How to tell if a job reference is fake

To tell if a job reference is fake, check the referee without relying on the contact details the candidate gave you. The candidate chooses the referee and supplies their name, email address and phone number, so a check that uses only those details can reach the candidate's friend, or the candidate. Confirm that the referee exists and worked where the candidate says, reach them through the company's main number or another channel you found yourself, and read the email domain and phone number for whom they belong to. Then compare the referee's account of the job with the candidate's, and look for patterns across the references.

This guide takes those checks in turn, with what each one proves and a worked example. For the candidate's own claims, see our guide to verifying a resume, and for the organised schemes behind many fake applications, our guide to spotting fake candidates.

A reference check usually starts from details the candidate supplied: a name, a job title, an email address and a phone number. Each of them can be chosen to make the check succeed. Timothy Bednall, an associate professor of management at Swinburne University of Technology, writes that reference checks are "a relatively easy hurdle for candidates to overcome because referees are typically self-selected".

Documented cases show how little it takes. In a 2022 investigation summary, the Public Service Commission of Canada described a candidate who was asked for references from a current and a previous manager. Both completed questionnaires came back from what seemed to be personal email accounts, and the candidate's name "was also linked to the email account of one referee." Asked for work addresses, the candidate supplied one and offered a third referee in place of the other. The candidate later "admitted that they had created 2 email addresses to impersonate and act as their own references."

New Zealand's Serious Fraud Office describes a case in which a woman was hired in 2021 as a property and facilities manager at Oranga Tamariki, a government agency, using references that "were not written by the claimed authors." She assigned work to her husband's company, and Oranga Tamariki made payments on its invoices totalling just over NZ$2.1 million. After resigning, she used another forged reference to get a job at Waka Kotahi NZ Transport Agency, and she was later sentenced to three years' imprisonment. The first red flag the SFO lists is that she "provided forged references from personal rather than business accounts."

Some fake references are bought. People Management, the HR magazine, reported in February 2026 that commercial "reference houses" offer paid-for references and employment verification, and "even company email addresses and websites to support people's applications."

So a number on a reference sheet may ring a friend or the candidate, and a company domain may have been registered for the occasion. A reference check is only as independent as the contact details it uses.

Contract and remote hiring put distance between you and the employers a candidate names. The FBI warned in July 2025 that people helping North Korean IT workers get jobs had set up US-based front businesses, "including businesses purporting to offer short-term technical contract workers", and that contract IT work "is a common way that North Korean IT workers procure employment."

Front companies can pass for employers. In April 2026, two US nationals were sentenced to 108 and 92 months in prison for their part in one such scheme. According to the Justice Department, they created shell companies with corresponding financial accounts "to make it appear as though the overseas IT workers were affiliated with legitimate U.S. businesses", and those companies "had no employees or operations." The FBI had seized four web domains associated with them.

The FBI's January 2025 warning points at the contact details. It says North Korean IT workers "have reused phone numbers (particularly voice-over-IP numbers) and email addresses" on resumes for different applicants, and advises employers to "Cross-check HR systems for other applicants with the same resume content and/or contact information." The same cross-check works for referees.

Start with the person, using sources the candidate did not write. New Zealand's Serious Fraud Office, in its pre-employment screening guidance, advises employers to "Double-check the referee's name, job title and contact information against sources such as LinkedIn or the organisation's website." The UK's National Protective Security Authority (NPSA), the government's technical authority for personnel security, says in its employment screening guide that you "should confirm the existence of the employer (e.g. that it appears in relevant business directories)".

In practice, look for:

• The referee on the company's own website: a team page, a press release, a talk given on the company's behalf. Archived copies of those pages can show who was there in a given year, as our guide to verifying a resume explains.
• The company in a registry. In the UK, Companies House gives free details of companies on its register, including the date of incorporation and current and resigned officers, which helps at small firms where the referee may be a director. In the US, companies register with a state, and the National Association of Secretaries of State links to each state's business registration pages.
• A footprint other people wrote over several years: customers, news, trade bodies and job adverts. A company that exists only on its own website has not shown that it trades.
• The referee's own professional history, checked for dates that overlap the candidate's. A manager who joined after the candidate left cannot have managed them.

A company newer than the job it vouches for is the clearest mismatch. A firm incorporated in 2025 that vouches for work in 2022 may have a predecessor company or an old name, so ask. Small firms also leave thin records for ordinary reasons, covered below.

Reach the referee through the organisation, on a number you found yourself. The NPSA guide advises contacting the employer "to confirm that they have provided the reference, and discuss its contents", and adds: "Telephone numbers supplied by the applicant should not be wholly relied upon."

