The Offer Letter Trap: How Fake Recruiters Turn Job Seekers Into Targets

The message arrives on a Tuesday afternoon, usually through LinkedIn. A recruiter at a company the candidate half-recognizes praises their background, mentions a role that sounds like a step up, and asks one small question: are you open to a quick chat?

For millions of Americans navigating a labor market that feels tighter and slower than it did two years ago, that message can feel like a door opening. For a growing number of fraud operations, it is a door they intend to walk through.

Why Job Hunters Make Ideal Targets

Cybercriminals follow opportunity, and few populations volunteer as much usable intelligence as people looking for work. A résumé uploaded to a job board typically contains a full name, phone number, email address, employment history, and often a city of residence. A LinkedIn profile adds a current employer, endorsements, and a professional photo. Together, these materials hand a scammer a pre-assembled identity dossier — no breach required.

The emotional context compounds the exposure. Job seekers are, by definition, in a state of motivated optimism. They are primed to respond quickly, reluctant to interrogate good news, and conditioned to follow the recruiter's process. Social engineers describe this as establishing authority and urgency at the same time; the job hunt supplies both for free.

There is also a volume problem. Layoffs across the technology, retail, and media sectors have produced a large, anxious pool of candidates, and scammers scale their operations accordingly. Security researchers tracking phishing infrastructure have noted a persistent rise in recruitment-themed lures, particularly around the new year and again in late summer, when hiring cycles peak.

The Anatomy of a Recruitment Scam

Most job-related fraud follows a recognizable arc, and understanding the stages is the best defense.

Stage one: the approach. The initial contact is deliberately unremarkable. The recruiter's profile is often cloned from a real employee — photo, job title, even copied posts — with only small alterations to the handle or URL. In some cases the message is generated by automation, sent to hundreds of candidates whose profiles match a keyword search.

Stage two: the off-platform pivot. Early in the conversation, the "recruiter" suggests moving to a messaging app such as Telegram, WhatsApp, or Google Chat, away from the platform where identity signals are stronger. This is a consistent red flag. Legitimate recruiters conduct business through corporate email and scheduled video calls; the pivot exists to escape moderation and reporting tools.

Stage three: the interview that isn't. Some schemes run a full fake interview, sometimes with deepfake video or AI-filtered audio, to build credibility. Others skip straight to an implausibly fast offer — a job extended within a day or two of first contact, before any real vetting could have occurred.

Stage four: the extraction. This is where the scam monetizes. Common variants include:

• Direct deposit setup. The victim is asked for a bank account number and routing number to "process payroll." This hands over the keys to direct financial theft.
• Fee-based fraud. The candidate is told they must pay for equipment, a background check, training software, or a visa application. No legitimate US employer charges applicants for these.
• Identity harvesting. The victim completes a "new hire packet" requesting a Social Security number, date of birth, and copies of a driver's license or passport — a complete identity-theft kit in one submission.
• The mule trap. In the most serious variant, the victim is asked to receive and forward payments, unknowingly becoming a money mule in a laundering operation. Federal authorities, including the FBI's Internet Crime Complaint Center (IC3), have repeatedly warned that participation can carry legal exposure even when the victim was deceived.

The Red Flags Worth Memorizing

Not every suspicious message is a scam, but a cluster of warning signs should end the conversation:

• An offer made before a substantive interview
• Pressure to communicate exclusively on a personal messaging app
• Free email domains (Gmail, Outlook) used for a corporate recruiter role
• Requests for bank details, SSN, or identity documents before a formal offer and verified hiring process
• Any fee charged to the applicant, described as refundable or otherwise
• Generic company names, recently created websites, or a recruiter profile with a thin, copied posting history

How to Verify a Recruiter Before You Share Anything

Verification takes minutes; recovery from identity theft takes years. A short routine covers most cases:

1. Check the company's own careers page. If the role isn't listed on the official site or a major applicant-tracking system, treat the approach skeptically.
2. Find the recruiter independently. Look up the person on the company's official website or call the company's publicly listed main number — not any number the recruiter provides.
3. Inspect the email domain. Hover over the sender address. "[email protected]" is not the same as "[email protected]."
4. Search the exact message. Pasted phrases like "we came across your profile and were impressed" often appear verbatim in scam-report forums.
5. Withhold sensitive data until late. Bank details and SSNs belong only in a verified employer's secure onboarding portal, after a signed offer letter — never in a chat thread or an emailed form.
6. Report what you find. Suspected recruitment fraud can be filed with the FTC at ReportFraud.ftc.gov, with IC3, and through the reporting tools on LinkedIn or the job board where contact occurred.

A Tight Market Shouldn't Mean a Loose Guard

The cruel arithmetic of these schemes is that they prey on the very urgency a difficult job market creates. But the fundamentals of digital caution still apply, perhaps more than ever: the slower, more boring channel is usually the legitimate one. A real recruiter will not object to a video call on a corporate platform, an emailed offer letter on company letterhead, or a candidate who wants to verify the role before sharing a Social Security number.

The best time to be skeptical is before the offer letter arrives, not after the bank details do.