Join the club, become a member for free.
Get startedA job offer arrives. No interview, or one short chat on a messaging app. The pay is better than anything else you have seen, and they need your bank details today to set up payroll.
Job-hunting from a new country puts you in the exact position these scams are built for. You are applying on platforms you have not used before, in a second language, to companies you cannot easily verify, often against a visa deadline.
The patterns below repeat almost without variation. Once you can name them, most of them fall apart in the first message.
College Life is working with Bitdefender to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. In line with this mission, Bitdefender is providing College Life Club members with 50% off for young professionals and graduates, and a free-trial option for students. Become a member of College Life Club (free) to get this benefit right now.
Job Offer Scams You Will Meet First
These are the opening moves. Almost every fake offer starts with at least one of them, and spotting one early saves the rest of the conversation.
None of these is conclusive on its own. Real recruiters do send cold messages, and real companies do sometimes move quickly. What matters is how many appear together, and whether the answer to a direct question makes them go away.
The unsolicited offer
You never applied. A message arrives praising a CV they supposedly found, offering a role that matches you suspiciously well. Real recruiters do reach out cold, so this alone is not proof. What separates them is what happens next: a genuine recruiter names the company, links to a real posting, and expects questions. A fake one moves straight to next steps. If you cannot find the role advertised anywhere, treat the message as an advert rather than an offer. Ask them which posting you are being considered for. A recruiter who cannot name it is not working from one.
The interview that is only a chat
A ten-minute conversation on a messaging app, then an offer. Hiring does not work this way, anywhere. As our guide on applying puts it, the recruitment process exists to associate a person with a candidate. That takes more than a text thread. A company willing to hire you without a proper conversation is not hiring you. The exception people cite is agency work, and even there someone speaks to you properly before money moves.
The salary that does not match the work
Data entry at triple the local rate. Package forwarding for a monthly retainer. The number is designed to switch off the part of you that asks questions. Look up what the role actually pays in that city. Treat any large gap as the point of the offer, not a lucky break. Job boards publish salary ranges for most roles now, so the comparison takes a minute. Anything more than about a third above the local range is worth explaining before anything else happens.
The company you cannot find
No registered address, no employees on professional networks, a website registered weeks ago. Check whether the company exists in the national business register, which is public in most countries. A firm that cannot be found in the place it claims to operate has told you everything. Registers are free to search in most of Europe and the US. Look for the company number, the incorporation date and the registered address, then check all three against what you were told.
The email that is almost right
The domain is one character off, or the message comes from a free email account with the company name in the display name. Read the actual address, not the name shown. This single habit catches a large share of everything on this page. Phones hide the real address behind the display name by default, which is exactly why the trick still works. Tap the sender to expand it before you read the rest.
The role that never existed
The posting is copied from a real job at a real company, reposted by someone unconnected to it. The tell is usually the contact route: applications going to a personal address rather than the company's own system. If the posting exists on the company site with a different application route, use theirs. If it does not exist there at all, that is the answer. Companies advertise their own vacancies; they do not outsource that to a stranger's inbox.
How Job Offer Scams Take Your Money
Every scam on this list eventually needs money or data to move. These are the mechanisms, and each one is a hard stop.
This is the useful part of the list, because it is where the variation stops. The story wrapped around them changes constantly; the mechanisms do not. If a conversation arrives at any of the six below, the story was never the point.
The upfront fee
Training materials, a background check, software, a uniform, a certification. Legitimate employers absorb these costs. There is no ordinary job in which you pay to start working. Any explanation for why this one is different is part of the script. Watch for the framing that it is refundable after your first month. Refundable is the word that makes people pay, and the refund never arrives.
The equipment cheque
They send a cheque to buy a laptop from a specified supplier. The cheque clears, you pay the supplier, then the cheque is reversed days later. The supplier is them. You are liable for the full amount. Cheques clearing is not the same as cheques being good, and that gap is the entire trick. Banks credit the amount provisionally, then reclaim it when the cheque is found to be fraudulent, which can take a week or more.
