What does a job-offer scam actually look like?
One shape, repeated. Contact you did not ask for, a company name you recognise, and a hiring process that never leaves the chat window.
The FTC's alert on unexpected messages offering online work puts the opening on WhatsApp, Telegram, text or social media, and states the rule flatly: real employers will never contact you that way. The company named is usually a real one, because a borrowed reputation costs nothing.
What follows is an interview made of typing. Questions arrive in the chat, answers go back in the chat, and an offer lands within a day or two, often with a logo, a contract and a start date. The profile doing the typing is a photograph and a first name; a WhatsApp profile publishes privacy defaults, not facts about anybody.
Then the money moves, and it moves towards them. Equipment you must buy, training you must pay for, or a cheque to deposit and partly forward. The last is worth understanding in detail, because it is the only one that arrives looking like being paid.
How does the cheque-overpayment trick work?
You send real money against a deposit that was never money.
US banks must make deposited funds available quickly, and the FTC's guidance on fake cheques says what that does not mean: seeing the funds in your account is not evidence the cheque is good. The credit is provisional; the paying bank has decided nothing yet.
Weeks can pass before the item comes back marked counterfeit. The Office of the Comptroller of the Currency, which regulates national banks, is direct about the consequence: if your bank credited your account, it can later reverse the funds when the cheque is found to be fraudulent, and as the payee it is generally your job to pursue whoever handed it over.
So the timing is the trick. You send genuine funds in week one against a balance that vanishes in week four, and the person the bank can reach is you.
Never forward money against a deposited cheque. The credit is provisional until the paying bank settles, and no employer with a real vacancy asks you not to wait for it.
One offer, four ways the money leaves
The story changes and the direction of the money does not. Each version ends with you sending funds to somebody who has not yet sent you any.
| The ask | How it is framed | The tell |
|---|---|---|
| Buy your own equipment | A laptop and headset from our supplier | An employer that hires you buys the kit |
| Pay for training or certification | Refunded with your first pay packet | Nobody charges you for being hired |
| Deposit a cheque, forward part of it | An overpayment, or supplies for the role | The credit reverses weeks after you send |
| Top up the account to unlock tasks | Your commission is waiting inside the app | Nobody pays in order to be paid |
The FTC covers all four in one line of its job-scams guidance: honest employers, including the federal government, will never ask you to pay to get a job. A request for money is not a stage of hiring that some companies happen to have.
An offer letter with a logo on it is the cheapest part of the story to produce. The reversal, four weeks later, is the part nobody forges.
How do you verify a recruiter before replying?
Four checks, none of which involves answering the message.
Start at the company's own careers page, reached by typing the company name into a browser rather than by following a link you were sent. A real vacancy is advertised there, with a named location and a reference you can quote.
Then put the recruiter beside the company. A profile carrying no history before this quarter, and not appearing among the employees the company lists itself, describes somebody who did not exist last year — reading a LinkedIn profile covers what the page gives up on its own.
Then the address and the telephone. Mail from a real employer arrives on the company's domain rather than a free mailbox or a lookalike spelling, and whether an address exists at all is a different question from whether it belongs to whom it claims. Ring the published switchboard and ask for the recruiter by name, never the number in the message — the checks on the number itself are set out separately.
What is a task scam, and why do people top up?
Because the app shows a balance, and the balance is the product.
The FTC's December 2024 data spotlight describes the work as simple repetitive tasks — liking videos, rating product images — assigned in sets of forty, inside an app that shows a commission climbing with every click. Small early payouts, usually $5 to $20, establish that the system pays.
Then the deposit appears. To unlock the next set and release the earnings you are told to charge up the account, usually in cryptocurrency. The earnings were never real and the deposit does not come back.
The scale moved quickly. About 20,000 people reported task scams in the first half of 2024 against about 5,000 in all of 2023, and cryptocurrency losses to job scams reached about $41 million in that half-year against about $21 million across the whole of 2023.
The interview that never becomes a video call
A hiring process conducted entirely in writing is the clearest structural tell available, and it is also the one that is weakening.
Text hides everything a live conversation exposes: no face, no unscripted answer, no colleague crossing the frame, no accent that has to match the country in the letterhead. An offer that arrives without anybody appearing on a call has skipped the only stage that is expensive to fake.
Name the limit in the same breath. The FBI's 2025 Internet Crime Report records the same technology running the other way — applicants using voice spoofing or deepfakes during on-camera interviews, with lip movement and audio failing to line up — and puts almost $13 million of 2025 losses on employment scams with an AI element.
So treat a video call as evidence rather than as the end of the question. It establishes that somebody was willing to appear on camera. It does not establish who.
How much of this is actually reported?
Enough that the two federal counters point the same way.
