Overview
The victim expects to interview with a company for a position, particularly in a remote work context.
How It Works
The scammer, posing as a recruiter or hiring manager, finds victims through ads placed on job search sites.
For versions of the scam that involve cryptocurrency stealing, the scammer may purposely target cryptocurrency enthusiasts or may impersonate a cryptocurrency company such as Coinbase.
Many times the scammer will pose as a real recruiter, stealing their name, profile picture, and so on to improve the likelihood that the victim will respond.
The scam typically begins on a job board such as Indeed or LinkedIn, but could also start with a targeted SMS or other message.
When the scam begins on LinkedIn, the scammer will probably ask the victim to move the conversation to a different platform to continue the scam.
The scammer convinces the victim that they got the job, and should complete various personal data forms as part of the onboarding process. The data given by the victim can be used for identity theft.
In some versions of this scam, the scammer sets up a fake interview with the victim, but the job is not real; the interview is used to extract data and information from the applicant.
In other versions of this scam, the scammer convinces the victim to pay for resume polishing or other job-related tasks. These tasks are not completed or not done in a satisfactory manner.
Related Articles
The LinkedIn Job Search Safety Pulse: 2026, LinkedIn 2026-05-06
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories, Trend Micro 2026-04-21
Scammers Are Stealing Recruiters’ Identities to Target Job Seekers, Wall St. Journal, 2026-04-15
Phishers Pose as Palo Alto Networks' Recruiters for Months in Job Scam, Dark Reading, 2026-03-26
Fake Next.js job interview tests backdoor developer's devices, Bleeping Computer, 2026-02-25
Operation Dream Job, CISOmetric, 2024-10-09
Related Scams
3.1 Remote Work / Gigworker Scam: Usually the jobs classified as 3.4 Fake Recruiter Scams have a higher skill threshold than 3.1 Remote/Gigworker scams. The end goal might also be different (e.g. leveling scheme vs data theft).
Related Crime Schemes
A particular instance of this scam may embed one or more of these related schemes.
Data Loss or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.
Fraudulent Platform: Any scheme that relies on custom built software that assists the crime. Includes fraudulent trading platforms, fraudulent clickworking platforms, and the like.
Victim Targeting Context
The scammer may use one or more of the following techniques to reach the victim.
Targeted Conversational Approach: The scammer approaches the victim through targeted, topical online conversation.
Social Engineering: Psychological Manipulations
The scammer may use one or more of these psychological techniques to accomplish the scam.
Authority: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.
Flattery: The scammer uses praise or flattery to increase the likelihood that the victim will go along with the scam.
Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.
Social Engineering: Impersonation Techniques
The scammer may impersonate one or more of the following groups as part of the scam.
Business or NonProfit: The scammer impersonates a business or nonprofit.