Verifying a job posting

Fraudulent postings want money or documents. Ghost jobs are adverts for roles that are filled, frozen or never existed, kept live to build a pipeline or project growth. Harvesting posts exist to collect CVs for a database you never agreed to join.

Only the first is a crime, but all three cost you the same thing — hours spent tailoring an application nobody will read. The checks below sort them apart before you invest.

Distinguishing them matters because the responses differ. Fraud means stop and report; a ghost job means apply quickly if it is cheap and do not chase it; harvesting means send less rather than nothing.

Start with whether the legal entity is real and whether it matches the name on the advert. A company register lookup takes a minute and catches impersonation immediately, because a fraudulent posting usually borrows a real company’s name while operating from somewhere unconnected to it.

Then check the careers page. A genuine opening is nearly always listed on the employer’s own site. A posting that exists only on a job board, especially with no matching page at the company, deserves a second look before you send anything personal.

Agency postings are the legitimate exception and have their own check. A recruiter withholding the client name early is normal; being unable to describe the team, the role or the process is not, and that distinction separates a real agency mandate from a fishing exercise.

• Legal entity on the company register, matching the advertised name
• The same role on the employer’s own careers page
• A physical address that resolves to something real
• A domain whose age matches the company’s claimed history
• Employees on professional networks who predate the posting

Genuine job descriptions are specific because they are written by someone who needs a particular problem solved. Vagueness is the most reliable signal of a posting that is not tied to real work.

Salary is the sharpest tell of all. A figure far above the market for the stated experience, attached to responsibilities nobody could summarise, is the oldest pattern there is — and it works precisely because it makes people want it to be true.

A useful test is whether you could tell what the person would do in their first month. A real posting implies it even when it does not say so; a fabricated one describes an ideal candidate at length and never describes any actual work.

Ghost jobs are legal and common, which makes them frustrating rather than dangerous. The signals are different: a posting reposted repeatedly over months, a role that has been live far longer than its seniority would suggest, or a description generic enough to fit any candidate.

The efficient test is to ask. A short message to the recruiter asking when the team expects to make a hire, and whether the role is newly approved or a replacement, gets a straight answer from a real process and silence or vagueness from a pipeline-building one.

Companies keep them live for reasons that are rarely malicious — a pipeline for an expected departure, a hiring freeze nobody updated the advert for, or an appearance of growth for investors. None of that helps you, which is why the check is worth the minute it takes.

• Reposted at intervals over several months
• Live far longer than typical for the seniority
• No named hiring manager or team anywhere in the process
• Description generic enough to fit almost anyone
• Recruiter cannot say when a decision is expected

You cannot investigate every posting and you do not need to. The checks scale with what you are about to spend: a quick application deserves thirty seconds, and anything involving documents or a tailored portfolio deserves the full pass.

The short version is three questions. Is this role on the company’s own careers page? Does the sender domain exactly match the company’s? Could I describe what this person would actually do?

If all three pass, apply. If the first two pass and the third does not, it may be a ghost job — apply cheaply without tailoring heavily. If either of the first two fails, verify independently before sending anything at all.

The simplest defence against harvesting is not putting harvestable data in your CV. Your full address, date of birth and any identity or tax number are not needed to assess your suitability, and their presence is what makes a leaked CV valuable.

Provide those at formal offer stage, to an employer you have verified, and not before. A legitimate process never needs them earlier, and a request for them earlier is itself one of the clearer signals you will get.

A separate email address for job applications is worth the two minutes it takes. It keeps application traffic out of your main inbox, and if it starts receiving unrelated marketing you have learned something concrete about where your details travelled.