Someone Is Hiring in Our Name. It Isn't Us.

I don't talk enough about our team at Humareso. When we redid our website this year, we leaned hard on an old Steve Jobs line, "people with passion," from his longer thought that people with passion can change the world for the better.

It is easy to put people first when the person is a client, or a colleague. The harder test is a stranger. This week a woman in Texas, someone none of us had ever spoken to, called our main line in the middle of the worst afternoon of her year, and the person who answered gave her the same care she would have given anyone we work with. The emotions on that call ran high from the first minute.

She called us from the parking lot of her bank. She was still in the car. A few minutes earlier a teller had looked at the check she'd brought in, looked at her, and slid it back across the counter with the kind of care people use when they are about to ruin someone's week. The teller said not to deposit it. Then she said why.

The check had come by FedEx, in an envelope with a letter inside. The letter was on company letterhead and it congratulated her on her new position with Humareso. It explained which equipment to buy for her home office, and it gave her an address for sending back whatever was left over. She had been interviewing for the role for most of an afternoon, over text, with a man whose name and title and photo she had checked on LinkedIn before she ever replied. He was one of our consultants. He is a real person. He has never heard of her.

At the end of that afternoon she was offered the job. The next message carried an I-9 and a W-4. She filled them both out, Social Security number on each, and sent them back the same day, because that is what you do when you have been looking for work for a while and someone finally says yes.

So by the time she found our real number and reached a coordinator in our office, she was past asking whether any of it was true. The teller had settled that. What she wanted to know, sitting in her car with the check on the passenger seat, was how much of herself she had already handed over, and whether there was any way to get it back.

Just hours earlier, a man called about a text that had woken him at seven that morning. It was from "Amanda" at Humareso, and it said we had just posted a job that fit his work preferences. He read it twice, and then, instead of replying, he found our number and dialed it himself. There is no Amanda. Our coordinator told him so, and stayed on the line while it sank in.

I ran a cybersecurity company before I came to Humareso. We did risk assessments, and I have read more incident reports than I could count, enough that I know what it is to look at one and see the people in it as line items. Then last week I read one with our name in the box marked "impersonated party," and the line items had voices, and one of them was calling from a parking lot. You feel responsible for people you have never met.

Most of the people reading this already know that recruitment fraud exists. You have seen the advisories, and some of you have handled a case. The woman with the FedEx envelope had never heard of it. Nobody in her life had thought to tell her, and that gap, between what we know in our offices and what she knew at her kitchen table, is the whole problem.

What changed

Fake job offers have existed as long as job boards have. What changed in the last two years is the cost of running one.

A scammer no longer needs to write a convincing recruiter message. A language model writes a hundred of them, each tuned to the candidate's resume, in the time it takes to read this sentence. They no longer need to invent a recruiter. They lift a real employee's name, title and photo from LinkedIn and let the victim's own research confirm the lie. They no longer need to hold a phone screen. A text-based "interview" can run a dozen conversations at once, and it sounds patient and professional because the software is.

The scam used to be limited by labor. Now it is limited only by the supply of hopeful people. That supply is enormous. Every laid-off worker, every new graduate, every parent returning to the workforce is a target, and the message that reaches them looks exactly like the message that reached them from a real employer last month.

The same technology is available to us. The tools that make the scam cheap also make the defense cheap, and most companies have not yet decided to use them.

What the first call sounds like

If your company has a recognizable name, the call is coming. It will not go to your security team. It will go to your front desk, your support inbox, or the person whose name was stolen, who will open LinkedIn one morning to find a stranger thanking them for the interview. The caller will be confused, and some will be angry at you, because from where they stand, your company lied to them. A few will have already lost money. One of ours had handed over everything an identity thief needs to open accounts in her name, and she knew it, and she was still on the phone with us, hoping we would say something that made it untrue.

Your people will handle that call well or badly based entirely on whether anyone prepared them. At Humareso, our coordinators did it well on instinct. They stayed with the caller, they got the facts, and they escalated. We have since written it down so the next person does not need instinct. Every report now becomes a ticket, every caller gets a clear answer and real next steps, and nobody on our team has to guess.

Decide what your front line says when someone asks "is this real?" Then tell them, before the phone rings.

Protecting candidates, before and after

Most of the defensive advice online is written by security people for security people. The woman with the envelope would not have found it, and if she had, it would not have been written for her. What we now tell candidates fits on a careers page, in plain language.

Before anything happens. Real recruiters email from the company's own domain. Real interviews involve a voice or a face, usually more than one. Real offers come after you have met people, and real paperwork comes after the offer, through the company's HR or payroll system. No real employer mails you a check before your first day and asks you to send part of it back. If any of those are missing, stop and call the company at a number you found yourself.

