The Suspect Job Contact, Scored to Engage, Verify, or Report

You have a recruiter message, a posting, or an "offer" in front of you, and you need to decide whether it is a scam before you reply, apply, or hand over any personal data or money. This guide is for job seekers running an active search across many companies, where suspect contacts arrive faster than you can research each one. It gives you a weighted rubric that ends in one of three actions - engage, verify first, or report and block - and a verification procedure you can run in under ten minutes.

Most red-flag articles hand you a list to worry about and stop there. This one scores a single contact to a decision and, just as important, separates the signals that are conclusive alone from the ones that only mean something stacked together, so you do not blow up a legitimate confidential search over a Gmail address.

Why this judgement call is worth a rubric

Job scams are a large, growing category, so the base rate of fraud in your inbox is not trivial. Treating every inbound as guilty wastes real opportunities; treating every inbound as innocent is expensive.

The FTC reports that job and employment-agency scam losses rose from $90 million in 2020 to $501 million in 2024, with the number of reports tripling over that time. The FBI's Internet Crime Complaint Center (IC3) tracks the same crime from a different angle and shows losses climbing even faster than complaint counts.

The IC3 column tells you something the headline number hides: employment losses quadrupled from about $70 million to $264 million while complaints rose only around 30 percent. The average take per victim went up. That is consistent with higher-value fake-check and investment-style schemes rather than simply more victims, and it is why the conclusive signals in this guide are all about money mechanics.

One more framing fact changes who should read this most carefully. The Better Business Bureau ranked employment scams the No. 2 riskiest scam type in 2024, making up about 14 percent of all reported scams, and ranked them No. 1 riskiest for ages 18 to 34. The usual fraud narrative is about elders; here the youngest workers are the most exposed, lured by work-from-home flexibility.

The two signal tiers: conclusive versus stacking

A signal is conclusive if its presence ends the scoring on its own. A signal is stacking if it means little alone but flips your verdict when it appears with others. Keeping these apart is the whole method - it is what stops you from false-positiving on a real recruiter and what stops you from rationalizing away a genuine red flag.

The conclusive signals are all money mechanics, not identity cues. That is deliberate. Every FTC "always a scammer" line describes a payment or a check, because those transactions are irreversible once executed. Banks make deposited funds available within a day or two but can take weeks to flag a fake check, and that gap is the scammer's clearance window.

The stacking signals are softer. LinkedIn's own data shows scammers are five times more likely to be from outside your network and twice as likely to ask you to move off-platform than a genuine interaction. But "outside my network" and "wants to use WhatsApp" each describe plenty of legitimate recruiters too. They only earn a verdict in combination.

Here are the stacking signals and, for each, what it looks like when the signal lies - because every one of them has an innocent explanation that will burn you if you treat it as proof.

• Free email or personal-number sender. Looks like fraud; lies when a small company or a genuinely confidential search uses a personal address. Count it, never conclude on it.
• Text-only or chat-only interview. Looks like fraud; lies when a busy agency recruiter does an informal first pass by text before a real call.
• Urgency and pressure. Looks like fraud; lies when a real role has a genuine deadline. The tell is pressure to share data or money fast, not pressure to schedule.
• Vague duties or pay quoted with no job detail. Looks like fraud; lies in an early mass-outreach template a legitimate sourcer sends to many people.
• Push to WhatsApp or Telegram. Looks like fraud; lies when a real recruiter prefers messaging. Fine to move chat; not fine to move your data there before you confirm identity.

Score any single contact: the procedure

Run these steps in order against the contact in front of you. The early steps are fast filters; the later ones are the verification you only need when a contact survives the filters. The whole run fits inside ten minutes.

Steps four and five are interchangeable in order - do whichever is faster for the contact you have. If the company is tiny and obscure, verifying the person on LinkedIn first may be quicker; if the recruiter is anonymous, going straight to the careers page is faster. What is not optional is step six.

The independent callback is the only check that survives a hijacked account, polished graphics, or a deepfake on the call.

Reach a verdict: engage, verify, or report

The verdict is a function of two things: whether any conclusive signal fired, and how the contact behaved when you tried to verify it independently. Score it on those two axes and the action falls out.

Note what the top-right quadrant says. A conclusive signal is conclusive even when the sender is friendly and seemingly happy to be checked. Scammers can run a convincing verification theater; what they cannot do is make a pay-to-work demand legitimate. Conclusive beats cooperative, always.

The archetypes you are scoring against

Knowing the common shapes of the crime helps you recognize which signal cluster you are looking at and which remediation you will need if it goes wrong. Five archetypes are documented, and they split cleanly by what the scammer is after.

Task scams now dominate the category. They were nearly 40 percent of job scam reports in 2024, and crypto losses to job scams roughly doubled, from about $21 million in all of 2023 to about $41 million in the first half of 2024. Crypto matters because those rails are not reversible the way a card chargeback is, which is exactly why remediation in the final step depends so heavily on how you paid.

