely submitted, a contact who appears to work at a company you actually applied to — all of which lower suspicion before anything is asked.
Job boards are also targeted directly. A fraudulent posting on a legitimate board inherits the board’s credibility, which is why "I found it on a real site" is not verification of anything.
The defence does not change with the channel. Wherever the approach came from, the same two questions apply: has there been real assessment, and can I verify this through a route they did not give me.
If you have already engaged
Act quickly, and do not let embarrassment delay you. If you sent money, contact your bank immediately — rapid reporting is what makes recovery possible at all. If you shared identity documents, treat it as an identity theft risk: alert your bank, monitor your credit record and consider a fraud flag.
Report it. Fraud reporting feels futile individually and is what allows patterns to be identified and networks disrupted. Report to your national cybercrime or fraud authority, to the platform where you were contacted, and to the real company being impersonated, which usually wants to know.
Keep everything. Messages, email headers, account names, payment references and phone numbers are what an investigation works from, and deleting the thread out of frustration removes the only evidence that exists.
Frequently asked questions
Should I ever pay a fee for a job?
No. Legitimate employers do not charge candidates for registration, training, equipment, background checks or visa processing. Any request for payment at any stage is sufficient reason to stop.
How do I verify an offer letter is genuine?
Verify through channels you found yourself, never ones you were sent. Search for the company independently, call the publicly listed switchboard, and check the legal entity on the company register.
Is it safe to share my identity documents during onboarding?
Only after independently verifying the employer, and normally after a formal offer following real interviews. Requests for documents early in a process, or before verification, are a common identity-theft pattern.
What should I do if I already sent money to a fake employer?
Contact your bank immediately — speed determines whether recovery is possible — then report to your national fraud or cybercrime authority, the platform where you were contacted, and the company being impersonated.
Is bad grammar still a reliable warning sign?
No. Generated text has largely removed that signal, which shifts the weight onto structural ones — no real assessment, a payment request, and a channel you cannot independently verify.
Does finding the job on a real job board make it safe?
No. A fraudulent posting on a legitimate board inherits that board’s credibility. The same two checks apply regardless of where the approach came from.
Check this against your own resume
Scan your CV against a real job description, or build a parse-safe one from scratch. Your first scan costs nothing.