1. Find the company's main number on its own website, in a directory or in its filings, and never in the reference or the candidate's application.
2. Call it and ask for the referee by name, or for their team. A switchboard that puts you through shows the person works there. One that has never heard of them is a strong finding, worth confirming with HR.
3. If the company sends reference requests to HR, ask HR to confirm the candidate's dates and title, and whether the referee worked there and in what role.
4. If the referee has moved on, find them at their current employer the same way, and ask the former employer's HR to confirm that they worked there.

Prefer a conversation to a form or a letter. The SFO advises employers to "Be cautious of candidates who only provide written references or referees who are not able to be contacted for a live conversation." A written reference is easy to produce in someone else's name, and a call through a switchboard is much harder to fake.

Read the domain first. A manager at a company of any size usually writes from the company's domain, and the SFO says that written references "from personal or free email accounts such as Gmail or Hotmail, rather than business email addresses, can be a warning sign that the referee is not who they claim to be." Treat a personal address as a reason to check, since a referee who has left an employer has no work address to use.

A company domain still needs reading. Compare it with the domain of the company's own website, character by character. The FBI and two other federal agencies have described fraudsters creating "email accounts and websites that closely mimic those of a legitimate company", with addresses that "may include extra letters or words, substitute characters" or use a different top-level domain. A reference from examplecorp-hr.example, when the company's website is at examplecorp.example, is the pattern to catch.

Then date the domain. For a generic domain such as .com, the public registration record includes the date the domain was created. ICANN's Lookup tool reads that record through RDAP, which replaced WHOIS as the definitive source of the data in January 2025. A company that says it employed the candidate for three years, writing from a domain registered last month, needs to explain the change. Check too whether the domain hosts a working website that agrees with the company's other records.

Last, search the address itself. In the Canadian case, the candidate's own name was linked to one referee's email account, and an address that turns up under the candidate's name is one of the strongest findings a reference check can make. Our guide to investigating an email address covers what one address can show.

Work out whose number it is before you dial it. Compare it with the numbers the company publishes on its website and in directory listings. A mobile or an internet phone number given as a direct line at a large employer deserves a question.

A current-carrier lookup usually shows the line type and the carrier serving the number today. Our guide to investigating a phone number explains what that can and cannot tell you, including why a number's older records may belong to an earlier holder. Internet phone lines are common at small businesses, so a line type is a reason to look further and nothing more.

Then search for the number. A referee's number that appears on the candidate's own CV, among another referee's details or in an earlier application to your platform ties the reference back to the candidate.

A real referee knows things the candidate did not tell you. Ask open questions and let the referee supply the facts: the candidate's title, the dates they worked together, who the candidate reported to and what they worked on. Compare the answers with the CV after the call. The SFO notes that reference checks can confirm employment and the "structure of the role and responsibilities, reporting lines and tenure."

Ask every referee the same questions. Bednall writes that "Research suggests using a standardised set of questions can produce more reliable outcomes", and the same questions make the answers easier to compare. In the Canadian case, the questionnaires returned from the same referee's personal and work email addresses "had significant differences, such as their evaluation of the candidate's work and the time they had supervised the candidate."

Small differences are normal, since people forget dates and round titles up. A referee who cannot describe the work, or agrees with everything you read out, has told you very little.

Read the references together as well as one by one. The SFO advises comparing written references "to identify where there might be similar sentence structures or grammatical errors", because similarities in writing style "may indicate that the same person is the author of multiple references."

Other shared patterns are worth recording:

• The same email domain for referees at different companies, or domains registered within a few weeks of each other.
• Phone numbers on the same internet phone provider, or numbers that run close together in sequence.
• Referees whose public profiles tie them more closely to the candidate than to the employer they speak for, such as the same course and graduation year and no record at the company.

Then notice how the candidate responds when you ask for a referee you can reach through an employer's main number. That is a fair request, and a candidate with real references can usually meet it. A candidate who offers a different referee instead, as in the Canadian case, has left the question open. As the SFO puts it, "It may be possible to identify someone impersonating a referee when referee information is obtained from several sources."

The case is a composite. The candidate and the companies are invented, the domains use the .example names reserved for documentation, and the phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use.

A talent marketplace places contract data engineers with enterprise clients. Linnea Corwath applies for a six-month contract. Her profile lists three roles: data engineer at Velsmere Freight, a logistics company, from 2019 to 2022, senior data engineer at Brackwold Insurance from 2022 to 2025, and a contract at Pennacott Analytics, a consultancy, since 2025. She gives one referee for each role. Warm written references from the Brackwold and Pennacott referees arrive within an hour of the requests. The Velsmere manager asks to talk by phone.

Velsmere. The company's website, its registry record and years of trade press agree. The vetting lead calls the main number from Velsmere's website, +1 312 555 0100, and asks for the manager by name. The switchboard puts her through, and she gives Linnea's title and dates within a month of the CV, describes the pipelines Linnea built and names the team's director at the time, who appears on an archived team page. The direct line Linnea supplied, +1 312 555 0164, is the one Velsmere's website lists for its data team. This reference holds up.

