You are four months into a search, your inbox is a graveyard, and a recruiter from Randstad just messaged you on LinkedIn. She has read your profile. She likes your background. There is just one problem: your resume scored badly on her firm's ATS pre-check, and she knows a guy who can fix it for $4,000 before the hiring manager sees it.
That is the exact script running through LinkedIn right now, and it is working. The FTC logged $501 million in reported job-scam losses in 2024, roughly 5.6x the $90 million reported in 2020. This piece is a field guide: how the DM unfolds, six red flags you can check in under 60 seconds, and what an ATS actually does (spoiler: it does not score you).
What the $4,000 "ATS rewrite" scam actually is
It is a social engineering play that clones an inactive LinkedIn recruiter profile, sends you a warm intro about a real-sounding role, then pivots to a demand that you pay a "trusted resume partner" up to $4,000 to make your resume "ATS-friendly" before the interview. The mechanic, documented in Ben Rothke's Medium writeup: "They use AI to rewrite the resume, something the job seeker could have done for free themselves. But the scammer charges up to $4,000 for this."
The impersonation targets are chosen for plausibility. Rothke names two real recruiters whose profiles were cloned: Sarah Nester at Randstad (the real Sarah Nester has not posted on LinkedIn in over two years) and Jeanette Christy at Insight Global. Inactive profiles are perfect cover, because the real person is not around to notice or reply to a confused mark.
Up from $90M in 2020, a 5.6x jump in four years.
GitLab published an official advisory confirming the tech-company variant of the same script. Attackers stood up lookalike domains (gitlab[.]careers, careers-gitlab[.]com), invented a fake credential called "CPD USA Certification," and impersonated GitLab HR staff on LinkedIn and Microsoft Teams before asking for sensitive information or upfront "equipment" payments. If GitLab has to write a blog post about it, the pattern is not fringe.
Why this works: the ATS black hole made you an easy mark
The scam works because it names a fear you already have. After months of sending applications into what feels like a black hole, being told your resume "won't even get seen" triggers exactly the panic response the scammer needs. A PasswordManager.com survey found that one in four people who looked for a job in 2025 fell victim to a hiring scam.
Two counterintuitive facts about who gets hit:
- Young workers are the volume victims. 44% of people aged 20 to 29 reported losing money to scams in FTC data, versus 24% among people aged 70 to 79. Recently laid-off engineers and analysts in their twenties are the modal target, not retirees.
- Older workers lose more per hit. People aged 70 to 79 reported a median loss of $1,000, compared with $417 for people aged 20 to 29. The $4,000 rewrite invoice is the older-victim variant of the same script.
Email is where the handoff happens. Per the FTC: "For the second year in a row, email was the most common way scammers reached people, accounting for a quarter of the fraud reports and $502 million in losses." The DM builds trust on LinkedIn. The invoice arrives from Gmail.
The 6 red flags in the recruiter DM
Here they are, in the order they usually appear in the message thread. Any one of them is enough to close the tab. Two or more and you are being scammed.
1. The recruiter's profile has not posted in 18+ months
Legitimate recruiters live on LinkedIn. They post open reqs, repost company updates, congratulate placements. A "senior technical recruiter at Randstad" with no activity in over two years and a fresh connection request to you is almost certainly a cloned profile. Click through to the company page and search the recruiter's name directly. If two profiles come back with the same headshot, the newer one is the fake.
2. Contact email is @gmail.com, not @company.com
This is the single highest-signal tell, and it is the one mobile users miss because the address collapses to a name on small screens. Rothke: "On mobile, fake emails are easy to miss; on desktop they're easier to spot but still overlooked if you're not paying attention." Rule: open every recruiter email on desktop before you reply. A Randstad recruiter emails from a Randstad domain. An Insight Global recruiter emails from an Insight Global domain. Never from @gmail.com, @outlook.com, or @proton.me.
3. They mention your "ATS score"
There is no such thing. Applicant Tracking Systems are database and workflow tools that let recruiters filter high volumes of applications by keyword, location, and experience. They do not assign your resume a 42/100 or a B minus. As CurryPro puts it plainly: "There is simply no such thing as an 'ATS score.'" Any recruiter, coach, or SaaS tool that quotes you a number is either scamming you or reselling vendor marketing from a resume-checker app.
4. They recommend a "trusted resume partner" (who is them)
Real recruiters get paid by employers. Money never flows from the candidate. If a recruiter suggests you pay anyone (them, their friend, a coach, a certification body) before an interview, the placement is fake. That is 100% of the tell, not 90%.
5. The urgency is 24 to 48 hours
"The hiring manager wants to move by Friday, so we need your rewritten resume by tomorrow." Urgency is how social engineers shut down the frontal cortex. Real hiring processes at real companies move in weeks. Interview loops get scheduled around calendars. A recruiter who can only work with you if you Venmo $4,000 by tomorrow is not a recruiter.
6. The invoice references a fake certification
GitLab's advisory called out "CPD USA Certification" specifically. If you Google the credential and the only results are the scammer's own site and a few thin blog posts, it does not exist. No legitimate accrediting body gates resume writing.
The supply side: why $4,000 is pure markup
The service the scammer is reselling costs $25 to $94 on Fiverr, and the top of that range buys you a bundle with a LinkedIn rewrite thrown in. A Fiverr search for "ats resumes" currently returns over 6,700 gigs. The scam is not fabricating a product. It is arbitraging a $50 Fiverr gig into a $4,000 invoice by adding fake authority and a 24-hour deadline.
