Table of Contents
An unexpected remote-job message may mention a recognizable company, flexible hours and attractive pay. The sender may even know your name or public work history. None of that proves the message is genuine.
The U.S. Federal Trade Commission warned in April 2026 about fake recruiters who impersonate familiar companies and offer vague work-from-home roles. A newer variation asks the recipient to reply with a word such as “YES” or “INTERESTED” instead of immediately clicking a link. The first reply is only the opening. The conversation can later turn into a fake-check scheme, a task scam, identity theft or another request for money.
You do not need to decide whether a message “looks professional.” Use a verification process independent of the sender. This protocol checks the recruiter, vacancy and channel before engagement.
Start with a pause, not a reply
Do not click, download, call the supplied number or reply just to see what happens. Take a screenshot for your records, then leave the message alone while you investigate independently.
This matters because replying confirms that your number is active and gives the sender another opportunity to create urgency. A scammer may say that interview slots are filling, a manager is waiting or the offer expires today. A legitimate recruiter can explain a real vacancy after you verify who they are. You do not lose a credible career opportunity by taking enough time to check it safely.
An unsolicited message, a vague title, early emphasis on pay, pressure to move to an encrypted app or a request for a one-word reply are reasons to investigate. Real recruiters sometimes approach candidates they have not met; the safe distinction is whether the identity, role and hiring route can be confirmed outside the message.
Use the three-part verification test
Check three separate things: the company, the vacancy and the person. One true element does not validate the others. A real company can be impersonated, a copied vacancy can be paired with a fake contact, and a real employee’s name can be used by someone else.
1. Verify the company independently
Type the company name into your browser yourself. Do not use the message’s link or rely on a search advertisement. Find the official website, then locate its careers page and fraud-warning page if it has one.
Compare the official domain with the sender’s email address character by character. Look for swapped letters, extra hyphens, unusual endings or a free account such as Gmail. A corporate-looking display name is not the underlying address. On mobile, expand the sender information so you can see the complete address.
The absence of a corporate email is a serious warning sign, but the presence of one is not absolute proof. Email addresses and display names can be spoofed, and lookalike domains can be registered. Continue with the next checks.
2. Verify the vacancy at its source
Search the official careers page for the exact title, reference number, location and department. “Remote” rarely means that anyone in any country can work there. Genuine listings often specify permitted countries or states, employment status, working hours, tax or payroll restrictions and required authorization.
If you find a matching listing, compare it with the message. Check the duties, pay format, manager, application method and closing date. Scammers frequently copy real descriptions, so a matching advert confirms that the job exists—not that the person contacting you represents the employer.
If the vacancy is absent, it may have closed or be handled confidentially, but the burden of verification becomes higher. Contact the employer through a phone number or email found on its official website and ask whether the recruiter and requisition are genuine. Do not use contact details supplied by the suspected recruiter.
3. Verify the recruiter through a second channel
Search the recruiter’s name together with the company, role and words such as “scam” or “complaint.” Review whether the person has a plausible work history and whether the employer lists or recognizes them. Remember that a convincing profile can be copied or compromised.
Then use an independent channel. For example, call the company’s published switchboard or email its verified recruiting team. State the name, claimed title, job reference and contact address. Ask for confirmation without forwarding sensitive documents.
If the sender resists independent verification or pressures you to stay inside one messaging app, stop the conversation.
Evaluate the hiring process, not the graphics
Scammers can copy logos, signatures, job descriptions, contracts and onboarding forms. A polished PDF is easy to reproduce. A credible process is harder to fake.
Before an offer, expect a meaningful discussion of your experience, the work, the team and practical requirements. The FTC notes that scammers may send official-looking paperwork and seek bank or identity information before conducting a real interview. A text-only interview followed by an immediate offer deserves special caution, particularly when no one will speak by voice or video and no independently verified employee participates.
Ask for the official job reference, vacancy URL, employing legal entity, permitted work location, interview participants, duties, hours and contract type. Also ask when identity and payroll details are collected and through which secure system. Vague or contradictory answers matter more than elegant language. Save the original listing and compare every later document with it.
Never pay to unlock work or wages
A legitimate employer does not require you to send money to receive wages. Stop if the “job” requires a deposit, cryptocurrency purchase, gift card, training fee, account recharge or payment to unlock higher-value tasks.
