Two Fake Recruiters Found Me in 48 Hours. Here Is Exactly How I Knew.
I was laid off from Lumen on July 10. Within ten days, two different people slid into my LinkedIn inbox with an executive opportunity that did not exist.
Both were polished. Both had done homework on me. Both were fake.
If they came for me, they are coming for you. So here is exactly what landed, exactly how I spotted it, and exactly what to do the next time it happens to you.
The first one
A recruiter from a real, well-known staffing firm. The pitch was good. The role was plausible. The firm exists, the name checked out, the LinkedIn profile looked lived-in.
Everything passed until I looked at the email address he gave me.
It was a gmail.com address with the agency's name jammed into the front of it. Not the agency's domain. Just the agency's name, sitting inside a free personal email account.
When I asked about it, he had a ready explanation about company email issues.
That explanation is the scam. Real recruiters at real firms do not lose access to their corporate email and then ask a stranger to send a resume to their personal Gmail instead.
The second one
This one arrived at 8:45 the next morning and it was better.
A "Confidential Independent Contract Recruiter" with a Director-level opening at Microsoft. Remote. $220,000 to $380,000 base, plus bonus, plus stock. Ten bullet points of responsibilities. A full benefits list. Executive coaching. A clear path to General Manager.
The flattery was specific enough to be flattering. It named Lumen, Verizon, Sprint, AT&T, CenturyLink, Global Crossing. It mentioned my work building AI sales systems. All of that is on my LinkedIn profile, which is exactly where they got it.
Here is what gave it away.
The reply address was a gmail.com account. Microsoft recruiters use microsoft.com. There is no exception to this and there is no story that makes it okay.
The employment type field said "Full-Time/ Part time." Nobody hiring a Director at that salary is undecided about whether the job is part time.
The spelling drifted. "Programmes." "Equity programmes." A US posting for a US company written by someone who does not write American English.
And the only actual request in eleven hundred words was: send me your resume at this personal address.
That is the entire point of the exercise. Your resume is a tidy package containing your full name, your address, your phone number, your email, your employment history, and your professional network. It is enough to open accounts, to run a convincing follow-on approach, or to sell you to the next list.
There was no job. There was never a job.
This is not rare and it is not getting better
The Federal Trade Commission reports that consumer losses to job scams grew from roughly $90 million in 2020 to about $501 million in 2024.
The FBI's Internet Crime Complaint Center received 24,688 employment scam reports in 2025, with nearly $363 million in reported losses.
The Better Business Bureau's Scam Tracker logged 23,234 employment scam reports in a single year, roughly double the prior year.
And those are only the people who reported it. Most people who hand over a resume never find out anything happened.
Why they target the newly laid off specifically
Because layoffs are public.
When you post that you are open to work, you are telling the entire internet three things at once: you are available, you are motivated, and you are going to respond quickly to anyone who offers hope.
That is not a criticism. That openness is genuinely how good things happen in a job search. But it is also a targeting signal, and the people running these schemes read LinkedIn the same way the rest of us do.
The cruelty of it is the timing. They arrive in the exact week you most want the message to be real.
The sixty second check that catches almost all of it
One. Check the domain, not the name.
Microsoft recruiters email from microsoft.com. Deloitte from deloitte.com. If the reply address is Gmail, Outlook, Yahoo, or a domain that is one character off from the real one, stop. Any explanation offered for this is part of the scam.
Two. Find the job on the employer's own careers site.
Not the job board. Not the link they sent you. Go to the company's actual careers page yourself and search for the title. If it is not there, it does not exist. This one step kills the overwhelming majority of fakes.
Three. Watch for the move off-platform.
The FBI names this as the single most prominent indicator of a fraudulent offer on LinkedIn: a recruiter pushing the conversation off LinkedIn messaging, to personal email, to WhatsApp, to Telegram, to Signal. They are trying to get away from the reporting tools.
Three more that should stop you cold:
- You are asked to pay for anything. Equipment, training, background checks, software. Real employers do not charge you to work for them.
- You are asked for a Social Security number, bank details, or a photo of your ID before a real interview with a real human being.
- You are hired without a genuine interview. An offer after one chat exchange is not a compliment.
What to do instead of replying
Do not reply. A reply, even an angry one, confirms you are a live target and gets you moved to a better list.
Use the three dots on the conversation and report it. Then block.
If you already sent your resume, you are not in crisis, but do this: watch for follow-up contact referencing details from it, do not act on any "next step" that involves payment or ID, and consider a credit freeze if you also shared identifying numbers.
You can report it to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov. Type those addresses into your browser directly. Do not search for them.
The thing I actually want you to take from this
Getting targeted does not mean you were careless. It means you were visible, and visibility is not optional when you are looking for work.
But it does mean the job search now has a verification problem sitting on top of everything else it already asks of you. You are supposed to tailor every resume, track every application, chase every warm introduction, and now also independently authenticate every stranger who contacts you, on the worst week of your professional year.
That is the part I could not accept.
After Lumen, I built the thing I wished someone had handed me. Every morning, The Pursuit Engine finds roles in my clients' lanes, confirms each one is genuinely open at the employer's own hiring system rather than a stale listing or a fiction, builds the tailored resume and cover letter for each, and maps who they already know inside the company. They review and press send.
That verification step is not a feature I added for marketing. It is there because of mornings exactly like the one I just described.
Be careful out there. And if one of these lands in your inbox this week, screenshot it and post it. The fastest way to make these stop working is to make them famous.