The market context matters, and it is why the pitch even sounds plausible. In Refolk's index of US professional profiles, 114,625 people hold Recruiter, Technical Recruiter, or Talent Acquisition titles, while only 5,367 hold Resume Writer or Career Coach titles. That is roughly a 21:1 ratio. A legitimate recruiter recommending "their personal resume writer" as the gating step for an interview is statistically weird, not a normal handoff. Recruiters recommend that you clean up your LinkedIn. They do not broker a paid rewrite.
| Metric | Figure | Source |
|---|---|---|
| US Recruiter / TA titles | 114,625 | Refolk's index |
| US Resume Writer / Career Coach titles | 5,367 | Refolk's index |
| Recruiter-to-coach ratio | ~21:1 | Derived |
| Fiverr "ATS resume" gigs | 6,700+ | fiverr.com |
| Scam price ceiling | $4,000 | Rothke, Medium |
| Fiverr equivalent price | $25 to $94 | fiverr.com |
| Implied markup | 40x to 160x | Derived |
| FTC job-scam losses, 2020 to 2024 | $90M to $501M | consumer.ftc.gov |
Real recruiters get paid by employers. The moment money flows from the candidate, it is not a real placement.
What an actually ATS-parseable resume looks like
Boring, single-column, and free. An ATS-parseable resume is a .docx or a text-based PDF (not an image scan) with standard section headings, no tables, no text boxes, no columns, no headshots, and no icons. That is the whole spec. It does not have a "score." It has parseability, which is binary: the parser either reads your job history correctly into the database or it does not.
Concrete rules that matter:
- Headings the parser expects. Use "Experience," "Education," "Skills." Not "Where I've Been" or "My Journey." Parsers match on the strings.
- Dates in one format. "Jan 2022 to Present," left-aligned, on the same line as the employer. Not "January '22 - now" in a sidebar.
- One column. Two-column templates in Canva and Word look elegant and destroy the parse order. The parser reads left-to-right, top-to-bottom, and your job titles end up interleaved with your skills list.
- Real text, not shapes. Every character on the page needs to be selectable. If you can highlight it with a cursor, it parses. If you cannot, it is an image.
- Keywords from the actual posting. The ATS filters on the recruiter's search string, which comes from the JD. If the posting says "Snowflake," your resume needs the word "Snowflake," not "cloud data warehouse."
That last point is where most people get stuck, and it is the reason the fake "ATS partner" pitch lands. Tailoring a resume to every posting is real work, and doing it by hand across fifty applications is where candidates burn out and start reaching for shortcuts. That is the exact work Refolk takes off you: paste the posting, get your own resume back rewritten against it, with the cover letter drafted and a fit score attached so you know before you apply whether it is worth the hour.
What to do if a scammer already contacted you
Three steps, in order.
- Do not pay, do not send ID, do not send a filled-in tax form. The rewrite invoice is the front door. The back door is a W-9 or driver's license request for "onboarding," which is identity theft.
- Report the profile to LinkedIn and the real company. LinkedIn's report flow is under the three-dot menu on the profile. Email the real company's talent team ("Is this recruiter one of yours?") with the DM screenshot. GitLab's own advisory includes a security contact for exactly this.
- File with the FTC at reportfraud.ftc.gov. The $501M figure exists because people file. Yours makes the next warning louder.
Then get back to the actual search. Apply through the company careers page, not a recruiter DM link. Verify the domain by typing it, not by clicking. Start from listings you can trace to a real employer, not a DM.
FAQ
Is there really no such thing as an ATS score?
Correct. ATS platforms (Greenhouse, Workday, Lever, iCIMS, and the rest) are search-and-filter tools that let a recruiter query the applicant pool by keyword, years of experience, location, and screening question answers. They do not compute a numeric score for your resume. The "82/100 ATS match" number you see in some SaaS tools is that tool's proprietary keyword-overlap metric, not anything the hiring company sees. Any recruiter who quotes you a score is fake, mistaken, or upselling.
How do I verify a LinkedIn recruiter is real in 60 seconds?
Four checks. First, look at post activity: real recruiters post or repost within the last month. Second, cross-reference the name on the actual company's team page or a Google search restricted to the company domain. Third, check the email domain of any message they send: @company.com only, never @gmail.com. Fourth, ask them to send the JD from their corporate email and confirm the posting exists on the company careers page. A real recruiter will do this in ten minutes. A scammer will pressure you to skip it.
What if a legitimate recruiter says my resume needs work?
That happens, and the advice is usually free and specific: "Move your most recent role to the top," "add the Snowflake keyword," "shorten to two pages." Real recruiters give feedback because they get paid when you get hired, so helping you costs them nothing. If the feedback comes with an invoice, a Venmo request, or a referral to a "trusted partner," it is not feedback. It is a sales pitch, and the product is a Fiverr gig with a 40x to 160x markup.
Are Fiverr resume writers themselves a scam?
No, most are just cheap. A $50 Fiverr rewrite is often a reasonable AI-assisted pass on your existing resume, and some sellers are legitimately skilled. The scam is not the Fiverr gig. The scam is a fake recruiter reselling that same gig as a $4,000 gated step before an interview that does not exist. If you want the Fiverr version, buy it directly for $50. If you want it tailored per posting instead of once, Refolk does that from your history so you are not paying per rewrite.