The overpayment refund
Your first payment arrives larger than agreed, and you are asked to return the difference. The original payment is fraudulent and will be reversed; the refund you send is real. Never move money on behalf of an employer, in either direction. No payroll department overpays and asks the employee to sort it out. If a real error happened, the company would correct it at their end.
The money-mule role
You receive payments into your own account and forward them, keeping a percentage. This is money laundering, and the criminal liability lands on you. The job title will be payment processor, financial agent or something equally official. No legitimate employer routes company funds through a new hire's personal account. The consequences here are worse than losing money. Accounts get frozen, and explaining that you thought it was a job is not a defence that works quickly.
The package-reshipping job
Parcels arrive at your address, you post them onward. The goods are bought with stolen cards, and your address is the laundering step. It is presented as quality control or logistics support, and the pay is per parcel to keep you moving. Payment usually stops after a few weeks, once the addresses are burnt. By then the parcels are traceable to you and not to anyone else.
The crypto payroll
Salary paid in crypto, or a wallet you must fund to receive it. Irreversible by design, which is why it appears. A real employer pays into a bank account and can tell you which payroll system they use. Ask the name of the payroll provider. It is a boring question with a boring answer, and fake employers rarely have one ready.
What a Real Employer Does Instead
The clearest defence is knowing the genuine process. Once you have seen it, the fake version stops being convincing.
Most advice on this subject lists things to fear. Knowing what normal looks like is more useful, because it gives you something to compare against rather than a list to memorise. It also travels: the order of events below holds in almost every country you might work in.
They interview properly
More than one conversation, usually with more than one person, and at least one of them will be a video or in-person meeting. An interview is where a company decides about you and you decide about them. Skipping it serves nobody who intends to actually employ you. Hiring is expensive and companies protect against a bad hire. That self-interest is why a real process exists at all.
They send a contract first
A written contract, naming the company, the role, the salary, the start date and the notice period, arrives before anything else is asked of you. No documents, no bank details and no payments precede it. If you are being asked for anything before a contract exists, the order is wrong. Read it properly, including the notice period and the probation terms. A contract that is vague about what you are actually paid is its own warning.
They ask for documents at the right moment
Tax forms, identity documents and right-to-work evidence come after an offer is accepted, through a proper system. Our onboarding checklist covers what is normal, including that work authorisation documents are standard once you are hired. The timing is the tell, not the request itself. Every real employer needs these documents eventually. The question is whether an offer, a contract and a signature came first.
They collect bank details securely
Payroll details go into an HR system, not into a chat message or an email attachment. Providing accurate banking information is genuinely part of onboarding; the difference is the channel and the point in the process where it happens. If an HR system is not available yet, that means it is too early to hand the details over, not that email will do.
They use company systems
Company email, a named HR platform, a scheduled call with a calendar invite. Not a personal messaging app, and not an account created last week. Legitimate hiring leaves an institutional trail because institutions are involved. That trail is also what protects you later, if a dispute over pay or hours comes up.
They let you verify them
You can call the company's published number and ask whether the person exists. A real employer expects this from someone moving country for a role. Anyone who resists being verified has explained themselves. Use the number on the company's own website, never one supplied in the message. That distinction is the entire value of the check.
Checks to Run Before You Reply
None of these take long. Run them before the conversation gets far enough to feel awkward to leave.
That awkwardness is real and worth naming. Several messages in, having answered questions and felt hopeful, most people find it harder to walk away than they expect. Running the checks in the first hour avoids the sunk-cost problem entirely.
Search the exact wording
Paste a distinctive sentence from the message into a search engine. Scam scripts are reused across hundreds of targets, and the same paragraph often appears on fraud forums with a warning attached. Use a full sentence rather than a phrase, and put it in quotation marks so the search matches it exactly.
Check the domain age
A company website registered three weeks ago, for a firm claiming a decade of trading, answers the question. Domain registration dates are public and take a minute to look up. Free lookup tools show the creation date. Recent registration is not proof of anything on its own, but combined with anything else on this page it settles the question.
Find a second route to the company
Look up the company independently, then contact them through the number or address you found yourself. Never through a link or number supplied in the message. If both routes lead to the same person, you have verified something. If only one does, you have learned something more important, and you have learned it before sending anything. If only one does, you have learned something more important.
