The complete recovery checklist after engaging with a fake job posting or fake recruiter — ordered by urgency, with every official reporting link. Most of the damage from a job scam is preventable in the first 24 hours. Start at the top and work down.
By JobScamScore Research Team · Published
Stop replying and block the "recruiter" on every channel: email, WhatsApp, Telegram, LinkedIn, phone. Don't click anything else they send. And don't announce that you know it's a scam — scammers who realize they're exposed rush to use whatever they already have, while you still need time to lock things down.
If they sent you a check or a "first paycheck," do not spend, wire, or forward any of it. The check is counterfeit — it will bounce in 1–2 weeks and your bank will pull the full amount from your account. Anything you sent on in the meantime is your loss, not theirs.
Your recovery steps depend on what the scammer got. Work through every section that applies — many victims are in two or three at once.
If your SSN, date of birth, or ID documents were exposed, a credit freeze is the strongest protection that exists: it blocks anyone — including you — from opening new credit in your name until you lift it. It's free by federal law, doesn't affect your credit score, and you can lift it online in minutes whenever you genuinely apply for credit. You need to do it at each bureau separately:
Create a myEquifax account, choose "Place a freeze." ~3 minutes.
Choose "Add a security freeze" — no account required for the initial freeze. ~3 minutes.
Create an account, select "Freeze my credit." ~3 minutes.
Freeze vs. fraud alert: a fraud alert only asks lenders to verify your identity; a freeze blocks access to your report entirely. After giving your SSN to a scammer, choose the freeze. Then file at IdentityTheft.gov for an FTC recovery plan, and request an IRS Identity Protection PIN so no one can file a tax return as you.
Reporting rarely feels satisfying, but it does three concrete things: it creates the official paper trail your bank and the IRS will ask for, it feeds the pattern-matching that takes scam operations down, and it gets the posting removed before the next person applies.
Keep screenshots of the posting, every message, email headers, and payment receipts before the scammer deletes their accounts. Outside the US? Report to your national cybercrime unit (e.g. Action Fraud in the UK, Scamwatch in Australia) — the money and identity steps above still apply.
Scam victims are systematically re-targeted, because scammers sell "sucker lists" of people who have already paid once. In the weeks after a job scam, expect some of these:
Stolen identity data doesn't expire — it gets sold, resold, and used months later, which is why the cleanup above needs a monitoring layer behind it. The free baseline everyone should do: check bank and card statements weekly for the first month, and pull your free credit reports at AnnualCreditReport.com on a rotating schedule — one bureau every four months covers the whole year.
Identity monitoring services automate what the manual routine can't: near-real-time alerts when your SSN or accounts appear in new credit applications, address changes, or dark web marketplaces, plus insurance and a restoration specialist if the worst happens. If your SSN or ID documents were exposed, this is the situation these services exist for. If you only shared a résumé, data broker removal is usually the more relevant layer.
Same day: freeze your credit at all three bureaus (free, ~10 minutes), file at IdentityTheft.gov for an FTC recovery plan, request an IRS Identity Protection PIN, and monitor your reports for the next 12 months. The freeze is the critical step — it blocks new accounts from being opened in your name.
Sometimes — and speed decides it. Card payments have the strongest fraud protections; bank transfers can occasionally be recalled if you call the same day; gift cards can sometimes be frozen by the issuer; wires, Zelle, and crypto are rarely recoverable. Call your bank first, report to IC3.gov second, and keep every receipt.
Yes if you lost money or your identity documents were exposed. Banks, the IRS, and insurers often require a police report number for fraud cases. File locally (many departments take online reports) in addition to the FTC and IC3 federal reports.
Freeze. A fraud alert only asks lenders to verify your identity; a freeze blocks new credit entirely and is just as free. You can lift it online in minutes whenever you actually apply for credit.
Lower risk, but stay alert: your résumé gives scammers enough for convincing targeted phishing and impersonation calls. Watch for follow-up contact referencing your real history, and consider data broker removal to make the stolen data less usable.
No. Real employers collect ID, SSN, and banking details during onboarding, after a signed offer. Requests before that point are identity harvesting. If you already sent documents, freeze your credit and file at IdentityTheft.gov.
At least 12 months: statements weekly for the first month, then monthly; one bureau's free credit report every four months; and keep the freeze in place indefinitely — it costs nothing and takes minutes to lift when needed.
Paste the job posting or recruiter message into JobScamScore. Our AI cross-checks the company, careers page, recruiter contact, and salary data — and tells you exactly what it found, free.
Scan the Job Now →The FTC-backed warning signs — so this never happens again.
The exact fraud patterns running on LinkedIn right now.
Red flags and verification steps for Indeed listings.
One minute of your time warns other jobseekers before they apply.