Fake Job Interviews Are Draining Bank Accounts. Here Is How the Scam Works.
Criminals posing as recruiters on LinkedIn and Indeed are tricking jobseekers into downloading malware disguised as interview software. One person lost £18,000 in cryptocurrency overnight.
Key points
- A jobseeker lost £18,000 in cryptocurrency after downloading a malicious Google Sheets document sent by a fake LinkedIn recruiter.
- Criminals are also circulating booby-trapped mobile apps disguised as legitimate interview tools, including a fake Indeed Interview app.
- LinkedIn data found that 32 percent of Gen Z professionals face the highest exposure to job scams, with many admitting they ignore warning signs because the job market feels too competitive to risk passing up opportunities.
- Indeed has confirmed that its interview process never requires downloading a separate app, so any message asking a candidate to do so is fraudulent.
What actually happened to the person who lost their savings?
A jobseeker who had publicly advertised on LinkedIn that he was looking for work was contacted by someone pretending to be a recruiter. The approach felt convincing. There was a video call. There was a Google Sheet that looked like a standard technical assessment. Nothing seemed obviously wrong.
What the document contained was malware, which is malicious software that quietly installs itself on a device and can then steal passwords, access online accounts, and siphon money. The victim completed the task, went to sleep, and woke up to empty cryptocurrency wallets. He had lost £18,000.
"It's a horrible feeling to be out a substantial amount, something I wouldn't wish on my worst enemy," he told BBC News.
Cybersecurity researcher Charlie Kelly, who analysed the attack, noted that the operation was unusually polished. "This wasn't a badly written email with a suspicious attachment," Kelly said. "This person was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app."
Digitally signed means the software carried a certificate that most computers treat as a mark of trustworthiness, the same kind of certificate that banks and operating system makers use. The criminals had faked it.
How widespread is this?
Very. Both LinkedIn and Indeed have flagged growing numbers of these scams in recent months.
LinkedIn released figures describing what it calls the Gen Z "Scam Gap": younger professionals face the highest exposure to scams at 32 percent, yet nearly a third of that same group admit to ignoring warning signs because the job market feels too competitive.
On Indeed, criminals are circulating fake mobile apps with names like "MyInterview", luring candidates with messages such as "Complete your interview by installing the Indeed app" or "Salary agreement available after app installation."
Once installed, those apps give criminals access to private data, which they use either to blackmail victims or to carry out direct financial theft.
Indeed has stated plainly: its interview process happens in a browser and never requires a separate app download.
| Platform | Scam method | Red flag |
|---|---|---|
| Malicious document in fake assessment | Unexpected file download during interview | |
| Indeed | Fake interview apps (MyInterview, fake Indeed app) | Told to install an app to interview |
| Both | Fake recruiter profiles | No verifiable company presence |
What should jobseekers actually do?
Do not download anything during an interview process without first checking the company is real. Look up the recruiter independently. Search the company name on LinkedIn and confirm the person contacting you actually works there.
If a "recruiter" sends you a file or asks you to install an app before you have ever spoken to anyone, treat it as a scam until proven otherwise. Legitimate employers do not ask candidates to install software to take an assessment.
If you use cryptocurrency wallets, keep them on a separate device you do not use for job searching.
Finally, if you have already downloaded something suspicious, change your passwords immediately from a clean device, not the one you used to open the file.
Common questions
How do I know if a recruiter on LinkedIn or Indeed is real?
Search the company they claim to represent independently, find the company's official careers page, and check whether the job is listed there. If you cannot verify the role exists outside of the message you received, be cautious.
Does this only affect people who use cryptocurrency?
No. Cryptocurrency was the target in the case reported here because it is harder to recover than bank transfers, but the same malware can steal passwords, banking credentials, and personal files that criminals use for blackmail.
