The Rise of Fake Job Documents
Fake job postings have increased 118% since 2020, according to the Identity Theft Resource Center. This surge has created a parallel increase in fraudulent job offer letters, employment contracts, onboarding documents, and recruiter communications. ScamVerify™ AI document analysis helps job seekers verify whether employment documents are legitimate before sharing personal information.
The employment scam ecosystem has become industrialized. Scammers create complete fake hiring pipelines: job postings on legitimate boards, professional-looking career websites, multiple rounds of "interviews" via chat or video, and finally, official-looking offer letters and onboarding documents designed to extract money or personal data.
What Fake Job Offer Letters Look Like
Professional Appearance
Modern fake offer letters are polished. Scammers download real company letterhead from corporate websites, use the correct executive names (found on LinkedIn), and format their documents to match industry standards. Visual quality alone is no longer a reliable indicator.
| Document Element | Legitimate | Fraudulent |
|---|---|---|
| Company letterhead | Official branding | Copied from website/social media |
| Executive signature | Authorized HR or hiring manager | Name copied from LinkedIn |
| Salary and benefits | Specific, market-rate | Often above market to attract victims |
| Start date | Reasonable timeline | Unusually quick, often within days |
| Pre-employment requirements | Background check, drug screen | SSN, bank details, "equipment fee" |
The Information Extraction Play
The real purpose of a fake offer letter is to extract information that enables identity theft or direct financial theft. Common requests include:
- Social Security number for "background check processing"
- Bank account and routing numbers for "direct deposit setup"
- Copy of driver's license or passport for "I-9 verification"
- Credit card or payment for "equipment," "training materials," or "software licenses"
Legitimate employers collect this information after you start, on your first day, through official HR systems. They do not request it via email before your start date.
The 5 Stages of a Job Scam
Stage 1: The Listing
The fake job appears on legitimate job boards (Indeed, LinkedIn, ZipRecruiter). It often describes a remote position with above-average pay and minimal qualifications. The posting uses a real company name or a convincing fake company.
Stage 2: The "Interview"
Interviews happen via text chat (Google Chat, Telegram, WhatsApp) rather than phone or video. Questions are generic and non-technical. Some scams use AI chatbots to conduct the initial screening. The interview process is unusually fast, sometimes completed in a single day.
Stage 3: The Offer Letter
A formal-looking offer letter arrives by email. It includes the company logo, specific salary, benefits overview, and a start date. The document looks like what a real offer letter should look like because it was modeled on one.
Stage 4: The Onboarding Trap
After the victim "accepts" the offer, onboarding documents request personal information:
- Tax forms (W-4) that require SSN
- Direct deposit authorization that requires bank routing and account numbers
- Equipment purchase where the victim must pay upfront for a laptop or software
- Training fee that will be "reimbursed after the first paycheck"
Stage 5: The Disappearance
After collecting personal information or payment, the scammer stops responding. The "company" becomes unreachable. The victim discovers the job never existed when they try to show up for work or contact the real company.
Red Flags in Fake Offer Letters
Financial Red Flags
- Salary significantly above market rate for the role and experience level
- Request for any upfront payment (equipment, training, background check fees, software licenses)
- Payment via wire transfer, gift cards, Zelle, or cryptocurrency
- "Reimbursement" promises for expenses you must pay first
- Check mailed for "equipment purchase" with instructions to forward the excess to a vendor (check fraud)
Process Red Flags
- Entire interview conducted via text chat, never phone or video
- Hired without meeting anyone from the company in person or on video
- Offer received the same day as the interview
- No reference checks or verification of your qualifications
- Pressure to accept immediately with a tight deadline
Document Red Flags
- Offer letter sent from a free email domain (gmail.com, yahoo.com) rather than a corporate domain
- Email domain is close to but not exactly the real company's domain
- Generic language that could apply to any role rather than specifics discussed in the interview
- No mention of company-specific benefits, policies, or workplace details
- PDF metadata showing creation by unfamiliar tools or on unexpected dates
How to Verify a Job Offer
Step 1: Verify the Company
Search the company name independently. Visit their official website (type the URL, do not click links from the offer). Check their careers page to see if the position is listed. Call the company's main phone number (from their official website, not the offer letter) and ask to confirm the job offer.
Step 2: Verify the Recruiter
Look up the person who sent the offer on LinkedIn. Check if they actually work at the company. If the offer came from a recruiting agency, verify the agency is real and contact them directly through their official website.
Step 3: Research the Role
Compare the salary to market rates on Glassdoor, Payscale, or the Bureau of Labor Statistics. If the offer is 30-50% above market for your experience level, that is a red flag. Legitimate companies compete on salary, but they do not dramatically overpay.
Step 4: Upload the Document to ScamVerify
Upload the offer letter to the ScamVerify document checker. The AI analysis extracts all entities from the document, including phone numbers, email addresses, and URLs, and checks them against 8 million+ threat records. This can identify offer letters that reference known scam phone numbers or fraudulent company domains.
Step 5: Never Pay to Start a Job
No legitimate employer requires you to pay for equipment, training, or background checks before your first day. If an offer requires any upfront payment, it is a scam. Period.
Upload a document to analyze
Upload any PDF, image, or document to check for signs of fraud or manipulation.
Analyze DocumentWhat Scammers Do With Stolen Information
Information collected through fake job offers enables:
| Stolen Information | Criminal Use |
|---|---|
| Social Security number | Identity theft, fraudulent tax returns, credit applications |
| Bank account numbers | Unauthorized withdrawals, money mule accounts |
| Driver's license copy | Fake IDs, identity verification for other fraud |
| Date of birth | Combined with SSN for comprehensive identity theft |
| Home address | Physical mail fraud, targeted social engineering |
The combination of SSN, bank details, date of birth, and address from fake onboarding documents gives scammers everything they need for complete identity takeover.
What to Do If You Fell for a Fake Job Offer
- Contact your bank to secure your accounts if you shared banking details
- Place a fraud alert with all three credit bureaus (Equifax, Experian, TransUnion)
- File an identity theft report at IdentityTheft.gov
- Report the scam to the FTC at ReportFraud.ftc.gov
- Report the job listing to the platform where you found it (Indeed, LinkedIn, etc.)
- File a police report for documentation purposes
- Monitor your credit for at least 12 months for unauthorized activity
FAQ
Can fake job offers appear on legitimate job boards like LinkedIn or Indeed?
Yes. Scammers post fake jobs on major job boards regularly. These platforms remove fraudulent listings when reported, but new ones appear constantly. LinkedIn reported removing millions of fake job postings in recent years. Always verify the company independently, regardless of where you found the listing.
How do I tell the difference between a real remote job and a scam?
Real remote jobs have specific role requirements, conduct interviews via video call, have a reasonable hiring timeline, never request payment, and collect personal information through official HR portals after your start date. Scam remote jobs accept anyone, interview only via chat, hire immediately, request upfront payment, and collect personal data before employment begins.
What if the company name on the offer is a real company?
Scammers frequently impersonate real companies. Contact the company directly through their official website or phone number to verify the offer. Many major companies have dedicated pages warning about employment scams using their name.
Is it safe to fill out a W-4 or I-9 before my start date?
Legitimate employers sometimes send pre-employment paperwork, but it is processed through secure HR systems (Workday, ADP, BambooHR), not email attachments. If you receive tax forms via email from a free domain or a domain that does not match the company, do not fill them out until you verify the request through official channels.
