How to tell if a recruiter is legit

To tell if a recruiter is legit, check the person, the email address and the company separately, then check that they connect: a real recruiter works at the company they name, writes from that company's real domain, and is hiring for a role listed on its own careers page. Find the company's website, phone number and careers page yourself, never through the links in the message, and stop if anyone asks you to pay, buy equipment or send ID and bank details before a formal hire. Sixtyfour, our research agent, runs the research behind all three checks: give it the recruiter's name, email address and claimed employer, and it returns where the person works today, whether the domain belongs to the company, and the source behind each finding.

This guide is for job seekers checking a message and for companies whose names scammers borrow. Our guides to investigating an email address, telling if a LinkedIn profile is fake and finding out who owns a website go deeper on single steps.

The FBI has warned about one form for years: someone poses as a recruiter for a real company. It described the method in 2020: criminals spoof a company's website "by creating a domain name similar in appearance to a legitimate company", post jobs that lead to it, and "impersonate personnel from different departments, including recruiters, talent acquisition, human resources, and department managers." A 2022 warning added that "In some cases, the scammers use the identities of actual company employees to increase the perceived authenticity of the job posts."

In the FBI's account an interview follows over a teleconference application, then an offer, then the ask. Its examples include upfront payments for background checks, training or "start-up equipment", and requests for a copy of your driving licence, your Social Security number and your bank and card details. The FTC adds the fake cheque, which you deposit and partly send on before it bounces.

The FBI's Internet Crime Complaint Center received 24,688 complaints in its employment fraud category in 2025, with reported losses of $362.9 million, up from 20,044 complaints and $264.2 million in 2024, according to its 2025 annual report. The FTC reports that one in three people who reported losing money to a job or business opportunity scam in 2025 said it started on social media, and that most scams are not reported to the government.

Sixtyfour researches the three things a fake recruiter has to fake, from what the message gives you. Reverse Email takes the recruiter's address and returns the person behind it, with their name, title, employer and LinkedIn profile, or "No data found" when nobody matched. People Intelligence takes the recruiter's name and claimed employer and researches, across sources on the web, where that person actually works. Company Intelligence takes the company's name and the website you found yourself, returns the facts you ask for, such as its real domain, its careers page and whether the role is listed, and can find the people who recruit there.

You name each answer you want as a field, for example whether this person works at this company today. With confidence scoring on, every field comes back with a 0 to 100 score, a short justification and the pages it was read on. Anything Sixtyfour could not establish is reported as open, and you decide. A People or Company Intelligence run takes up to ten minutes, according to the docs. Some checks stay with you: the domain's registration date, older copies of the company's pages in a public web archive, a reverse image search of the profile photo, and a call to the company on a number you found yourself. Larger cases can run in Atlas, and companies that check many reports can use the Research API.

Start with what LinkedIn itself has verified. A workplace verification means a member "has confirmed their association with the specific company", for example through a work email or a LinkedIn Recruiter licence the company provides. Recruiters who use their company's Recruiter licence can show a Verified Recruiter label on the InMails they send through it, and the verification appears in the About this member section of their profile. In September 2025 LinkedIn told reporters that workplace verification would be required for recruiter roles, and Help Net Security reported that the rule applies when a member adds or updates a recruiter title.

A missing badge proves less. LinkedIn says the recruiter label is "available only to corporate subscription customers", workplace verification is not offered to every company, and the rule as reported covers adding or updating a title, so an older profile may carry no badge. So read the rest of the profile: LinkedIn's scam guidance says to pay close attention to profiles that "are incomplete, have low connection counts overall, or are not connected to many employees within the company they represent."

A verified profile proves nothing about an email that uses its name, because scammers copy real recruiters' names and photos into messages sent from elsewhere. A borrowed name and photo can pass every check on the person, which is why the email domain and the company need checks of their own.

Then look for the person outside LinkedIn. Sixtyfour researches the name and the claimed employer across sources on the web, including the company's own pages, and reports where the person works today with a source for each job. Older copies of the company's team page in a public web archive are a check you make yourself, and can show whether the name was on the team in the past. Our guide to fake LinkedIn profiles covers profile age, photos and badges in depth.

Compare the address with the company's real domain, which you find yourself by searching for the company and opening its website. The FBI lists employers who contact candidates "through non-company email domains" among its signs of a hiring scam, and LinkedIn's guidance flags "Mismatched email domains", such as a free webmail address where the company's own would be expected.

A lookalike domain needs closer reading. In a 2020 warning about domains imitating its own websites, the FBI describes spoofed domains as having "slightly altered characteristics of legitimate domains", such as "an alternate spelling of a word" or a different ending. Read the domain one character at a time against the one on the company's website, looking for a dropped or doubled letter, a letter swapped for one that looks like it, an extra word such as careers or hr, and a different ending. The FBI also suggests searching for the company's name on its own, since several websites for one company "may indicate fraudulent job listings."

