Start with what they are asking you to do
The FTC identifies advance payments for promised jobs and checks followed by requests to send money onward as scam patterns. A recognizable company name does not make those requests safe.
| Request | What to do |
|---|---|
| Deposit this check, then buy equipment from our vendor. | Do not send money. Independently confirm the employer's equipment process. |
| Pay a fee to secure this internship. | Stop the payment. Verify the offer with the real employer. |
| Send your bank login or a one-time security code. | Do not provide either. A payroll deposit does not require access to your bank account. |
| Complete tax or payroll details in an onboarding portal. | Confirm the portal through the recruiting contact or employer channel you already verified. |
| Apply for a role that is absent from the careers page. | Ask the real employer to confirm the requisition and recruiter. Absence alone does not settle whether the message is genuine. |
An unfamiliar recruiter or a fast interview process is a reason to verify, not proof of fraud. The action they want you to take is more informative than spelling mistakes, a polished PDF, or an impressive signature.
Sources[1]
Why an equipment check can leave you owing money
Suppose you have $500. A supposed employer sends a $2,400 check, and the bank initially makes those funds available. You send $1,800 to its chosen laptop vendor. Your displayed balance is now $1,100. If the entire check is then reversed as fake, your balance becomes negative $1,300, before any fees.
You have not earned the $600 the sender told you to keep. You have lost the real $1,800 you sent. The FTC warns that available check funds are not proof that a check is genuine. This example uses invented amounts to show the mechanism.
Sources[1]
Verify through a route the sender does not control
Find the employer's official website yourself. Use its published recruiting contact, main switchboard, or an existing verified recruiter to check the person's name, exact role, and onboarding system. Do not use only the phone number or link in the questionable message: those can lead back to the same sender.
Send: “I received an offer for [title and requisition] from [name and email address]. Could you confirm that this person is recruiting for the role and that [portal domain] is your onboarding system? The message asks me to [specific action].”
Compare the exact domain, not just the display name. A match is one check, not a complete guarantee. Save the original message privately so the employer can investigate.
Already responded? Act on what you exposed
If you deposited a suspicious check, contact your bank's fraud department immediately and explain that the deposit may be fake. Do not spend or transfer the remaining funds.
If you sent money, contact the bank, card issuer, payment app, or transfer service used and ask whether it can reverse the payment. Recovery is not guaranteed. If you shared a password, change it and any reused passwords, then enable two-factor authentication. If you exposed a Social Security number, use the FTC's identity-theft guidance for the appropriate prevention or recovery steps.
Sources[2]
Report the message without publishing your private records
Report the account or listing to the platform where you found it and report the scam to the FTC. Notify the genuine employer when its identity was used. Keep the messages, transaction identifiers, and receipts; redact identity numbers and banking details before sharing evidence outside the official reporting process.
Sources[2]