After something happens. If a candidate has shared a Social Security number, a copy of an ID or bank details, the clock matters. Place a fraud alert or a credit freeze with all three bureaus. Go to IdentityTheft.gov and follow the recovery plan. Report to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov. Then tell the company whose name was used, because they may be able to get the fake posting taken down faster than you can.

We did not put the credit-freeze instructions in our candidate materials until someone mentioned that I-9s and W-4s were involved. I wish we had done it sooner.

Protecting your company and your people

You cannot prevent impersonation. Your name and your employees' names are public by design, and no amount of security spending changes that. What you control is how long the impersonation works and how much damage it does in that window. When I ran a security company, the clients who did best were never the ones who tried to make themselves unimpersonable. They were the ones who had already decided what to do on the morning it happened.

• State your rules in every posting. Which domain your recruiters write from, that you never interview by text alone, that you never ask candidates for money. One paragraph, on every job board, on your careers page, and in your applicant confirmation email.
• Give candidates one place to verify. An email address or a page where anyone can ask "is this recruiter real?" and get an answer the same day. Make sure the people behind it know what to say.
• Watch for lookalikes. Search job boards and LinkedIn for your company name weekly. Register the obvious misspellings of your domain before someone else does. Ours was already taken.
• Warn the people whose names are likely to be used. Your recruiters, your HR team, your most visible consultants. Tell them what to do when a stranger messages them to ask about a job they never posted.
• Prepare your front line and log everything. A short script, a ticket for every report, and one owner who sees all of them. Pattern recognition starts with a pile of tickets.
• Report as the impersonated company. Job boards, platforms and domain registrars move faster for the company whose name was abused than for an individual victim. File quickly and file everywhere.
• Use the tools on your side. The same models that write the scam can read your inbox for lookalike postings, draft takedown requests, and keep your candidate warnings current across every board. We use them for exactly that.

A company of twenty people can do all of this in an afternoon, as long as one person owns it.

The part that is about people

The woman in the parking lot was not careless. She researched the company. She found a real consultant with a real title and a real face. She did everything we tell people to do, and the scam was built to survive exactly that much diligence. The one thing nobody had ever told her was that the check in the mail was the tell, and by the time she learned it she was standing outside a bank holding one.

That is the gap. Leaders know this is happening. The public mostly does not. We can keep that knowledge inside our security teams, or we can put it in front of the people who need it, in words they can use, in the places they will actually look.

I am hopeful, and I can tell you exactly why. Every person who called us this week called because something felt off and they wanted to check. The man with the seven o'clock text had the scammer's reply box open on his phone and chose our number instead. That instinct is the whole defense, and it is already out there, in millions of people who will never read a security advisory. Our job is to make sure that when they act on it, someone picks up, tells them the truth, and helps them with what comes next.

If you lead a company, that someone works for you. Prepare them.

If you are the one looking

If you are reading this because a message like that landed in your inbox, I am sorry. Looking for work is hard enough when everyone involved is honest. You already carry the quiet math of a job search, how many weeks the savings cover, how many applications went out this month without a reply, how to answer when someone at dinner asks how it's going. A fake offer walks straight into that and makes itself at home.

I know what it costs, because the people who called us told me. An afternoon in an interview that was never going to end in a job. A resume rewritten for a posting that did not exist. A few days of not applying anywhere else, because something had finally come through and it felt wrong to keep looking. For some, a morning at the bank, an evening on the phone with the credit bureaus, and nights wondering what else is out there now with their name on it. The scammers took money from a few of you. From everyone they reached, they took time and hope, and those are the two things a job search cannot spare.

None of this was your failure. The message was built by people who do this for a living, with tools that make it look exactly like the real thing. It was aimed at you because you were doing what careful people do: checking the name, answering promptly, filling out the forms you were asked for. Your diligence did not fail you. It was the thing they planned around, and there is no shame in being lied to well.

Here is what I'd ask of you, and it is small. When something feels off, find the company's number yourself and call it. The person who answers at a company worth working for will be glad you did, and if they aren't, you have learned something worth knowing. If you have already shared more than you meant to, the steps above work, and today is better than this weekend. And if the name on the message was ours, write to us. Someone here will tell you the truth, stay with you through what comes next, and mean it when they say they are glad you called.

You were not wasting anyone's time by checking. The people who wasted yours were never going to hire you, and the right employer is still out there, waiting for the version of you that this did not get to stop.

Humareso recruiters only contact candidates from an @humareso.com address. We never interview by text alone, and we never ask candidates for money. If you have received a message claiming to be from us and you are not sure, write to support@humareso.com and we will tell you.