Cybercriminals using fake job listings to steal money, info from applicants
Be extra careful when looking for a job online, the Internet Crime Complaint Center (IC3) warns: cybercriminals are using fake job listings to trick applicants into sharing their personal and financial information, as well as into sending them substantial sums of money.
“While hiring scams have been around for many years, cyber criminals’ emerging use of spoofed websites to harvest PII and steal money shows an increased level of complexity. Criminals often lend credibility to their scheme by advertising alongside legitimate employers and job placement firms, enabling them to target victims of all skill and income levels,” they noted.
A tech-savvy take on consumer confidence schemes
Individuals targeted by these cyber crooks have a lot to lose. According to the advisory, victims can end up some $3,000 out of pocket (on average), in addition of getting their PII and payment card information compromised.
“The PII can be used for any number of nefarious purposes, including taking over the victims’ accounts, opening new financial accounts, or using the victims’ identity for another deception scam (such as obtaining fake driver’s licenses or passports),” the IC3 explained. Ultimately, this could also end up damaging their credit scores.
“What’s interesting is that this is just a tech-savvy take on a typical consumer confidence scheme,” says Bob Jones, senior advisor with Shared Assessments.
“The players in any scheme are the con artist and the mark. The con artist concocts a story that sounds real enough to cause the mark to believe it. The suspension of disbelief resulting from the mark’s confidence in the story leads to a successful scam. The more sophisticated the potential mark population, the more elaborate the scheme has to be.”
How to spot fake job listings and avoid becoming a victim
The best defense to becoming a victim is a healthy skepticism, Jones says.
IC3 advises job seekers to always conduct a web search of the hiring company using the company name only.
“Results that return multiple websites for the same company (abccompany.com and abccompanyllc.com) may indicate fraudulent job listings,” they explained.
In addition to this, they should not share their PII, Social Security number or payment info before getting hired. They should also confirm that the person they are interviewing with (online) are actually who they say they are and are working at the firm.
Indicators that the job listing may be fake include them appearing on job boards but not on the companies’ websites; recruiters/managers not having profiles on the job board, or having profiles that do not fit their roles; and them contacting victims through non-company email domains and teleconference applications that use email addresses instead of phone numbers.
“While this is a consumer con, it shares the same elements as those deployed against enterprises in phishing schemes,” Jones notes.
“Unsuspecting employees click on links attached to emails they think are from their boss or colleague, thus infecting the network. Firms that use fake phishing emails as an awareness training tool to vaccinate their employees with a healthy dose of skepticism also perform a public service, because those employees are all consumers.”