Task scams often present simple activities such as rating products or completing sets of clicks. A dashboard may show rising earnings, while a group chat contains apparent coworkers celebrating withdrawals. Scamwatch warns that these groups can include scammers and bots. A displayed balance is not proof that money can be withdrawn.
Fake-check schemes use a different route. The sender may mail a check for equipment, ask you to deposit it, then instruct you to pay a “vendor” or return an excess amount. A bank may temporarily show funds before discovering that the check is fraudulent. Do not forward any portion of a check or purchase equipment through an unverified supplier.
Also reject any role that asks you to receive money into your personal account and transfer it elsewhere. Titles such as remote cashier, finance agent or payment assistant can conceal money-mule activity. You may be moving stolen funds even if the recruiter calls it transaction processing.
Protect documents until identity and purpose are clear
Normal employers eventually need information for payroll, tax and right-to-work checks. Timing and submission method matter. Before a verified interview and offer, do not send a passport, driver’s licence, national identification number, bank details, login code or full date of birth through chat or email.
Ask why each item is needed, who receives it, how it is stored and which secure portal should be used. Navigate to the portal independently when possible. Confirm the domain with the employer’s verified contact.
If a recruiter asks for a résumé early, remove unnecessary sensitive details such as your full street address, identification number and banking information. Use a dedicated job-search email, unique passwords and multifactor authentication.
Treat files and coding exercises as software risk
Some fake recruiting campaigns target developers with repositories, packages or Visual Studio Code projects that contain malware. A multinational advisory published on September 18, 2026 described attackers using fake job opportunities and technical interviews to persuade candidates to download files or execute code.
Do not run an unfamiliar project on a computer that contains saved passwords, client data, employer access or cryptocurrency wallets. Verify the company and interviewer first. Review the repository and package history, inspect scripts and dependencies, and use an isolated environment when appropriate. Visual Studio Code’s Restricted Mode can reduce some risks, but it is not a substitute for verification and security review.
Job Online Club’s fake coding interview scam guide covers this technical scenario in more depth. The broader rule is simple: an interview request does not make an unknown file safe.
Use a ten-minute decision record
Create a short record before continuing with any unexpected recruiter. Note the sender, the independently found company website, the official vacancy URL, how you verified the recruiter, the permitted work location, the contract type and every request for money, documents, downloads or account access.
Mark the contact verified, unverified or stop. “Unverified” means you do not proceed yet. “Stop” applies when the sender requests payment, asks you to move money, refuses independent verification, sends suspicious files or demands sensitive data prematurely.
This record prevents urgency from replacing judgment. It also helps you compare the contact with the original advert instead of relying on memory.
If you already replied or shared information
Replying once does not mean you must continue. Stop contact, do not send additional information and preserve screenshots, email headers, payment instructions, wallet addresses and transaction records.
If you sent money, contact your bank, card provider or payment service immediately and ask whether a transaction can be stopped or recalled. If you shared a password, change it anywhere it was reused, enable multifactor authentication and review active sessions. If you installed software or ran unknown code, disconnect the device from the internet and seek qualified security help; use a different trusted device to change important credentials.
For exposed identity documents, follow the identity-theft guidance for your country and monitor relevant accounts. U.S. users can report fraud at ReportFraud.ftc.gov and internet crime at IC3.gov. Australian users can report to Scamwatch. Elsewhere, use your national fraud-reporting service and local police guidance when appropriate.
Build safety into a real remote-job search
Start from employer career pages or reputable platforms, then verify independently. Track the company, role, URL, date applied and contacts so an unexpected message can be matched to a real application. For finding genuine opportunities, use the site’s LinkedIn AI job-search guide. The seasonal remote customer service guide explains location and contract checks, while the guide to using AI responsibly helps keep applications truthful.
No checklist guarantees safety. The goal is to separate discovery from verification and refuse irreversible actions until identity, vacancy and process all match.
The practical takeaway
Do not judge an unexpected remote-job message by its logo, confidence or promised pay. Pause, find the employer independently, confirm the vacancy, verify the recruiter through a second channel and examine the hiring process. Never pay to get paid, move money for an employer or run unknown files simply because they are described as an interview task.
A real opportunity should survive reasonable verification. If the sender tries to prevent that verification, the safest career move is to walk away.
