Fake Job Interviews Are Draining Bank Accounts. Here Is How the Scam Works.
Criminals posing as recruiters on LinkedIn and Indeed are tricking jobseekers into downloading malware disguised as interview software. One person lost £18,000 in cryptocurrency overnight.
Key points
- A jobseeker lost £18,000 in cryptocurrency after downloading a malicious Google Sheets document sent by a fake LinkedIn recruiter.
- Criminals are circulating booby-trapped mobile apps disguised as legitimate interview tools, including a fake Indeed Interview app.
- LinkedIn data found that 32 percent of Gen Z professionals face the highest exposure to job scams, and nearly a third of that same group admit they ignore warning signs because the market feels too competitive.
- Indeed has confirmed that its interview process never requires downloading a separate app, so any message asking a candidate to do so is fraudulent.
What actually happened to the person who lost their savings?
A jobseeker who had publicly advertised on LinkedIn that he was looking for work was contacted by someone pretending to be a recruiter. The approach felt convincing. A video call was arranged, followed by a Google Sheet framed as a standard technical assessment. Nothing seemed obviously wrong.
What the document contained was malware: malicious software that quietly installs itself on a device and can then steal passwords or drain financial accounts. The victim completed the task, went to bed, and woke to empty cryptocurrency wallets. He had lost £18,000.
"It's a horrible feeling to be out a substantial amount, something I wouldn't wish on my worst enemy," he told BBC News.
Cybersecurity researcher Charlie Kelly, who analysed the attack, noted that the operation was unusually polished. "This wasn't a badly written email with a suspicious attachment," Kelly said, speaking to the BBC. He added that the victim "was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app."
Digitally signed means the software carried a certificate that most computers treat as a mark of trustworthiness, the same kind used by banks and operating-system makers. The criminals had faked it. This technique also featured in the Iranian crew Nimbus Manticore's fake-job campaign we reported on 1 September, where signed coding-challenge packages were used to drop remote-access malware on Mac and Linux machines.
How widespread is this?
Both LinkedIn and Indeed have flagged growing numbers of these scams in recent months.
LinkedIn released figures describing what it calls the Gen Z "Scam Gap": younger professionals face the highest exposure to scams at 32 percent, yet nearly a third of that same group admit to ignoring warning signs because the job market feels too competitive.
On Indeed, criminals are circulating fake mobile apps with names like "MyInterview", luring candidates with messages such as "Complete your interview by installing the Indeed app" or "Salary agreement available after app installation." Once installed, those apps give criminals access to private data for blackmail or direct financial theft.
Indeed has stated plainly: its interview process happens in a browser and never requires a separate app download.
| Platform | Scam method | Red flag |
|---|---|---|
| Malicious document in fake assessment | Unexpected file download during interview | |
| Indeed | Fake interview apps (MyInterview, fake Indeed app) | Told to install an app to interview |
| Both | Fake recruiter profiles | No verifiable company presence |
What should jobseekers actually do?
Do not download anything during an interview process without first checking the company is real. Look up the recruiter independently. Search the company name on LinkedIn and confirm the person contacting you actually works there.
If a "recruiter" sends you a file or asks you to install an app before you have ever spoken to anyone, treat it as a scam until proven otherwise. Legitimate employers do not ask candidates to install software to take an assessment.
If you use cryptocurrency wallets, keep them on a separate device you do not use for job searching. And if you have already downloaded something suspicious, change your passwords from a clean device, not the one you used to open the file.
Common questions
How do I know if a recruiter on LinkedIn or Indeed is real?
Search the company they claim to represent independently, find the company's official careers page, and check whether the job is listed there. If you cannot verify the role exists outside of the message you received, be cautious.
Does this only affect people who use cryptocurrency?
No. Cryptocurrency was the target in the case reported here because it is harder to recover than bank transfers, but the same malware can steal passwords, banking credentials or personal files that criminals use for blackmail.
