Five of these have reached me or my clients since July, the most recent this morning. If you
are in an active search, you are on the list. This is the check I run, in the order I run it, with the
real messages that taught me each part of it.
Start here: judge the ask, not the profile
The profile check is the check that fails. Everyone's instinct is to look at the person's
LinkedIn and decide from there. I did exactly that on a message I received on 6 August. The profile
had a genuine sixteen-year career history: five years at Procter & Gamble, a stint at ExxonMobil
covering a $20bn projects division across seven countries, a real university with real detail. The
kind of unglamorous specificity nobody bothers to invent.
It was still fraud. The account was either cloned or compromised, and I could not tell which from
the outside. What gave it away had nothing to do with the profile: the message asked me to send my
resume to careerpage.procterandgamble@outlook.com. Procter & Gamble does not
receive applications at an Outlook address.
So: read what you are being asked to do. That is where the tell lives, every time.
Five asks that mean stop
1. Move to a personal chat account
Especially teams.live.com, which is a consumer Microsoft Teams
account, not a company one. A real employer uses its own tenant, with its own domain. The same goes
for a recruiter steering you to WhatsApp, Telegram, Signal or personal Gmail. They are moving you
somewhere the platform's fraud detection cannot see.
2. No job description, and you have to make contact to get it
"He will provide you with the full job description." Real recruiters lead with the
job description, because their problem is attracting candidates, not withholding information. A
withheld JD is not disorganization. It is the hook.
3. An email address that is not the company's domain
Any Outlook, Gmail, Yahoo or lookalike domain claiming to be a Fortune 500's careers
inbox is fraud, full stop. Check the characters carefully too: rn reads as
m, and a zero reads as an O at a glance.
4. "Tell him you were referred by me"
This manufactures a trust chain so the second person inherits credibility the first
one never earned. Legitimate referrals come with a name you already know, or an introduction the
referrer makes themselves.
5. Anything involving money, equipment or your identity documents, at any stage
A check to deposit. Equipment you buy and get reimbursed for. Bank details, Social
Security number, or a photo of your driver's license "for onboarding" before a signed offer and a
verified employer. No legitimate employer needs any of that from a candidate. This is where the
actual loss happens.
6. Your resume itself, sent anywhere other than a company address
This one looks harmless, which is why it works. A resume carries your full name,
phone number, location and work history, which is most of what someone needs to impersonate you or
to run a convincing approach on your former colleagues. Watch for the version that arrives wrapped
in flattering nonsense about resume optimization, hiring algorithms or ATS scores, several
paragraphs of it, with nothing about the actual job. And if they explain the personal email by
citing compliance or data standards, that is backwards and it settles the question. Compliance
rules are exactly why real firms require company email and forbid personal accounts. Nobody moves
your details to a personal inbox in order to comply with something.
The one message that settles it
You never have to accuse anyone of anything, and you do not need to become suspicious of every
recruiter who contacts you. Most are real, and inbound interest is one of the best things that can
happen in a search. You just need one reply that a real recruiter can answer easily and a fake one
cannot:
"Happy to share my resume once there is a specific opportunity. Which role and which client are we
talking about, and I will send it to your company address rather than a personal account."
Then read what comes back. A real recruiter sends a title, a company, and usually a link, because
their problem is filling the job. A fake one sends a job title with no company attached and a reason
why the personal email is necessary. That is the whole test, and it costs you one message.
Five real specimens. They get better. The ask does not change.
These are all real messages, in the order they arrived. I have deliberately not named any
individual, because a convincing profile may belong to a real person whose account was cloned or
compromised, and from the outside you cannot tell. They are a victim too.
1 · Staffing firm, ten days after my layoff
Impersonated a real agency. Good pitch, plausible role, profile that looked lived
in. Everything held up until I looked at the email address: a Gmail account with the agency's name
jammed into the front of it. When I asked about it, he had a ready explanation about company email
problems. That explanation is the scam. A real recruiter never needs a story about why they
are not on their company domain.
2 · A Director role at Microsoft, 8:45 the next morning
Far better. Remote, $220,000 to $380,000 base plus bonus and stock, ten bullet
points of responsibilities, executive coaching, a path to General Manager. Eleven hundred words.
The flattery was specific: it named Lumen, Verizon, Sprint, AT&T, CenturyLink and Global
Crossing. All of that is on my public profile, which is exactly where it came from.