Because recruiter impersonation leans on real company names, "verify the person" is both the hardest and the most decisive move. You cannot know recruiters by reputation at the scale of a mass application campaign. In Refolk's index there are 117,997 US profiles holding recruiter or talent-acquisition titles, against 7,781 in the UK - roughly a 15 to 1 ratio.

That haystack is the problem. When a message claims to come from a named company's talent team, the fast confirmation is to pull the real recruiters at that company and check whether the person who contacted you is among them. Refolk builds that list from public history so you can cross-check the sender against people who actually hold the role, instead of trusting the profile the message pointed you to.

When SSN, bank details, and ID are actually legitimate

A trustworthy employer requests your SSN or banking details only after an official hire, around a signed offer, never early. That is the defensible line, and it is the one to hold.

The reason SSN-before-offer is treated as conclusive here is that the request is the payload in a data-harvesting scam. The FTC is blunt about the motive: what they want is your bank account number to steal your money, or your Social Security number to steal your identity. An early request framed as being "for direct deposit setup" or "to run the background check" is the harvesting marker, not a normal step.

The honest limit: no single regulator document specifies exact day-one-versus-offer sequencing to the day. Real onboarding does eventually need this data. The workable rule is that nothing sensitive leaves your hands until there is a signed offer and you have independently confirmed the employer. If a process genuinely needs your SSN sooner, it will survive a callback to a number you found yourself - and if it will not, that is your answer.

How this goes wrong: the false positives and false negatives

The expensive mistakes split two ways. False negatives let a scam through; false positives make you discard a real opportunity. A rubric that only guards one direction is half a rubric, so weight this section heavily.

• Over-weighting a free email domain. Legitimate confidential and small-company searches do use personal addresses. Blocking on domain alone discards real recruiters. Domain is a stacking signal, never conclusive - resolve it with the independent callback.
• Trusting a verification badge as proof. The badge is a trust signal, not a guarantee. Some legitimate recruiters lack it, and scammers hijack real, badged accounts. Layer the badge with the careers page and an independent call rather than leaning on it.
• "The check cleared." Funds becoming available is not the check clearing. A fake can bounce weeks later and you owe the full amount. Treat any mailed check with a send-money-back instruction as a scam regardless of how the funds look.
• Assuming a missing role means fraud. A role absent from the careers page raises the bar but is not proof, because genuine unposted and confidential roles exist. Confirm via the switchboard before concluding.
• Reading polished graphics as legitimacy. The FTC warns not to trust a message no matter how professional the graphics look. Judge the ask, not the design.
• Ignoring the off-platform push. Moving to WhatsApp or Telegram is twice as common in scams but also used by some real recruiters. The defense is not to refuse the chat but to refuse to share data or money until identity is independently confirmed.
• Treating a video call as clearance. Deepfake video and voice now defeat the old "I saw their face" test. Require the independent callback anyway.

The through-line: almost every false positive is cured by the independent callback, and almost every false negative is cured by respecting the conclusive tier. If you are unsure, you have not run step six yet.

Remediate fast if you already engaged

If you have already paid, deposited a check, or shared credentials, speed decides whether you recover anything, so act before you finish reading. The right move depends entirely on how the exposure happened.

• You paid. Whether by debit or credit card, payment app, wire, gift card, or crypto, immediately contact the company you used to send the money, report the fraud, and ask to reverse the transaction. Card and app payments sometimes reverse; crypto and wire rarely do, which is why scammers prefer them.
• You deposited a check. Notify your bank immediately and tell them you suspect a fake-check scam. Do not spend or forward any of the funds.
• You shared credentials or clicked a link. Change your passwords and enable two-factor authentication on the affected accounts before anything else.
• Report it regardless of outcome. File at ReportFraud.ftc.gov and IC3.gov, and use the in-product report function on LinkedIn or the platform where the contact arrived.

Reporting feels pointless when your money is gone, but the figures in this guide exist because people report. The median employment-scam loss the BBB recorded in 2024 was $1,500; among frauds, fake-check losses have historically run far higher. Your report is what makes the next person's rubric accurate.

Keep your rubric current

The scam category changes faster than any static list can track, so maintain the rubric by watching the mechanism, not the specific trick. The conclusive tier is stable because it is about irreversible money movement; the stacking tier and the archetypes drift.

Two drifts are already visible. The newest FTC twist asks you to reply "YES" or "INTERESTED" instead of clicking a link, which defeats link-based detection, so treat an unsolicited reply-to-confirm text as a stacking signal in its own right. And AI voice and deepfake video have erased the video interview as a safety check. Re-check the FTC job scams hub and the IC3 annual report on a cadence - say, each time you start a new search - and add any new mechanism to your stacking list. When a new trick appears, ask the one question that sorts it: does it try to move money irreversibly, or does it try to harvest identity? If yes to either, it belongs in the conclusive tier. If it is only a behavioral tell, it stacks. The verdict logic does not change; only the inputs do.