Fake LinkedIn Job Offer / Advance Fee Scam

How This Attack Works

Scammers create fake recruiter profiles on LinkedIn or send unsolicited emails offering lucrative remote positions. After a minimal interview conducted over chat, the victim is "hired" and asked to pay for onboarding kits, background checks, or equipment. Some variants send counterfeit payroll checks and instruct victims to forward the excess funds, leaving them liable for the full check amount.

Red Flags to Watch For

• ✗
  Job offer arrived unsolicited without a prior application or mutual connection
• ✗
  Salary offer is substantially above market rate for the described simple tasks
• ✗
  Company name has no verifiable web presence, LinkedIn company page, or Glassdoor reviews
• ✗
  Interview conducted entirely by text chat — no video or voice call
• ✗
  You are asked to pay for training materials, background checks, or software licenses
• ✗
  A check is sent for more than expected and you are told to wire back the difference

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

• linkedin-careers-apply.comMALICIOUS
• recruiter-job-offer.netMALICIOUS
• remote-work-opportunity.comMALICIOUS
• wfh-job-placement.netMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.