Check the message itself
Bitdefender Scamio lets you paste a suspicious job message and get a read on it before you answer, which is useful in the moment where something feels wrong but you cannot yet say why. That instinct usually arrives before the reasoning does. Acting on it early costs you nothing. Talking yourself out of it is what the pressure is designed to achieve.
Look up the recruiter
A profile created recently, with few connections and no history at the company they claim to represent, is worth noticing. Real recruiters have a professional footprint because their work depends on it. Check whether their profile predates the conversation by more than a few weeks, and whether anyone else at the company appears alongside them.
Ask a question only an employee could answer
Who would I report to, which office, what does the team work on this quarter. Vague answers to specific questions are the fastest way to end a fake conversation, and a genuine contact will answer without hesitating. Vague answers to specific questions end a fake conversation quickly. A genuine contact answers without hesitating, because they work there.
Slow the timeline down deliberately
Say you will confirm tomorrow. A real employer accepts this without friction. Manufactured urgency is the one ingredient every scam on this page depends on, and removing it collapses most of them on its own. Manufactured urgency is the one ingredient every scam here depends on. Removing it collapses most of them without any other check.
Never install what they send you
Interview software, a company portal, a secure messaging client they insist on. Unexpected software from an unverified source is how a device gets compromised, and a fake interview is a very effective delivery method. Unexpected software from an unverified source is how a device gets compromised. A fake interview is a very effective way to deliver it.
Protect the documents you have already sent
If a CV, passport scan or bank statement has gone out, that package matters more than the job did. Identity monitoring watches for those details appearing where they should not, which is the part people skip once the immediate panic passes. Identity monitoring watches for those details appearing where they should not. It is the part people skip once the immediate panic has passed.
Report it, then move on
Report to the platform, to the real company being impersonated, and to your national fraud service. It takes ten minutes and it stops the same advert reaching the next person. It is also the only part of this that helps anyone but you.
Keep applying through proper channels
The best protection is a normal process. Applying through company sites and established platforms means the application tracking systems do some of the filtering for you. Cold offers then become easier to recognise as unusual.
Finish onboarding through official systems only
Once you are genuinely hired, complete onboarding requirements through the company's own platforms. A request to move any part of that process to a personal channel, even late on, is worth stopping for.
Conclusion
Job offer scams work on timing rather than cleverness. They find people who are new to a country, applying under pressure, unsure what normal looks like locally, and they offer relief.
The defence is knowing the real process. A contract before documents. Documents before bank details. An interview before any of it, and a company you can verify through a route you found yourself. Anything that skips a step is skipping it for a reason.
None of that requires suspicion of every message. It requires one habit: check the order of events before you check anything else. A real employer will not notice you doing it, because nothing you ask for is unusual to them. A fake one will produce a reason why this case is different, and that reason is the answer.
If you take a single line from this page, take that one. The order of events is the thing scams cannot fake without giving themselves away.
The purpose of this guide was to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. To help you on this journey, College Life has partnered with Bitdefender to make your life easier. Join College Life Club for free and start taking advantage of this today.
Frequently Asked Questions
How can I tell if a job offer is a scam?
Check the order of events. A real employer interviews you, sends a contract, then asks for documents and bank details through a proper system. Any offer that reverses that order, or skips the interview, is the thing to question.
Is it normal to pay for training or equipment?
No. Legitimate employers cover the cost of training, equipment and background checks. There is no ordinary job where you pay to begin working, whatever explanation is offered.
What should I do if I already sent my bank details?
Contact your bank the same day and tell them the details may be compromised. Keep every message as evidence, report it to the platform and your national fraud service, and watch for your details being used elsewhere.
Are job scams more common for international applicants?
They target people applying from a distance under time pressure, which describes most international students and graduates. Not knowing local hiring norms is the vulnerability, and it fades as you learn what normal looks like.
Can a scammer harm me with just my CV?
A CV carries your address, phone number, employment history and often your date of birth. That is enough to make later approaches far more convincing, which is why an unexplained request for one is worth questioning.