Then date the domain yourself. The public registration record of a domain under a generic ending includes its creation date, even where the owner's details are withheld, and ICANN's Lookup tool shows it through RDAP, which became the definitive source for that data in January 2025. Mail from a domain created last month, for a company whose own domain is fifteen years old, is a strong sign.

Sixtyfour's part is the address and the person. Reverse Email returns the person and employer behind the address, or no match. An address with no history proves little on its own, and it counts for more when the same name has a history on the company's real domain and none on this one.

Recruiters at agencies write from the agency's domain, so check the agency the same way and ask the employer whether it works with them. The FTC notes that honest placement firms "do not typically charge a fee to job candidates", because the hiring company pays them.

Find the company's website through a search, open its careers page and look for the role. Among the FBI's indicators of a hiring scam: "Job postings appear on job boards, but not on the companies' websites." Its advice is to verify postings "on the hiring company's own website or through legitimate HR representatives at the hiring company." The FBI also advises impersonated companies to put a warning on their careers pages, so read that page for how the company says its recruiters contact candidates.

The FTC suggests searching for the company or the person with words such as "scam", "review" or "complaint", and warns that a lack of complaints "doesn't guarantee that a company is honest".

Company Intelligence does this research from the company's name and the website you found. Ask for its official domains, its careers page, whether the role is listed and how it says recruiters contact candidates, and turn on find_people with a prompt such as "the people who recruit for this company" to see who does the hiring. Each answer comes back with the pages behind it, so you can open them yourself.

Call the company on the main number from its own website and ask for the recruiter or the talent team, never on a number from the message. In a 2024 warning that covered fake recruiters, the FBI advised verifying a contact's identity "using separate unconnected communication platforms."

Reverse Phone in Sixtyfour takes the number in the signature and returns the person behind it, with their employer and its domain, or no match. A number that leads to the recruiter at the company supports them. A number that leads nowhere counts for little, since new and private numbers are common, and numbers are reassigned, so an old record may belong to an earlier holder, as our phone guide explains.

Run the profile photo through a reverse image search yourself. The FBI has warned that impostors posing as recruiters use "pictures stolen from open social media profiles of the impersonated individual", so a photo that appears under the same name elsewhere shows only that it is the real person's photo, which an impostor would also want.

A real hiring process has steps a scam tends to skip, and asks for things in a different order. The FBI's indicators include interviews "not conducted in-person or through a secure video call", a requirement to buy start-up equipment from the company, and requests for credit card information. Legitimate companies, it says, "will ask for PII and bank account information for payroll purposes AFTER hiring employees." The FTC is direct: "Honest employers, including the federal government, will never ask you to pay to get a job", and "No honest potential employer will ever send you a check to deposit and then tell you to send on part of the money, or buy gift cards with it."

The requests that should stop the process:

• Money before the job starts, for a fee, training, a background check or equipment. LinkedIn's guidance warns about companies that ask you to buy your own equipment "and requests you to mail it to their IT department".
• A laptop to keep at home for someone else, or an interview to sit on someone else's behalf. The FBI warned in October 2026 that North Korean IT workers post fake job openings on well-known job boards with requests like these.
• An early move to WhatsApp, Telegram or text. LinkedIn lists "Urgent requests to move off-platform", and the FTC says of generic, unexpected texts and WhatsApp messages about jobs: "Real employers will never contact you that way."
• Your ID photo, Social Security number or bank details "before formal hiring", in LinkedIn's words.
• A coding test that means running a package, script or repository the recruiter sends, or an unexpected offer of unrealistically high pay "without negotiation". Both are on the FBI's 2024 list of signs of North Korean social engineering against people in cryptocurrency and related industries, where the impostors include recruiters.

In the FBI's words, these scammers "lend credibility to their scheme by using legitimate information to imitate businesses", and in each of its examples job seekers contacted the company. Its 2022 warning was written partly for employers: "Job seekers who are unaware they have been scammed may write negative reviews of the victim company". Its recommendations include listing job postings on your own website "with instructions on how to apply, including the legitimate contact information for your company", adding a warning to your careers page with examples such as "We will not hire through text message/social media/email alone," searching for fraudulent postings under your name and reporting them, and making sure hiring staff know that "victims of recruitment scams may contact them".

On LinkedIn, admins of a verified company Page can now remove known impostor accounts so they no longer appear in search results under the company's name, a feature LinkedIn announced in September 2026.

Each report from a candidate needs the same answers, and Sixtyfour researches them from the details in the report. Reverse Email on the sender's address shows whether it leads to anyone on your team, and People Intelligence on the name the scammer used shows whether it belongs to a current employee, a former one or someone elsewhere. Teams with many reports can run them as a file through Bulk Intelligence, and Lattice, in beta, turns the rows into one graph in which reports sharing an email address, phone number or domain connect, which can show whether many reports come from one operation.

