Job seekers beware! Cyber criminals are now posting fake job postings on Indeed and other job boards in an attempt to steal your personal information. They may even ask you to send them your resume and other personal information, which they will then use to commit identity theft.

Be very careful when applying for jobs online, and make sure that the job posting is legitimate before providing any of your personal information.

What are fake job postings on Indeed and how do they work?

Job seekers are often targets of social engineering scams, and Indeed is no exception. Scammers will create fake job postings in an attempt to collect personal information from job seekers, such as their Social Security number or bank account information.

The scammer may pose as a potential employer, or they may set up a fake Indeed account and use it to post the fake job listing. In either case, the goal is the same: to trick job seekers into giving up personal information that can be used to steal their identity or commit fraud.

Fortunately, there are a few things you can do to protect yourself from fake job postings on Indeed. First, be sure to verify the identity of anyone you communicate with about a job listing. If you’re unsure about someone, you can always reach out to Indeed customer service for help.

Second, never give out personal information until you’re sure you’re dealing with a legitimate employer. And finally, if something seems too good to be true, it probably is. If a job listing seems too good to be true, there’s a good chance it’s a scam. By being aware of these red flags, you can help protect yourself from becoming a victim of fraud.

How can you tell if a job posting is legitimate

There are a few things you can look for to help determine if a job posting is legitimate. First, check the employer’s website to see if they have an active career page. If they don’t, that’s a red flag.

You should also be wary of any listing that asks you to provide personal information upfront, such as your Social Security number or bank account information.

If you still aren’t sure if you’re looking at a fake job posting or not you can also try and verify that it is legitimate by attempting to contact the company directly from their website, NOT the contact information from the job posting itself.

Next, take a close look at the language used in the job posting. If it seems overly promotional or too good to be true, it’s likely a scam.

Some of the most common red flags include:

• The employer is not listed on the job posting
• The job listing asks for personal information upfront
• The language in the job listing is too good to be true
• You can’t verify that the company exists

If you encounter any of these signs, it’s best to avoid applying for the position.

Source: Automatic Detection of Online Recruitment Frauds: Characteristics, Methods, and a Public Dataset

The two job ads above are real examples of what one of these fake job postings might look like.

What to do if you think you’ve been scammed by a fake job posting

If you think you have been the victim of a job scam, there are a few things you can do to protect yourself and your information. First, contact the company that supposedly posted the job and ask if the posting is real. If it is not, they may be able to take down the fake posting and warn other potential victims.

Next, report the scam to any job boards or websites where you found the posting. This will help to prevent others from falling victim to the same scam.

Finally, if you have already given out personal information such as your Social Security number or bank account information, contact your financial institution immediately and let them know what has happened.

Not all fake job postings are malicious

It’s important to note that not all fake job postings are malicious. Many recruiters use fake job postings as a way to research the job market or to build up a database of potential candidates for future openings. Although this practice may not be ethical, it is not necessarily malicious.

In many cases, recruiters will use fictitious job postings to gauge interest in a particular role or to assess the skills and qualifications of candidates.

In other cases, they may use fake job postings as a way to attract talented individuals who might not otherwise consider applying for a position. While there is no doubt that this practice can be misleading, it is important to remember that not all fake job postings are created with malicious intent.

You should still be cautious though, and it is best not to apply to these types of jobs if you are suspicious about a listing.

Final thoughts

Fake job postings on Indeed and other job boards are becoming increasingly common, so it’s important to be aware of the signs of a scam. By following the tips above, you can help protect yourself from becoming a victim of fraud.

If you think you may have been scammed, don’t wait, make sure you immediately start doing what you can to minimize the damage that a bad actor can cause.

If you are an employer reading this, make sure to offer cybersecurity awareness training to your staff so that they can be prepared for different types of social engineering attacks.

Watch our On-Demand Cybersecurity Webinar

Phishing is one of the most common and well-known social engineering techniques. It’s the process of sending emails (or texts, which is known as smishing) appearing to be from reputable sources in an attempt to get someone to reveal personal information.

These can take the form of emails seeming to come from coworkers, or impersonating reputable brands such as Google and Microsoft or government institutions such as the IRS. The idea is that you will see something familiar and won’t look too closely.

Source: Phishing Examples | Phishing.org

What is phishing and how does it work

Phishing is a type of social engineering attack that seeks to collect personal information such as login credentials or credit card numbers by pretending to be a trustworthy entity. The attacker will typically send an email or message that appears to come from a reputable source, such as a financial institution or popular online service.