The FTC reported in March 2025 that job and employment agency scam reports tripled between 2020 and 2024, with reported losses rising from $90 million to $501 million over the same period. The wider business-and-job-opportunities category reached $750.6 million in 2024.
The FBI's complaint centre counts separately and agrees. Its 2025 report logs 24,688 employment complaints and $362,934,762 in losses, against 20,044 complaints and $264,223,271 the year before.
Read both as floors rather than as measurements. The FTC says outright that the vast majority of frauds are never reported, so each figure describes the share of people who filled in a form afterwards. The two bodies also classify differently, which is why the totals are not meant to be added together.
What can a lookup settle about a recruiter?
The identifiers they hand you, and nothing about the offer itself.
An email address is the strongest thing in a recruiter's signature. The email module here reaches 71 sources and returns the public accounts opened with it, its breach appearances and the domain behind it, and an address created this month attached to nothing sits badly beside a decade in recruitment.
A username reaches 71 platforms, a name reaches 13 registers and a phone number reaches 8, which is the honest order to try them in. The phone module is thin because numbers are not written down in public the way handles and domains are.
None of it reads the offer. A lookup can show that a recruiter's address has no history at all; it cannot tell you whether the company has ever heard of the person using it, which is why the careers page and the switchboard do the heavier work.
If you have already deposited the cheque
Two calls, in this order, today.
Ring the bank first and say you believe you have deposited a fraudulent cheque. Stopping an outgoing transfer in the first hours is worth more than anything else available to you, and the bank would rather hear it from you than from the returning item.
Send nothing further, whatever the employer says about the delay. Then report it — in the United States that is ReportFraud.ftc.gov and the FBI's complaint centre at ic3.gov, and elsewhere your national fraud body.
Expect a second approach afterwards. Anybody who contacts you offering to recover the money is running the next scam, which is the same ending documented after investment frauds, where the list of victims is itself resold.
Common questions
How do I check if a job offer is a scam?
Verify the employer without using anything in the message. Type the company name into a browser, open its own careers page and look for the role. Check the recruiter against the employees the company lists, check the email address sits on the company domain, then ring the published switchboard. An offer that survives all four is still not proof, but very few reach it.
Why does a fake cheque clear and then bounce weeks later?
Because availability and payment are two different events. US banks must make deposited funds available quickly, so the credit appears within days as a provisional entry. The paying bank may take weeks to return the item as counterfeit. The FTC states plainly that seeing the funds in your account does not mean the cheque is good.
Am I liable if I deposit a fraudulent cheque and send the money on?
Usually, yes. The Office of the Comptroller of the Currency answers it directly: if your bank credited your account, it can later reverse the funds when the cheque is found to be fraudulent, and as the payee it is generally up to you to pursue whoever gave it to you. Your deposit account agreement sets out the detail.
Should an employer ever ask me to pay for equipment or training?
No. The FTC's rule is that honest employers, including the federal government, never ask you to pay to get a job. Kit, software licences, certifications and background checks are the employer's cost. A refund promised with your first pay packet is the same request wearing a different sentence, and the pay packet does not arrive.
How do I verify that a recruiter really works for the company?
Two routes that do not depend on each other. Look for them among the employees the company lists itself rather than trusting the profile you were sent, and check whether anything on that profile predates the vacancy. Then telephone the company's own published switchboard and ask for them by name. A recruiter nobody there recognises ends the question.
What is a task scam?
Paid work that turns out to be a game. You rate products or like videos inside an app showing commissions that climb, receive a small early payout of $5 to $20, and are then told to deposit your own money, usually cryptocurrency, to unlock the next set and withdraw. The earnings were never real and the deposit does not return.
Is a job interview held entirely over chat a red flag?
A strong one. Text hides everything a live conversation exposes and costs the sender nothing, so an offer arriving without anybody appearing on a call has skipped the expensive stage. Treat a video call as evidence rather than proof: the FBI's 2025 report records voice spoofing and deepfakes used during on-camera employment interviews.
Does a recruiter's profile prove they are real?
No. It shows what somebody typed into a form, so read it against the company rather than on its own terms. What matters is whether the person appears among the company's listed employees and whether anything on the profile predates the vacancy. A profile with no history before this quarter is describing a very new object.
What can a lookup on a recruiter's email address show?
Whatever public trace the address has. The email module here reaches 71 sources and returns accounts opened with it, breach appearances and the domain behind it, so an address with no history at all sits badly beside a long career. It cannot tell you whether the company has heard of the person using it.
What should I do if I already deposited the employer's cheque?
Telephone your bank today, say you believe the cheque is fraudulent, and stop any outgoing transfer before it leaves. Send nothing further whatever the employer says about the delay. Then report it at ReportFraud.ftc.gov and to the FBI at ic3.gov, or to your national fraud body. Ignore anybody who later offers to recover it.
