An offer too good to be true. The warning light should come on

Searching for a new job can be quite a challenge. Candidates carefully look at potential positions, employers and responsibilities. As it turns out, however, they have one more serious task ahead of them – the need to distinguish real offers from those prepared by cybercriminals…

Cybercriminals on the labor market

Unfortunately, in addition to authentic ones, you can also find fake ads on the Internet. Professional job boards have practices, processes and safeguards in place to help protect users from such situations. However, many people also look for employment in other ways, e.g. via social media, groups, forums or networking. Fake offers circulating in such places can be very well prepared, fraudsters even go as far as to “construct” the personality and professional life of recruiters or people from HR departments, sometimes stealing real data for this purpose.

Cybercriminals carefully plan such activities, with the end goal of using the collected data to achieve some form of profit – monetary or otherwise. Therefore, in the next steps, they can extort electronic banking data or, for example, fees for fictitious implementation training or “starter packages”, or illegally obtain personal data in order to sell them on the black data market. To protect yourself against this type of actions, it is worth knowing the mechanisms and strategies used by attackers.

Beware of fake recruiters

Unfortunately, users often reveal too much about themselves on the Internet, especially in places such as social networking sites or discussion groups. This may make it easier for fraudsters to obtain data – either by directly purchasing authentication data (from leaks) for accounts or by collecting data shared on various websites on the Internet (so-called web scraping).

Cybercriminals use fake job offers in various ways. They can send messages directly to job seekers (e.g. via instant messaging, online chats and forums, or via e-mail) and attach a malicious link or attachment to the message. Job advertisements may be very similar to those posted on recruitment portals, which makes the scammers' “proposals” look more realistic. Sometimes, at a later stage, they will request information about your bank account or other data, which should always be an alarm signal.

How to make sure you are dealing with a real recruitment offer? ESET expert advice

• Check if the company and person exist– pay attention to the company name, address and whether it is registered as a business entity, present on the Internet and whether it can be found, for example, in the press.
• Verify company/recruiter profiles on social media – look for things like grammatical errors, strange information in posts, and lack of consistent online activity (fake profiles may not have a long-term, regular online presence). You can contact the company directly and check whether it is actually recruiting for this position.
• Look for comments and reactions from real people– recommendations from previous employers and colleagues, certificates, authentic reactions to others' posts, etc.
• Pay attention to site security – fake sites may not have the correct certificate and may not encrypt connections via HTTPS.
• Verify the links you receive from the company/recruiter– spelling errors and typos should raise suspicions.
• Respond to suspicious requests – no company will ask for your bank account number, ID scan, etc. during a job interview. Unless you are already an employee (and have met with verified HR representatives), providing such information is prohibited.
• You should also be alert to typos in the job offer itself– fake websites may contain many typos or grammatical, stylistic or intentional character changes that may not be noticeable at first and are intended to impersonate existing brands (for example, using “0racle” instead of “Oracle”).
• Watch out for extremely attractive offers– if the offer contains information about an extremely attractive remuneration that is inadequate to the duties and responsibilities, it is most likely a fraud.