Fake job offers in your company's name hurt candidates and your brand. Learn how recruitment fraud works and the steps employers can take to stop it.
Quick answer: Recruitment fraud impersonating a company is when criminals pose as that company's recruiters, post fake vacancies or send fake job offers in its name, and use them to take money or personal data from job seekers. Employers can act on it: preserve the evidence, take down the lookalike domains, fake profiles and job postings, publish a clear recruitment fraud notice on the careers page, and report the scheme to the FTC or IC3 in the US, or to Report Fraud in the UK.
The company is not the one losing money, but it pays in other ways: angry candidates, a damaged employer brand, and HR teams fielding calls about jobs that never existed. This guide explains how these schemes work and gives employers a practical response plan.
How recruitment fraud impersonating a company works
The US Federal Trade Commission described the typical pattern in an alert on scammers impersonating well-known companies on LinkedIn and other job platforms:
- Contact. A "recruiter" sends a message saying you have exactly the skills they need, or a fake vacancy is posted on a job board under the company's name.
- Interview. The candidate is invited to a virtual interview, often by text chat, and sent an official-looking job briefing.
- Offer. An offer letter arrives with the real company's name and logo.
- The ask. The candidate is told to buy equipment from a "supplier" with a promise of reimbursement, to deposit a cheque and send part of it back, or to hand over their Social Security number, ID and bank details for "onboarding".
A newer version skips the job board. In April 2026 the FTC warned about job offer texts in which fake recruiters claim to represent well-known companies, ask people to reply "YES", and then run a fake cheque scam or a task scam in which victims eventually deposit their own money.
The scale is significant. The FTC reported that reports of job and employment agency scams nearly tripled between 2020 and 2024, and that reported losses rose from $90 million to $501 million (FTC).
Why it is the employer's problem
Candidates who lose money often blame the company whose name was on the offer. They post reviews, contact HR and sometimes the press. Beyond reputation, the stolen ID documents and bank details can feed identity theft, and the same lookalike domains used for recruitment fraud can later be used for invoice fraud against your suppliers and customers, a form of business email compromise. Every fake recruitment domain you take down is infrastructure the criminals can't reuse.
What employers can do: a response plan
1. Create one place to report it
Give candidates and staff a single route, such as a dedicated mailbox or a form on the careers page, and tell receptionists, recruiters and the social media team to forward every enquiry there. A handful of candidate emails is often the first sign of a campaign.
2. Verify and preserve the evidence
For each report, keep the job posting URL, the recruiter's profile link, the full email with headers, the sending domain, phone and chat numbers, the offer letter and any payment details the candidate was given. Check whether the domain is newly registered and who hosts it. These details are what platforms, registrars and police need.
3. Take down the infrastructure
- Lookalike domains and fake careers sites: report them to the hosting provider, the registrar and browser blocklists. Our guide to the phishing site takedown process explains the order that works. If the domain uses your trademark, a UDRP complaint can transfer it to you, although it takes longer.
- Fake job postings on LinkedIn: LinkedIn's help page on reporting jobs lets you report a posting as a scam or flag that it shows an incorrect company. A fake company Page can be reported from the Page's More menu with Report abuse (LinkedIn). Other job boards have similar report options on each listing.
- Fake recruiter accounts and chat numbers: report them on the platform where they appear as impersonating your company.
- Free webmail addresses: report them to the email provider's abuse team.
Phishvoid can take this work off HR's desk: our team verifies each fake careers site and recruiter profile, then reports it to the host, the registrar, the job board and the blocklists, and keeps watching for new ones.
4. Report to the authorities
In the US, the FTC asks people to report job scams at ReportFraud.ftc.gov and to their state attorney general, and IC3 accepts complaints at ic3.gov. In the UK, report through Report Fraud (0300 123 2040) in England, Wales and Northern Ireland, or Police Scotland on 101. Encourage affected candidates to file their own reports too, since police link cases using victim reports.
5. Answer every candidate who asks
Prepare a short, kind reply: the offer did not come from you, here is your official careers page, never pay to get a job, contact your bank if you sent money, and report it. People who were scammed are often embarrassed; a helpful reply protects your reputation.
Prevention: make fake offers easy to spot
- Publish a recruitment fraud notice on your careers page. State that you never charge fees, never ask candidates to buy equipment or deposit cheques, never interview only by text chat, and only email from your own domain.
- List every real vacancy on your own careers site, so candidates can check a posting against a source you control.
- Tell recruiters to use company accounts only, never personal email or messaging numbers.
- Protect your email domain with DMARC. An enforced DMARC policy stops criminals sending from your exact domain, though not from lookalikes; see our guide to SPF, DKIM and DMARC.
- Monitor new domains that combine your name with words such as careers, jobs, hr, talent or hiring. The free lookalike domain finder is a good place to start.
Helping candidates who were caught
Point them to the FTC's advice on job scams: if they paid, they should contact the company they used to send money immediately and ask for the transaction to be reversed. If they shared ID or a Social Security number, IdentityTheft.gov gives a recovery plan. They should never deposit a cheque from a "new employer" that comes with instructions to send money on.
FAQ
How can a candidate check whether a job offer from a company is real?
Contact the company through a phone number or website you find yourself, not the details in the message, and check that the vacancy appears on its official careers page. The FTC recommends exactly this.
Can an employer get a fake job posting removed?
Yes. Report it on the job board as a scam or as listing the wrong company, and take down any lookalike careers site it links to through the host and the registrar.
Should we report recruitment fraud if no one has lost money yet?
Yes. Early reports help platforms and authorities link the campaign to other cases, and taking down the domains early prevents losses.
Does DMARC stop recruitment fraud?
Only partly. It stops spoofing of your exact domain, but most recruitment fraud uses lookalike domains or free webmail, which need monitoring and takedowns.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.