Brackwold. The referee's address is a free webmail account, and the number is a mobile. Brackwold's switchboard routes reference requests to HR, which confirms that Linnea worked there as a senior data engineer from 2022 to 2025 and, by policy, nothing more. HR has no record of anyone with the referee's name. A search of the webmail address finds a public profile under that name listing the same university course and graduation year as Linnea, and no job at Brackwold. Asked for a contact the team can reach through Brackwold itself, Linnea offers a different referee, from another job, with another webmail address.

Pennacott. An RDAP lookup shows that pennacott-analytics.example was created 23 days before Linnea applied, for a contract she says began in 2025. The website is one page naming only the director, and the registry of the state it names has no entity by that name. The office number, +1 312 555 0188, is an internet phone line, and the same number appears on an application Linnea made to the marketplace two years earlier, listed as her own. The two written references share two identical sentences.

Put together, one reference stands up, and two lead back into Linnea's own circle: a university contemporary with no record at the employer, and a consultancy whose phone number Linnea once listed as her own and whose domain is younger than the contract it vouches for. A number can pass to a new holder, so the team does not treat the shared number as proof on its own. It records what it confirmed, sets out the findings for Linnea, and asks her to explain the number and to name a referee reachable through Brackwold. Three questions stay open, and the file says so: whether the Pennacott contract happened at all, who wrote the two written references, and how well Linnea performed at Brackwold, since HR confirmed only her dates and title.

Count only independent evidence: a referee's profile and a company website that the candidate controls can be one source seen twice.

Each check has a known way around it.

• A real friend at a real company. The referee exists, works there and answers the switchboard, then says what they agreed to say. The checks confirm the person and the employment and leave the honesty of the account untested, so ask for specifics a friend would have to invent, and add a referee you found yourself.
• A front company built to last. A domain registered years ahead, a registry entry and a polished website pass the age and existence checks. The shell companies in the Justice Department case had web domains, financial accounts and "no employees or operations". A footprint written by other people over years, such as customers, news coverage and staff with histories of their own, is much harder to build.
• A paid reference service that supplies a company email address and website, as People Management describes. The domain's age, the registry and the footprint expose it, and a call through a number you found yourself is the step it struggles to answer.
• A main number taken from the wrong place. A number on a website the candidate controls reaches whoever the candidate chose. Take the number from a source the candidate could not have written, such as a directory, the company's filings or a page with an archived history.
• Impersonation of a real employee. A real name at a real company, used from a lookalike domain or a personal address, passes the existence check. Reaching the person through the company is what catches it.

Most references that look odd have an ordinary explanation, and a fair review checks for it first.

• Many employers confirm only dates and job title as a matter of policy. The NPSA notes that "many employers only permit references to be provided by the HR department", and Acas, the UK's Advisory, Conciliation and Arbitration Service, describes a basic or factual reference as a short summary such as the employee's job title and dates, adding that "some employers only give basic references." A former manager who sends you to HR is following that policy.
• Referees move on, and freelancers, consultants and staff at very small firms often use personal email. Someone who has left a company has no work address to give, so reach them through their current employer.
• Small companies and founders leave thin records. A five-person firm may have a one-page website, and a founder may be the only person who can speak for the candidate's work there. The registry's list of officers fills part of the gap, and for periods of self-employment the NPSA suggests evidence that can include client references.
• Names change. A referee or a candidate may appear in older records under a former or transliterated name, so ask before treating a missing record as a mismatch.

Keep the levels apart. A personal address or a thin website means look further. A contradiction, such as a company with no record of the referee or a domain younger than the job, needs an explanation from the candidate. The NPSA reminds employers that "there may be a reasonable explanation for apparent inconsistencies" and advises raising concerns with the applicant. The FBI's October 2026 update on remote IT worker schemes makes a similar point: such workers "cannot be identified reliably with a single indicator", and aggressive controls risk "false positives that could harm legitimate employees". The CIPD's selection methods factsheet cautions that references "provide a limited perspective of an individual's suitability for a role", so weigh them alongside everything else.

Checking referees by hand means looking up every name, company, domain and number a candidate supplies, and recording where each finding came from. Sixtyfour's agent starts from what you already have, such as a referee's name, email address, phone number or company, researches public sources such as company websites, registry filings and professional profiles, and links what it finds to the right person and company. Every finding comes with its source, and anything it could not establish is reported as open. It does not contact referees or replace the call through the company's main number, and a person on your team decides what to ask and whether to proceed. There is more on how hiring teams use it on our workforce identity page.

Check every referee through sources the candidate did not write: the company's own records, a call through its main number, and the email domain and phone number, read for whom they belong to. Compare the referee's account of the job with the candidate's and the references with each other, and ask the candidate about anything that does not fit before you decide.