Fake recruiters, fake vacancies, real losses: the job scams hitting businesses now

Scam one: the take-home test

It began, as plenty of good news does, with a message from a recruiter. A software engineer at Binance, the world's biggest cryptocurrency exchange, was approached on a mainstream job site by someone introducing themselves as a project director at a promising company. There were two interviews — one with a pleasant HR contact, one with the "CEO". Then came the usual next step: a small take-home coding task. Download this project, get it running, show us what you can do.

According to the incident report Binance published on 3 November, that coding task was the door. The project carried hidden malicious code, and the company's own security tools didn't catch it straight away. Weeks later, the attackers used the engineer's laptop as a stepping stone onto other employees' machines, and from there to the money. Reports put the theft at around $6.3 billion. The FBI has blamed North Korea's state-backed hackers; North Korea denies it.

It would be easy to file this under "crypto problems" and move on. That would be a mistake. The opening move had nothing to do with cryptocurrency. It used the most trusted ritual in working life — applying for a job — and turned it into a weapon. And it is far from the only scam built that way. The hiring process has quietly become one of the most abused corners of the internet, and it hits individuals and businesses from both directions.

Scam two: pay to fix your CV

Take the smallest version first. For a few years now, consumer watchdogs in the US have been warning about the "résumé formatting" scam. A friendly headhunter invites you to apply for a role; when you upload your CV, an error tells you the format is incompatible. Helpfully, the recruiter knows a website that will fix it — just enter your details and pay a small fee. There is no job. The fee and the personal details go straight to the scammer. It's petty next to Binance, but it runs on exactly the same engine: a believable recruiter, a reasonable-sounding next step, and a request you'd feel silly refusing.

Scam three: vacancies that are really tender bids

The third version is closer to home for anyone who has ever bid on a contract, and it doesn't come from criminals in the usual sense. Professionals in procurement-heavy fields — construction and consulting especially — have been describing what they call tender fraud: firms posting job adverts they never intend to fill, purely to collect CVs from qualified people. Those CVs then appear in a tender bid as the firm's "proposed team", lending it expertise it doesn't actually have. The applicant hears nothing back. The client evaluating the bid believes it's hiring people who may never set foot on the project.

Put the three side by side and the pattern is clear. In each case, the trust we extend to a hiring process — to recruiters, to job adverts, to a test task, to a CV in a bid document — is the thing being exploited. Nobody broke in. Somebody was invited in.

What to actually do about it

So what does a sensible organisation actually do with this? Start with your own people. Nobody runs files from someone they haven't verified, and verification means going around the conversation, not through it: look the company up independently, call a published number, check the person exists outside the thread you're in. Never pay to apply for anything. And keep job hunts, side projects and tests from strangers off the machine that holds client files, banking and admin logins — a separate device, or at minimum a separate account. It's dull advice, and it's the advice that would have turned the Binance story into a non-event.

Then look at the keys. Two-step sign-in on email, banking, your domain and your website's admin panel means one compromised laptop doesn't automatically become a compromised business. Keep a short, honest list of who has access to what — including former staff, and the freelancer who set up your site three years ago. Access nobody remembers granting is access nobody will think to remove.

If you buy services through tenders, treat the CVs in a bid as claims to verify, not facts. Ask whether the named people are actually employed, or contractually committed, and make it a condition that they work on the project. A quick call to a key person listed in a bid is cheap insurance. And if you're the one hiring, protect your own name: publish genuine vacancies on your own website as well as job boards, say plainly that you never charge applicants or ask them to install software, and give people a way to check that a recruiter really speaks for you. Scammers borrow real company names precisely because nobody checks.

Finally, make it easy for people to say "this feels off" without embarrassment. The engineer in the Binance story wasn't careless; they were targeted by professionals with patience and a script. The organisations that come through these attacks best are the ones where checking with a colleague is normal, not a confession.

That is also how we run our own work. Every system we build — from member platforms to board-election ballots — assumes that somebody, someday, will be fooled, and is designed so that one mistake can't open everything. If you'd like a plain-language look at who can reach what in your organisation, and which two or three changes would matter most, that's a short conversation worth having before someone else starts one.