A candidate applies for a role at a company they recognise. The process feels normal: a careers page, a form, an interview over chat. Then come the onboarding documents — passport scan, national insurance or social security number, bank details for payroll.
There was no role. The "employer" existed only to collect those documents.
Why it works better than other fraud
A job application is the one context where handing over identity documents feels routine. Everywhere else, a request for a passport scan raises suspicion; here it is the expected next step. The candidate is also motivated not to seem difficult.
Why the company never finds out
The victims are not customers. They contact the real employer eventually — angry, and often convinced the company is responsible — but by then the posting has moved. Nobody inside the business is monitoring for job listings that use their name, because it is not obviously anyone's job: not security, who watch infrastructure; not HR, who watch their own pipeline; not brand, who watch advertising.
What detection looks like
Three conditions have to hold together, and any two without the third is an ordinary page:
The page is genuinely about hiring — in its title or headings, not a "Careers" link in a footer.
It has a form.
That form asks for a Social Security number, passport number, bank details, or a driving licence number.
We built exactly that check, and the reason it is that specific is instructive: a looser version flagged PayPal, by matching the word "Careers" in the footer against "card number" elsewhere on the page. Precision here is not fastidiousness. It is the difference between a useful tool and a defamation risk.
What to do if it is your brand
The removal path is more straightforward than most: every major job board has an impersonation channel, and a lookalike careers domain is a domain like any other. The hard part is finding out at all, which is the part we automate.