Fake Job Offers and Recruitment Fraud
Recruitment fraud works because applicants are motivated to cooperate and reluctant to challenge an employer. For security teams it matters twice over: staff get targeted, and your company name gets used as the bait.
How the scam runs
Contact arrives by WhatsApp or Telegram, referencing a real company and often a real job title. The salary is above market, the process is unusually fast, and the recruiter moves quickly to a chat app rather than staying on the recruitment platform where the listing appeared.
The extraction takes one of three forms. A fee, framed as administration, training, uniform or a medical check. A data harvest, where identity documents, bank details and selfies holding an ID are collected as onboarding, then used to open accounts or take loans in the applicant's name. Or a role that is itself criminal, where the job is receiving and forwarding funds.
The company being impersonated usually has no idea. This is why it matters to security teams: candidates and the public may contact you about offers you never made, and the reputational exposure is yours even though the fraud happened elsewhere.
Signals that give it away
You are asked to pay anything
Legitimate employers do not charge candidates for administration, training, equipment or medical checks. Any payment request, at any stage and for any stated reason, ends the conversation.
The recruiter moves you to WhatsApp or Telegram immediately
Real recruitment leaves a trail on a platform or corporate email domain. Moving to a personal chat app early removes accountability and makes the recruiter untraceable afterwards.
You are offered a job you never applied for, with terms above market
Unsolicited offers with unusually generous terms and no interview are designed to make questioning feel like ingratitude. Speed and generosity together are the signal.
The one rule that stops it
No legitimate employer ever asks a candidate for money. Verify any offer through the company's official website or published number, never through the contact details supplied in the message.
These pages describe fraud tactics for defensive awareness and staff briefing purposes. They are general information, not legal or financial advice. If you have lost money, report it through official channels: the police cyber crime unit, your bank, and for investment or lending matters, OJK.
Frequently asked questions
Find the company's official website independently and check whether the role is listed. Call the published number and ask to confirm the recruiter's name. Do not use any contact detail supplied in the offer itself.
Related pages
How To Report Online Fraud in Indonesia
Which channel to use, in what order, and what evidence to gather first. Reporting fast to the right place is what determines whether funds can still be held.
Learn moreThe Malicious APK Sent Over WhatsApp
A file arrives on WhatsApp looking like an invitation, a delivery receipt or a tax notice. Installing it hands an attacker your SMS, your notifications and often your banking access.
Learn moreYou Already Installed It: What To Do Now
The steps that matter in the first hour after installing a malicious APK, in the right order, and the mistakes that make the damage worse.
Learn moreTurn awareness into measured behaviour
Reading about scams does not change what people click. Claro runs bilingual simulations across email, WhatsApp, SMS and voice, then measures who is actually resilient.
See how Claro measures it