Bethany Alvaro 
New findings from Bitdefender have highlighted the emerging tactics scammers are using in an attempt to steal personal data, harvest credentials, conduct financial fraud, and deploy malicious software to unsuspecting victims.
“Although not all recruitment scam emails we’ve detected look the same, the styles and approaches share the same goal,” Bitdefender said.
“Some messages read like formal HR emails, while others rely on slick visuals and one-click actions. Both aim to rush jobseekers into engaging before they have time to verify anything.”
Bitdefender found that the most prominent pattern used by scammers was impersonating a larger, global company, such as Amazon, in order to display a false sense of legitimacy and make victims feel like they are being contacted in a familiar way.
Identical styles and approaches in the scam structure involve immediate approvals, call-to-action lines such as “click to confirm interview” or “secure my spot”, and requests to move the conversation from emails to a third-party communication platform such as Microsoft Teams.
The research found that both direct-contact recruitment emails that are very text-heavy and one-click confirmation scams rely on psychological triggers that may make them seem believable and convincing: “trust in well-known brands, urgency, and the fear of missing out on a good opportunity”.
How to protect yourself from hiring scams
Bitdefender said there is a range of mechanisms jobseekers can employ in order not to fall victim to these hostile scam infrastructures.
Verification of authenticity and prior correspondence is key, as Bitdefender reminds the public in its report, “no legitimate employer hires this way”.
Employment communications when no application has even been submitted, instant approval of profiles, reluctance to interview in person or on live calls, and urgent language are all suspicious activities by fraudulent employers. It is always best to stop and verify.
Bitdefender suggests that individuals refrain from clicking on links or buttons in unsolicited emails, verify who is sending the communication, and check URLs diligently.