To know if a recruiter is legit on LinkedIn, run the nine checks below. They take about five minutes, because four are lookups and the other five you can read from what the person has already said. Not all nine carry the same weight, though the lists we read treat them as equal. A request for money, for your Social Security number before a formal hire, or to run software they send on your own machine is a hard stop. Everything else is a signal that can be wrong about a real recruiter, so two or more of those mean you should confirm with the company before going further.
| # | Check | A fail means |
|---|---|---|
| 1 | Their email domain matches the company's real site | Doubt, strong |
| 2 | The role is on the company's own careers page | Doubt, since agency searches can be unposted |
| 3 | Their profile fits the company | Doubt, since new recruiters exist |
| 4 | They show workplace verification | Weak signal |
| 5 | Nobody asks you to pay for anything | Stop |
| 6 | No SSN, bank details or ID photos before a formal hire | Stop |
| 7 | No rush to WhatsApp, Telegram or an outside form | Doubt, strong |
| 8 | The pitch is plausible on pay, remote work and speed | Doubt, strong |
| 9 | The interview is real, and nothing has to be installed or run on your own machine | Stop |
This matters because the harm is real. The FTC reported in December 2024 that losses to job scams "increased more than threefold from 2020 to 2023 and, in just the first half of 2024, topped $220 million". In April 2026 it added that one in three people who reported losing money to a job or business opportunity scam in 2025 said it started on social media.
The fast check: domain and profile
1. The domain. Find the company's website yourself through a search, not through a link in the message. Then compare it with the address the recruiter writes from, character by character. LinkedIn's scam page says generic addresses such as Gmail or Yahoo should raise suspicion, and that impersonators may use mismatched domains.
If a domain looks close but not identical, ICANN runs a free lookup tool at lookup.icann.org, and its registration data policy requires registrars and registries under it to publish a creation date. A domain created last month, claiming to be a firm founded decades ago, tells you a lot. Agency recruiters write from the agency's domain, not the employer's, so check the agency's own site and ask who the client is.
2. The role. The FBI's advice from its 2022 public service announcement is to "Verify job postings found on networking and third-party websites on the hiring company's own website." A missing role is not proof of fraud, because agencies run confidential searches. A role that is present is not proof of a hire either: our post on ghost jobs covers real employers with postings that lead nowhere.
3. The profile. Does the work history hold together? Does the person appear among the company's employees, with connections there? LinkedIn flags profiles with few connections to the company as a sign of impersonation. A reverse image search of the photo takes seconds. Then follow the FTC's advice: search the company or person's name with the words "scam", "review" or "complaint". The FTC adds that finding no complaints does not guarantee honesty.
4. The badge. LinkedIn's VP of Trust Product told Help Net Security in September 2025 that "workplace verification is required for recruiter roles, and executive-level roles", and the article names titles such as "Recruiter" and "Talent Acquisition Specialist". LinkedIn's help page says a verification badge appears next to the name. That makes a missing badge on a recruiter title worth noticing.
Keep it in proportion. We found no LinkedIn help text on the rule's rollout or on how it treats older profiles, so a missing badge is a prompt to look closer and not a verdict. And a badge says the account passed a check at some point. It does not say who is typing today.
What real recruiters do not ask for
5. Money. The FTC is unusually blunt: "Honest employers, including the federal government, will never ask you to pay to get a job. Anyone who does is a scammer." On placement firms: "Honest placement firms do not typically charge a fee to job candidates." The same goes for a check you deposit and partly send on, and for buying your own equipment to mail to an IT department, which LinkedIn also lists. A paid job board subscription is a different thing, since you are buying a product and nobody is promising you the job. We looked at one in is FlexJobs legit.
6. Sensitive data, too early. The test here is the order of events. The FBI says "Legitimate companies will ask for PII and bank account information for payroll purposes AFTER hiring employees." LinkedIn lists early requests for your SSN, banking details or ID photos as a red flag before a formal hire.
Real employers do ask for this material later, which is why people get fooled:
| Request | When it is normal | How it looks |
|---|---|---|
| Consent to a background check | Later in a real process | Written permission is required, says the FTC |
| Identity and work authorization documents | After you are hired | Form I-9 covers "individuals hired for employment" |
| Bank details | After you are hired, for payroll | Per the FBI, as above |
| Any of these in a LinkedIn chat, before an offer | Never | Stop |
7. The channel. LinkedIn lists urgent pressure to move to WhatsApp, Telegram or an outside form as a warning sign. The FTC says task scams typically start "with an unexpected text or WhatsApp message offering online work but no specifics". A real recruiter may well suggest email, ideally from a company address. The word that matters is "urgent".
Too good to be true: remote and pay
8. The pitch. The FTC's test: "If someone offers you a job and claims that you can make a lot of money in a short period of time with little work, that's almost certainly a scam." Remote work deserves extra doubt in such a pitch, simply because real remote jobs are scarcer than the pitches suggest.