The case is a composite. Gellivane, Gannerley Health and Nadia Gelstrop are invented, and so is Rhea's search. Domains use the .example names reserved for documentation, and the phone number comes from the fictitious 555-0100 to 555-0199 range.

Rhea, a data analyst, gets a LinkedIn message from Nadia Gelstrop, who says she is a talent partner at Gellivane, a logistics software company, about a remote senior analyst role. The next email comes from nadia.gelstrop@gelivane.example, with Gellivane's logo and a salary well above Rhea's current one, and asks her to interview by text on a messaging app. After an hour of typed questions an offer arrives, asking her to buy a laptop from a named supplier, to be repaid in her first salary, and to send a photo of her driving licence and her bank details before her start date. The signature gives +1 415 555 0143.

Searching for the company herself, Rhea finds Gellivane's website at gellivane.example, with two Ls. The domain in the email has one.

She gives Sixtyfour the address, the name, the company, the phone number and the website she found, and asks four questions as fields: where Nadia Gelstrop works today, whether she works at Gellivane, which domains Gellivane uses, and whether Gellivane lists a senior analyst role. Confidence scoring is on.

• Reverse Email on the address returns "No data found".
• People Intelligence finds Nadia Gelstrop as a talent partner at Gannerley Health, a clinic group, since March 2024, citing Gannerley's team page and her own profile, which lists Gellivane as her employer before that. Its answer to whether she works at Gellivane today is no, with a high score and a justification citing both pages.
• Company Intelligence returns gellivane.example as the company's only domain, citing its website and its LinkedIn Page, and finds two people on its talent team, neither of them Nadia Gelstrop. The careers page lists four roles and no senior analyst, and its hiring notice says Gellivane's recruiters write only from gellivane.example addresses and never ask candidates to buy equipment.
• Reverse Phone on the signature number returns no match.

Sixtyfour reports two things as open: nothing it found connects gelivane.example to Gellivane or to anyone else, and it cannot say who sent the messages.

Rhea makes her own checks. In a public web archive, a 2023 copy of Gellivane's team page lists Nadia Gelstrop as a recruiter. In ICANN's Lookup tool, Gellivane's domain was created in 2014 and the lookalike eleven days before the first message, with its owner's details withheld. She calls the main number on Gellivane's website, and the talent team confirms that the role does not exist and that Nadia Gelstrop left in 2024.

So the name belongs to a real recruiter who now works elsewhere, the domain is not Gellivane's, the role is not on its careers page, and the process asked for money and bank details before any hire. Who registered the lookalike and wrote the messages stays open. Rhea stops replying, sends nothing, and reports the messages to LinkedIn, the FTC and the FBI's Internet Crime Complaint Center. Gellivane adds the lookalike domain to the warning on its careers page and tells Gannerley Health that Nadia Gelstrop's name is being used. Sixtyfour found and cited the facts, and the decisions stayed with Rhea and Gellivane.

• A real account in the wrong hands. If someone controls a genuine recruiter's mailbox or profile, the domain and badge checks pass, and the process checks and a call to a number you found yourself are what catch it.
• A fake company built from scratch, with its own domain, website and profiles. The FBI's October 2026 warning says North Korean IT workers "create fake companies". With no real company to compare against, look for a history other people wrote, such as press, a registry record or people who worked there years ago.
• Time pressure. A deadline that runs out before your checks do is part of the method, and a real employer can wait a day.

The checks that hold up best are the ones a scammer does not control: the company's own website, a phone number you found yourself, and pages other people wrote about the recruiter over the years.

A recruiter who fails one check may still be real, because several things that look wrong have ordinary explanations.

• Agency recruiters write from their agency's domain, and some companies send interview invitations through a hiring platform. Find out who the agency or platform is before treating the domain as a mismatch.
• A real recruiter can be new, have few connections or carry no badge, since verification depends on the company and its LinkedIn products.
• Large companies own several domains for good reasons, and the FBI says only that several websites for one company "may indicate" a fake listing.
• Small companies may not keep a careers page, so confirm the role by phone.
• A search that finds nothing about a person is a gap in the evidence, and may reflect a private person with a small footprint.

Act on what fails against the company's own records, reached through channels you chose: a domain the company does not use, a role it does not list, a recruiter it does not employ, or a request no real employer makes.

Check the recruiter, the email domain and the company separately, through the company's own website and phone line, and make sure the three connect. Treat any request for money, equipment, ID or bank details before a formal hire as the end of the conversation. Sixtyfour runs the research behind the checks from the recruiter's name, address and claimed employer, and returns where the person works, whether the domain is the company's and whether the role exists, with a source behind every finding.