Fake Job Offer From a Real Company? Here Is How to Check
Last reviewed: November 2026
A job offer can be fake even when the company exists and the recruiter's name belongs to a real employee. Scammers copy job listings, impersonate hiring staff, and send convincing offer letters. The question is not just whether the company is real. It is whether the person contacting you is authorized to recruit for that role.
A typical fake-recruiter conversation, replayed message by message. Watch what each message is really asking of you.
Sarah Chen, Vertex Systems
Recruiting message
The company is real. The name may even belong to a real employee. Neither proves the sender is that employee. Names, photos and job titles are copied from LinkedIn every day.
What to do: Find the vacancy yourself on the company's official careers page.
Why checking LinkedIn is not enough
A LinkedIn profile proves very little about the person behind an email, chat account or phone number. An attacker can borrow a real employee's name and photograph, copy a job description, and create a lookalike domain. A genuine job advertisement can also be used as cover for a fake recruiting conversation.
Even a polished PDF offer letter is easy to imitate. Branding is not verification.
This matters most when you're under pressure to accept quickly, provide identity documents, or pay for equipment before you've had a normal hiring process.
A seven-step recruiter verification checklist
Find the vacancy independently
Open the employer's official careers page yourself. Search for the role and location. If it is not listed, do not assume it is fake, since some hiring is confidential, but verify with the employer directly.
Contact the employer using details you found yourself
Use the main website's contact information or an official recruitment channel. Ask whether the recruiter, vacancy and offer are genuine. Don't call the number provided only in the suspicious message.
Examine the sending address
A lookalike domain, personal email address, or unexpected reply-to address warrants closer inspection. But a company-domain email is not conclusive either, since accounts can be compromised.
Consider the hiring process as a whole
An unsolicited offer before an interview, an interview conducted entirely through chat, or unusual pressure to act immediately are reasons to verify. None alone proves fraud, but several together should change how cautiously you proceed.
Refuse advance payments and equipment transfers
Be especially wary if you're told to deposit a check, buy a laptop from a specific vendor, send money by payment app, or return an overpayment. A deposited check can appear in your account before it is finally determined to be fraudulent.
Protect identity and banking documents
Real employers may need identity and payroll details during legitimate onboarding. Share them only after confirming the employer and using its approved onboarding process. Be particularly cautious about passport scans, national IDs, bank details and tax identifiers.
Check where forms and links lead
A fake onboarding portal may imitate Microsoft, Google or the employer's HR software. Use official navigation rather than following unexpected links. Never run commands or install software merely to complete an interview or verification step.
What if you've already responded?
- Only shared a CV: Watch for follow-up impersonation, especially if the CV contains your address or other personal details. A CV alone doesn't mean your accounts are compromised.
- Shared an ID document: Keep copies of the conversation, report the incident, and consult the relevant identity-fraud guidance in your country. Monitor for misuse; the appropriate steps depend on what information was exposed.
- Entered an account password: Change it through the official website, revoke sessions where possible, and check MFA settings and account activity.
- Deposited a check or sent money: Contact your bank's fraud team immediately. Don't forward or return funds at the scammer's direction.
- Installed software or granted remote access: Disconnect the affected device from networks if instructed by your IT or security team, and seek professional assistance before continuing to use it for sensitive accounts.
Regional reporting routes
If your bank account or identity documents are involved, contact the relevant provider or authority promptly rather than waiting for an online report to be processed.
Where PhishGlass fits
PhishGlass can help assess suspicious recruiter messages and URLs for phishing indicators. It cannot verify that a recruiter is employed by a company or that an offer is genuine. That requires independent confirmation with the employer. Redact personal information before submitting any material to an analysis service.
Check a suspicious recruiter message with PhishGlassFrequently asked questions
Can scammers impersonate a real recruiter?
Yes. They may use a real employee's name, photograph and job title without that person's involvement.
Is an offer letter with a company logo proof of employment?
No. Logos, signatures, addresses and PDF documents can be copied or fabricated.
Is a job interview over Microsoft Teams a scam?
Not by itself. Teams is used for legitimate interviews. Verify the recruiter and hiring process independently, particularly when the interview is text-only or unusually brief.
Why do fake employers ask me to buy equipment?
Some use fake-check or payment-diversion schemes. They may send funds that later prove invalid while persuading you to send real money to a supposed vendor.
Can AI tell whether a job offer is legitimate?
AI tools can identify suspicious language or links, but they cannot establish that the employer authorized the offer. Verify directly with the employer.