We poll more than 100,000 employer boards directly, which gives us about 900,000 active jobs to read. In a 1% sample of those (9,474 rows, 9 November 2026), roughly 81% were onsite, 8% remote, 8% hybrid and 3% did not say. So roughly 1 in 12 open jobs is fully remote.
The field matters too, and here our data says something the usual advice does not. The FTC names virtual assistant and work-from-home roles among common scam forms. Yet in the same sample, roughly 2% of administrative roles were fully remote, against roughly 24% of software engineering roles. The administrative figure rests on a handful of sampled rows, so the direction is the useful part: a fully remote, entry-level admin job at high pay, offered to you unprompted, is a rare thing.
None of this means remote jobs are fake. Roughly 1 in 12 of about 900,000 is still a lot of jobs. It means the combination deserves a second look: remote, little experience needed, high pay, and a fast yes.
Interview red flags
9. The interview. The FBI says that if you cannot meet in person, "a video call with the potential employer can confirm identity." Be wary of an interview held only by text chat, or an offer that arrives with no interview at all.
Software engineers need one more check, and the lists we read skip it. Microsoft reported in March 2026 on a campaign in which attackers pose as recruiters from cryptocurrency or AI firms and ask candidates to clone and run a code package as a test. That launches scripts that install a backdoor. In recent versions, opening the project in Visual Studio Code prompts you to trust the repository author, and agreeing runs it. Other lures show a fake technical error on a website and ask you to paste a command to fix it.
Real employers do set take-home tests, so a test alone proves nothing. Stop here means do not run it on your normal machine. Microsoft's advice is to use "a dedicated, isolated environment" for coding tests, review any repository before installing or running it, and treat paste-and-run commands as high risk. A request to fix a technical error by pasting a command is a stop for anyone, in any field.
When the checks disagree
If you have doubts but no hard stop, ask the company. Use a contact you found on its website, not one the recruiter gave you. This is a sample, so change the details:
Hello, I received a LinkedIn message from Dana Reyes, who says she recruits for your company and is hiring for a Data Analyst. Could you confirm that she works with you and that the role is open? I have not shared any personal information with her.
Our post on how to reply to a recruiter on LinkedIn has a companion message you can send to the recruiter while you wait. Asking the recruiter alone settles nothing, since a scammer will simply say yes.
If you already shared something
Do not wait to be certain. These steps come from the FTC's page on what to do if you were scammed, except where noted.
| You gave | Do this |
|---|---|
| Money, by any method | Immediately contact the company you used to send it (card issuer, bank, wire company, crypto exchange, gift card issuer), report the fraud and ask to reverse it |
| Social Security number | If it was used, report at IdentityTheft.gov. If not, or you are unsure, follow the steps at IdentityTheft.gov/databreach |
| A username and password | Create a new password, change it wherever you reused it, and turn on two-factor authentication |
| Remote access, or you ran their software | Update your security software, run a scan and delete what it finds, then change your passwords and turn on two-factor authentication |
| Bank account details | Call your bank today (our advice, not the FTC's wording) |
If you ran code on a machine with work credentials on it, tell your employer's security team as well. Treat what that machine could reach as exposed. That part is our judgment.
How to report it
Report it even if you lost nothing. Someone else got the same message.
- To LinkedIn. LinkedIn's steps: on the profile, choose More, then Report / Block, select the report option for that person or account, choose "This person is impersonating someone" or "This account is not a real person", and submit. For scam messages, its scam page links a contact form.
- To the FTC. ReportFraud.ftc.gov takes job scams. The FTC says you can also report to your state attorney general.
- To the FBI. The Internet Crime Complaint Center is at ic3.gov.
- To the company being impersonated. It may not know, and it can warn others. This one is our suggestion.
Fake candidates: the other side
Recruiters have the same problem in reverse, which explains some of the friction you may meet. Gartner forecast that by 2028 "1 in 4 candidate profiles worldwide could be fake", according to HR Dive, and 6% of 3,000 candidates in its survey said they had taken part in interview fraud. The 2028 number is a forecast, not a measurement. In Greenhouse's 2025 survey, 91% of recruiters said they had spotted candidate deception, and 39% of US hiring managers were doing more in-person interviews to verify authenticity.
So do not count every extra step against a recruiter. Being asked to come in person or keep your camera on is a recruiter checking you, and that is ordinary now. The line is what they ask you to hand over, and when. A request to see you is fine. A request for a photo of your ID in a chat window, before any offer, is the thing LinkedIn warns about.
What to do next
Run checks 1 to 3 on the message in front of you now, then checks 5, 6 and 9 on anything the sender has asked for. One hard stop ends it. Two weak signals mean you write to the company, using the sample above.
The other habit is to apply where no stranger stands between you and the form. ApplyEze applies on employers' own application systems, and roughly 62% of the active jobs we track sit on systems it can apply to once you connect an application inbox. A form that requires your full Social Security or national ID number stops that application. You queue the roles you want in the desktop app, which runs on your computer while it is on and awake. If you would rather spend your evenings on real recruiters than on forms, your first 50 applications are free, once per email address with no card.