How to Protect Candidates From Job Scams That Impersonate Your Brand

To protect candidates from job scams that use your brand, make your real jobs easy to verify and fake ones easy to spot: publish every open role on one official careers domain, distribute jobs only through channels you control, authenticate your recruiting email with DMARC, state publicly that you never charge candidates or ask for payment, and give candidates a clear way to report suspected fraud. 

Job scams are growing fast, and every fake offer sent in your company’s name erodes trust in your real ones.

How Big Is the Job Scam Problem?

The Identity Theft Resource Center’s 2026 Trends in Identity Report ranked job and employment scams as the second most common scam type and the most intensive in the personal information they harvest. The FTC also reports that one in three people who lost money to a job or business opportunity scam in 2025 said it started on social media.

How Do Job Scams Impersonate Employers?

Most brand impersonation scams follow a few patterns:

• Cloned job postings. Scammers copy a real job ad, change the contact details, and repost it on boards, social media, or messaging apps.
• Fake recruiter outreach. Texts, emails, or DMs from “recruiters” using a real company’s name, logo, and sometimes real employee names.
• Lookalike domains and spoofed email. Addresses that differ from the real domain by a character, or messages that spoof the real domain when email authentication is weak.
• Task and “pay to get paid” scams. Candidates are told to complete simple online tasks, then asked to deposit money (often crypto) to unlock earnings. The FTC tracked about 20,000 task scam reports in the first half of 2024, up from about 5,000 in all of 2023.
• Fake onboarding. Requests for bank details, Social Security numbers, or payment for “equipment” before a real offer exists.

Step 1: Make Your Careers Site the Single Source of Truth

Candidates increasingly verify jobs on the employer’s own site, so every live role should appear there with a consistent requisition ID. A well-structured careers site with a visible “How we hire” page should explain your process, which domains you email from, and that you never charge fees or ask for payment. The FTC’s core advice to job seekers is never to pay anyone to get paid.

Step 2: Control Where Your Jobs Are Distributed

When jobs flow through a governed set of publishers, it is easier to spot a posting that should not exist. Programmatic distribution through a platform like Joveo gives employers a single feed, publisher-level visibility, and consistent apply URLs, so a clone pointing to an unfamiliar domain stands out. Expired roles should be removed promptly everywhere; stale postings are easy raw material for clones and contribute to the ghost jobs problem.

Step 3: Lock Down Recruiting Email

DMARC lets a domain owner tell receiving mail servers what to do with messages that fail SPF or DKIM checks; a “reject” policy is the strongest protection against direct spoofing, according to CISA. Since February 2024, Gmail has required bulk senders to authenticate with SPF, DKIM, and DMARC. Make sure your ATS, CRM, and scheduling tools send from authenticated domains, and avoid recruiting from free email providers.

Step 4: Verify Recruiters and Job Posts on Professional Networks

LinkedIn reports that 70% of recruiters consider verification of the job, recruiter, or Company Page a must-have, and that 90% of reported scam messages try to move the conversation off-platform. Encourage your recruiters to verify their profiles and to keep early conversations on-platform or on corporate email.

Step 5: Monitor, Report, and Respond

• Set up search alerts for your company name plus “hiring,” “remote job,” or “recruiter.”
• Report fraudulent postings to the hosting platform. Indeed, for example, reported removing more than 181,000 fraudulent accounts in the first half of 2025
• Point affected candidates to ReportFraud.ftc.gov and IC3.gov 
• Keep a ready-to-publish fraud notice on your careers site and social channels

Step 6: Train Recruiters and Hiring Managers

Recruiters are often the first to hear about a scam because candidates contact them to confirm an offer. Give them a short script, an internal escalation path, and a log for reports. The same vigilance helps on the other side of the problem, where employers face deepfake candidates and fake applicants; iHire found 23.6% of employers received at least one fraudulent applicant in the past year.

Why Does This Matter for Employer Brand and Job Advertising?

Every scam in your name is a negative candidate experience you did not create but still own. Trust affects apply rates: when 42.8% of job seekers struggle to tell real jobs from fake ones, clear verification signals can make your legitimate ads perform better. Protecting candidates is part of protecting your employer brand.

Frequently Asked Questions

How can I tell if someone is posting fake jobs under my company’s name?

Search for your company name with terms like “hiring” or “remote job,” check postings against your ATS requisition IDs, and watch for candidate inquiries about roles or recruiters you do not recognize.

Can an employer be held responsible for a scam using its brand?

Liability depends on the facts and jurisdiction. Employers generally are not the scammer, but they can reduce harm through clear verification signals and fast response. This is not legal advice.

What should candidates do if they were targeted?

Stop contact, do not send money or personal data, report it to ReportFraud.ftc.gov and I3.gov, and confirm the role directly through the company’s official careers site.

Does DMARC stop all recruiting scams?

No. DMARC helps stop direct spoofing of your domain, but it does not stop lookalike domains or messages on social and messaging apps. It is one layer among several.

Should we put an anti-fraud notice on our careers site?

Yes. A short notice listing your official domains, stating that you never request payment, and explaining how to report fraud gives candidates a simple way to verify.