Personalization is not evidence of legitimacy. It is evidence of a scraper. In eleven hundred
words there was one actual request: send your resume to a personal address. The reply address was
Gmail. Microsoft recruiters use microsoft.com, and there is no story that makes an exception.
3 · Procter & Gamble, behind a real sixteen-year career
The one that nearly worked, described at the top of this page. Genuine career
history, real employers, real detail. The profile check passed. The ask did not:
careerpage.procterandgamble@outlook.com.
4 · A staffing firm, handing off to a personal Microsoft Teams account
A "Senior HR Recruiter" claiming five years across three real firms, asking me to
meet the hiring manager on a teams.live.com invite, mention I had been referred by
him, then report back so he could make sure it all went smoothly. No job description until after
contact. Three connections on the account. Recruiting is a networking profession; the
account was days old. Located in Australia while recruiting a US role for a US firm.
Read those four in order. They improved every time: sloppy, then
well written, then backed by a real career history, then using a legitimate Microsoft product as the
handoff. What never changed is the ask. Every one of them wanted the conversation moved somewhere
unverifiable, and every one wanted a document or a contact before giving me anything real. Two of the
four impersonated companies that genuinely exist, because borrowed credibility is free.
5 · The day I posted publicly that I was open to work
Hours after that post went up, a first-degree connection opened with "Hello", then
"What type of role are you currently pursuing and how has the process been so far?" Friendly, no
pressure. His next message was four paragraphs on how resumes have to be optimized for hiring
algorithms, ending with "if your resume aligns with the current industry standards consider you're
hired," and a Gmail address. No recruiter can promise you a job, and none of them talk like
that. I replied asking which role and which client, and said I would send it to his company
address. What came back was a job title with no company attached, and the reason for the personal
email was "recent issues concerning resume standards and compliance." Two lessons worth keeping.
A public post about looking for work is a trigger event, so expect this class of message
within a day of posting. And the specifics question ends it every time: he had a title, and
nothing behind it.
If you think it is a scam
Do not click the link and do not reply. Not even to decline. A reply confirms a live
human on the other end and increases what comes next.
Report the profile to LinkedIn. The three dots on their profile, then Report, then the
fake-account option. Then remove the connection.
Tell the real company. If they are impersonating a genuine employer or staffing firm,
contact that firm through their own website. They want to know, and they usually cannot see it
happening.
Report it to the FTC at reportfraud.ftc.gov.
Two minutes, and it is how the pattern gets tracked.
Send it to me. I will verify it properly and, if it is real, I will find you the genuine
version of that role.
If you already engaged
Nothing to be embarrassed about, and please do not sit on it. These are engineered by people who do
this professionally, and the second specimen above fooled me on the first pass with better tools
than most people have.
If you only sent a resume: your risk is targeted phishing and identity-building, not
immediate loss. Watch for follow-up messages that reference real details about you.
If you shared bank details: call your bank now and tell them it was fraud.
If you shared your Social Security number: freeze your credit with all three bureaus, which
is free, and start at identitytheft.gov.
If you deposited a check: tell your bank immediately, before you move any of it. The money
is not yours and you will be liable for it.
Then tell me. I would much rather help you work through it than have you carry it alone.
Why this keeps getting worse
$501MConsumer losses to job scams reported to the FTC in 2024, up from roughly
$90M in 2020.
24,688Employment scam reports to the FBI's Internet Crime Complaint Center in
2025, with nearly $363M in reported losses.
Those are only the people who reported it. Most do not, because the moment you realize, the feeling
is embarrassment rather than anger, and embarrassment keeps people quiet.
The reason job seekers are targeted so heavily is unkind but simple: an active search means you are
expecting messages from strangers about opportunities, you are motivated to respond quickly, and if
you have been out of work for a while you are less inclined to walk away from something promising.
Every one of those is a normal, healthy response to looking for a job, and all three are being used
against you.
Not a client, and something landed in your inbox?
Send it to me anyway. I will tell you straight whether it is real, and if the role is genuine I
will point you at the actual posting on the employer's own site. No charge and no pitch attached to
it. I would rather spend ten minutes than have someone lose a month, or a deposit, to this.
Written by Bobbie Ziemer. Every specimen described here is a
real message received in July and August 2026, verified in-browser before being written up. Nothing on this page
names or accuses an individual, because a convincing profile may belong to a real person whose account
was compromised, and they are a victim too.