Recruitment Fraud in 2022

Earlier this month, the FBI released a public service announcement titled “Scammers Exploit Security Weaknesses on Job Recruitment Websites to Impersonate Legitimate Businesses, Threatening Company Reputation and Defrauding Job Seekers.”

This is a growing risk, and goes far beyond the United States. In the last few weeks, reports have come from South Africa and India where there have been high-profile attempts to trick job-seekers. 

What is recruitment fraud, and how do security teams use SearchLight to protect themselves and their prospective candidates from being targeted?

What is Recruitment Fraud?

According to the FBI, recruitment fraud occurs when criminal actors deceive victims into believing they have a job or a potential job. Criminals leverage their position as “employers” to persuade victims to provide them with personally identifiable information (PII) or to send them money.”

Some of these attempts ask for payment before candidates are interviewed or in order to send an appointment letter. Candidates often flag this as suspicious, and so cybercriminals have found other ways to gain from recruitment fraud. Instead, cybercriminals look to capture personal information of the victims or deploy malware on their machines. 

Detect Spoof Social Media Accounts

Any LinkedIn user will have received odd-looking connection requests, or even an enticing job offer. Unfortunately, there are criminals who impersonate HR departments and recruitment agencies as part of highly targeted spear-phishing attempts. For more information on this, check out a great Motherboard article from last year on this phenomenon.  

With Digital Shadows (now ReliaQuest) “Impersonating Company Profile” alerts, users can detect cybercriminals setting up similar-looking profiles that may be used to trick employees into revealing personal information.

Detect Impersonating Domains

Some criminals go one step further to lure candidates in – by registering fake domains that look like the real company that they are impersonating. 

When SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) users add assets for monitoring, they tell us if this particular brand is used for recruitment purposes. With this information, we search for specific keywords that are related to employment in combination with our other detection methods. This enables our customers to detect these sites early on and takedown the content before it gets used to target job candidates. You can read more 

Understand New Techniques with Dark Web Monitoring

Finally, it’s important to understand the different techniques attackers are using to maximize their success in employment fraud. Cybercriminals often share guides and tutorials on the best practices for this type of fraud (one method is shown below). By keeping updated on any new techniques and trends, we can have a better idea of what to look out for!

If you want to dig into some other dark web data, you can register for a  7-day test drive of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) to perform your own Shadow Search (now ReliaQuest GreyMatter Digital Risk Protection)es.

Reporting

If you do identify these attempts, make sure you report them! You can report the activity to your local FBI field office, or report it to the FTC at ReportFraud.ftc.gov. If you paid the fraudulent account, make sure you contact your financial institution or bank to flag the suspicious activity.

Interested to read more? Check out this Forbes article with some great tips to look out for on recruitment fraud.