Deceptions
A salary of $90,000/year, a luxurious home office, and 30 days of paid leave for a junior data analyst position – sounds too good to be true, doesn’t it? Well, that’s because it is. Many job offers like these are simply fabricated to lure unsuspecting individuals into divulging their personal information.
06 Jun 2024
•
,
5 min. read
Currently, securing employment can pose a considerable challenge, given that many companies are opting to either impose hiring freezes or reduce recruitment efforts. Moreover, the recent surge in layoffs has significantly inflated the pool of job seekers.
Despite these circumstances, businesses do not entirely refrain from posting job opportunities. Sometimes, vacant positions are left unfilled but listed as “ghost jobs,” where companies are not actively seeking new hires.
However, amidst legitimate job postings are fraudulent listings claiming to represent reputable firms, flooding job boards with deceptive offers. These deceitful ads can appear highly convincing as scammers meticulously construct false personas and professional identities, often resorting to identity theft to achieve this.
The ultimate objective behind such scams remains the same – to exploit the acquired data for financial or other illicit gains. While job scammers can be crafty, identifying them is not an insurmountable task.
Fabricating fictitious identities
As detailed in an earlier publication on WeLiveSecurity by Daniel Cunha Barbosa, individuals tend to divulge excessive information about themselves online, particularly on platforms like LinkedIn, which functions both as a professional networking site and a job portal. This oversharing can make it easier for malefactors to harvest data, either by purchasing leaked account credentials or through web scraping.
For instance, open-source intelligence (OSINT) tools facilitate the extraction of data from individuals’ online profiles and activities. Tools such as Maltego can unveil information about individuals or organizations on the web, empowering users to establish and map out connections between websites, accounts, emails, locations, and more.
Illustration of the information that can be uncovered using Maltego. Note the extensive network related to just one individual. (Source: Sol González/WeLiveSecurity)
Consequently, creating profiles with the intent of enticing unsuspecting individuals with fake job offers to gather additional data for committing further criminal activities, such as business email compromise or various forms of social engineering attacks, becomes increasingly simplified.
Conversely, individuals can leverage OSINT tools to assess their online exposure, thereby yielding valuable insights, especially for security professionals aiming to uncover information about potential threats that may jeopardize the security posture of those under their guardianship.
Recognizing a counterfeit job posting
What distinguishes a fraudulent job listing? The characteristics vary, as fake recruiters might directly contact job seekers, embedding a malicious link or attachment within the message/email. These deceptive practices are often complemented by counterfeit job openings on recruitment platforms, heightening the appearance of authenticity.
Furthermore, during the initial stages of the application process, scammers might go to lengths of soliciting bank account details or social security numbers, actions that should immediately raise red flags.
Therefore, to validate the legitimacy of an offer before engaging, it is advisable to cross-verify:
- The existence of the company and the individual – official business name, address, registration status, online presence, and any relevant news coverage.
- Social media profiles belonging to the business/recruiter; scrutinize for grammatical errors, peculiar date discrepancies in posts, and irregular online activity (dubious profiles may lack a consistent online presence).
- Testimonials from real individuals, endorsements from previous employers and colleagues, certifications, genuine feedback from the individual on others’ posts, etc.
- The job history and other activities of the recruiter- a higher number of posts on various platforms suggests authenticity. While verifying local job boards can be beneficial, it does not ensure the offer’s legitimacy.
Minor inconsistencies can serve as indicators. Fraudsters frequently fabricate corporate webpages to appear legitimate, but these sites might exhibit discernible characteristics:
- Website security: Bogus websites often lack the HTTPS certification, indicating a potential security threat.
- Hyperlinks: Watch out for suspicious signs in the links, such as misspellings. Additionally, ensure that the intended destination matches the link by hovering over it and verifying the tooltip at the bottom left of the browser window, as illustrated below.
- Questionable Inquiries: No legitimate organization will request your bank details, social security number, identification, or similar information during a job interview. Unless you have interacted with verified Human Resources personnel as an existing employee, refraining from providing such details is advisable.
- Typographical Errors: Fraudulent websites may contain numerous typographical errors or instances of poor grammar, stylistic inconsistencies, or intentional character alterations that might go unnoticed initially (such as using “0racle” instead of “Oracle”).
- Repute: Whenever feasible, conduct a swift examination of the domain using resources like who.is or ScamAdviser.com. These platforms provide valuable insights into the website’s registration, longevity, and more.
Essential Recommendations
Any discourse on safeguarding against fraudulent employment schemes should encompass multiple aspects.
To evade falling prey to identity theft, it’s crucial to constrain your privacy settings on job portals (or social media platforms in general, if possible), and refrain from disclosing personal details online willingly, especially on publicly viewable accounts. As previously indicated, divulging such information makes it simpler for threat actors to compile a comprehensive profile on you using open-source intelligence tools and web scraping techniques.
For instance, you can customize your LinkedIn profile visibility to be public or private (only visible to fellow LinkedIn users) and specify which details are viewable. Further information on this subject can be found in an article authored by André Lameiras.
Secondly, always verify the legitimacy of potential employers before disclosing any personal information. Falling for a sham job listing is a common pitfall, but a scant job advertisement or an inconsistent online presence can be red flags.
Exercise caution with unsolicited emails or messages offering job opportunities from suspicious or unverified sources.
Lastly, if an offer appears excessively enticing (such as promising an unusually high salary without requiring substantial experience), it’s likely a scam.
Overall, the prevalence of fraudulent job advertisements is high, necessitating vigilance to uphold cybersecurity practices for an extended period.
About Author
