He Wouldn't Name the Role. Then He Sent Me a Teams Link.

A message showed up in my LinkedIn inbox this week from someone describing himself as a talent acquisition consultant. Friendly opener, a "leadership opportunity," would I be open to a conversation. I said sure, same as I'd say to any real recruiter with a real requisition.

What happened next is the part worth writing about, not because it's a new scam, but because the specific move he made is one I hadn't laid out plainly before, and it's showing up in more inboxes than mine.

The transcript

Three separate attempts to answer "for what role?", and not one of them named a role in a way I could check before clicking anything. The first two were the same Teams link, copy-pasted twice. The third dressed itself up as something more substantial.

Why the Teams link is the actual tell

Two things about that link matter more than the vague messaging around it. First, the link itself. A legitimate company reaching out to interview you sends a calendar invite through its own enterprise system, or points you to a real, named platform tied to its domain. A personal Teams invite, the consumer version anyone can generate for free with no company account behind it, costs a scammer nothing to create and gives you zero way to verify who's actually on the other end before you click.

Second, and more telling: he never named the role, not once, across two direct asks. A recruiter working an actual open requisition leads with it, the company, the title, a general comp range, because that's the entire reason they reached out to you specifically. Withholding it while pushing you toward a different platform to "find out" is the mechanism, not an accident.

The next message made it worse, not better

After the second unanswered "for what role?", the conversation didn't go quiet. It escalated. What arrived next was a polished, several-page document listing three specific "matched" roles at real companies, complete with responsibilities, qualifications, salary ranges, and a "recruiter positioning" section ranking them, formatted exactly like the output of a real research tool. Here's one of the three entries, trimmed for length, the other two followed the identical format:

Real companies were named, INEOS, Fivetran, and ParetoHealth all genuinely exist. That's what makes this stage more dangerous than the first, not less: referencing actual employers makes the whole package feel verified. But every single citation attached to all three listings pointed to a URL ending in .invalid, a reserved domain suffix that cannot resolve to a real website under any circumstances. It exists specifically so testing and documentation tools have a guaranteed-fake address to point at. Whoever, or whatever, built that document filled in a citation format without a single real source behind any of it.

That's the tell inside the tell. The first message tried to look human and personal. This one tried to look researched and credible, complete with requisition numbers and citations, and neither survived a basic check. If a "recruiter" ever sends you a document full of source links, click through at least one before trusting anything else in it.

This is a named, tracked pattern, not just bad luck

The Better Business Bureau's 2026 employment scam update names this specific move, platform-shifting away from wherever contact started toward WhatsApp, Telegram, or similar apps, as a defining tactic of current job scams. Nearly 50,000 people have reported employment scams to BBB's Scam Tracker over the past three years, and reports doubled in 2025 compared to the year before. Median losses for the task-based scams that often follow this exact opening run around $2,300, with individual cases running far higher.

It's common enough now that real companies are pre-empting it. GitLab published guidance in December 2025 telling candidates plainly that its interviews happen over Zoom, not Microsoft Teams or WhatsApp, specifically because scammers were impersonating its recruiters through those channels. When a company has to publicly say which video platform it doesn't use, that's how normalized this specific move has become.

Zoom out further and the broader number hasn't moved in the right direction either: the FTC reports that job scam reports roughly tripled between 2020 and 2024, with reported losses climbing from $90 million to $501 million over the same stretch.

What to do instead

• Ask for the role, the company, and the comp range in writing, on the original platform, before anything else. If that gets deferred to a call or a different app, treat that as your answer.
• Don't click a personal or consumer video-call invite from someone you haven't verified. If a company wants to talk to you, its name will be attached to the invite, not a generic personal link.
• Check the sender's profile for basic consistency. Someone who calls himself a "retained search representative" mid-conversation but lists an internal, in-house title on his own profile is describing two different jobs.
• Report it and move on. LinkedIn's Report function exists for exactly this, and Microsoft has its own reporting path for Teams-based impersonation at microsoft.com/concern/scam. Neither takes more than a couple minutes.

The honest bottom line

I've written before about fake recruiters who never had a role and about a resume "critique" of a document I never sent. This is the same family, with a more elaborate wrapper: friendly opener, a real-sounding title, a push to a platform where nobody's watching, and now, apparently, a document dressed up to look like real research when it isn't. The tell is always the same underneath the wrapping. If naming the actual job keeps getting deferred, and the sourcing behind it doesn't hold up when you check it, there isn't one.