The message will often include a link that leads to a fake website that looks identical to the real thing. The user is then prompted to enter sensitive information, which is then collected by the attacker.

Phishing attacks can be difficult to detect, but there are several warning signs to look out for, such as suspicious links or email addresses, grammatical errors, and unexpected requests for personal information.

Source: The Most Common Examples Of A Phishing Email | uSecure

If you suspect that you may be the target of a phishing attack, do not respond to the message and immediately report it to your IT department or security team.

The most common types of phishing attacks

There are a few different types of phishing attacks, but the most common ones include:

• Spear phishing: This type of attack is targeted at a specific individual or organization. The attacker will often do research to collect personal information about the target before sending the email.
• Whaling: This type of attack targets high-profile individuals within an organization, such as executives or CEOs. The attacker will typically send a spear phishing email that appears to be from a trusted source, such as a government agency or well-known company.
• Clone phishing: This type of attack involves cloning an existing email that was previously sent by the target. The attacker will then replace any links in the email with their own malicious version.
• Phishing kits: This type of attack uses pre-made templates and scripts that can be easily customized. The attacker will often host the kit on a server and send out mass emails in an attempt to infect as many people as possible.

How to protect yourself from phishing attacks

There are several steps you can take to protect yourself from phishing attacks, including:

• Be aware of the signs of a phishing email. Suspicious links, grammatical errors, and unexpected requests for personal information are all red flags.
• Do not click on links or open attachments from unknown sources. If you’re unsure about the sender, confirm their identity by independently contacting them.
• Keep your software and antivirus up to date. Outdated software can have security vulnerabilities that can be exploited by attackers.
• Be cautious of public Wi-Fi. Hackers can set up fake Wi-Fi networks in public places in order to collect login credentials and other sensitive information.
• Report any suspicious emails or messages to your IT department or security team. They will be able to determine if it’s a real phishing attack and take appropriate action.

What to do if you fall for a phishing attack

If you think you may have responded to a phishing email or clicked on a malicious link, there are a few steps you should take:

• The very first thing you should do… TAKE ACTION! Do not be embarrassed or afraid to tell your IT department, they can’t take action to help you if they are unaware of the issue. 
• Change your passwords immediately. If you used the same password for other accounts, be sure to change those as well.
• Run a virus scan on your computer. This will help identify any malware that may have been installed without your knowledge.
• Enable two-factor authentication (if available). This adds an extra layer of security to your account and makes it more difficult for attackers to gain access.
• Keep an eye on your credit report and financial statements. Watch for any unusual activity that could indicate fraud or identity theft.

How to report a phishing attack

If you receive a phishing email or text, do not respond to it! You should report it to your IT department or security team immediately.

You can also report phishing emails to the FTC at ftc.gov/complaint. And if you get a text message that looks like phishing, forward it to SPAM (7726).

When in doubt, throw it out! If you’re unsure about an email or text, don’t take any chances. Delete it and move on. After all, it’s just a message.

By being aware of the signs of phishing and taking steps to protect yourself, you can help keep your personal information safe from criminals.

Resources on further reading and training

• Free On-Demand cybersecurity training for nonprofits
• Multi-Factor Authentication: Why it’s critical
• How to make sure security is an ingrained part of your culture
• Types of Social Engineering Attacks

Wrap Up

Phishing is a well-known social engineering technique that uses emails (or texts) to try and get someone to reveal personal information. The goal of a phishing attack can be anything from getting you to open a malicious attachment, stealing your login credentials, to just plain stealing.

Source: Phishing Examples | Phishing.org

There are several steps you can take to protect yourself from phishing attacks, including keeping your software and antivirus up-to-date, being aware of the signs of a phishing email, and reporting any suspicious messages immediately.

If you think you may have responded to a phishing email or clicked on a malicious link, there are some things you should do immediately, such as changing your passwords and running a virus scan. It’s important to remember that taking action is the best way to protect yourself from these types of attacks.

While phishing attacks are the most well-known type of social engineering attack, it’s important to be aware of the other types of attacks that exist. By being informed and taking steps to protect yourself, you can help keep your personal information safe from criminals.

If you are interested in cybersecurity awareness training for your nonprofit organization, or would like to speak to our cybersecurity experts about your security, contact us here.

Watch our On-Demand Cybersecurity Webinar