A remote job that pays twenty percent above market rate for a title you already know cold is not a stroke of luck. That's usually the first flag, and it's an easy one to miss because everything else about the posting looks right — the software mentioned is the exact platform your industry actually uses, the language reads like an HR person wrote it, and the recruiter's profile checks out at a glance. Employment identity theft during remote hiring season doesn't run like the phishing scams from ten years ago, and treating it like an old-school scam is exactly how good candidates get caught.
The Old Advice Doesn't Match the New Remote Job Scam
Most safety advice for job seekers stops at "don't click strange links" and "never wire money to a stranger you haven't met" (fine advice, ten years too late). The scam I watched play out, through a posting for a remote HR director role applied for without much thought, never asked for a wire transfer. It asked for "verification." A generic application form, no company site behind it. Then, within half a day, an "onboarding" email that referenced my actual applicant tracking software by name and used the right industry shorthand the whole way through.
The requests kept escalating in the wrong direction after that. The "recruiter" wanted to move things off email and onto an encrypted messaging app, citing "corporate security" — real HR teams use Zoom or Teams for interviews, not Signal. Next came a payroll setup link, asking for tax paperwork before we'd had so much as a phone call. In an actual hiring process, payroll setup and I-9 verification happen after a signed offer and a live conversation with an actual person. This was running in reverse, and reverse is the tell.
The Nine Digits They're Really After
Here's what a scammer running this play actually wants: your Social Security number, paired with the address and phone number already sitting on your resume. Once they have both, they don't need your bank account. They can file for unemployment in your name, apply for other jobs as you, or open credit lines that become your problem instead of theirs. Your email address is the part people forget about in all this — it's close to the master key for everything else you own online, and losing quiet control of it is worse than most people realize.
I learned a related lesson the hard way years ago, when my credit card got cloned at a gas pump and ran up over a thousand dollars in furniture charges I never made. how to spot gas pump skimmers and protect your credit card info turned out to be a small piece of a much bigger picture. A cloned card gets shut off in five minutes with one phone call. A Social Security number doesn't have an off switch, there's no five-minute fix, just a long process through the Social Security Administration if it ever needs replacing at all.
Why "Wait for the Formal Offer" Is the Wrong Rule
Here's the piece of standard advice that actually makes people more vulnerable, not less: wait to share your SSN until you have a formal offer in hand. It sounds responsible. In practice, it trains candidates to let their guard all the way down the moment an "offer" shows up, because by then they're relieved and ready to be done with the process. That's exactly when people rush through an unfamiliar onboarding portal without checking who built it.
The timing was never the real problem. Who you're handing information to is the problem. If you haven't had a live video call with a specific person whose identity you can independently confirm against the company's own website — not a link the "recruiter" sent you — nothing gets typed into any box, offer letter or not. A real employer will not run an entire hiring process over text or an encrypted chat app, no matter how official the sender sounds.
Verify the Person, Not the Paperwork
My neighbor Bettye Carnes has never trusted an online form in her life, she'll take a phone call over a portal every time (she's not wrong). Verifying a recruiter works the same way as verifying anyone else who wants your personal information: call the company's main line, not a number the recruiter handed you, and ask whether that person actually works there. Check whether the sender's email domain matches the company's real website instead of a free email service. Search the exact wording of the job posting, too - scammers frequently lift real listings word for word and repost them under a different contact.
That's only half the picture, though. Data broker sites quietly reselling your name, address, and employment history are a separate, ongoing cleanup — not something one alert fixes. A fraud alert on your credit file asks lenders to double-check before approving anything in your name; a credit freeze is a stronger version of the same idea. And the same appetite for your information doesn't stop at your inbox, a phone number tied to your name is worth almost as much to someone trying to hijack it through your carrier instead of your email password.
What Actually Happens After You Hand Over an SSN
The moment that actually made this real for me didn't happen at a desk. I got the notification in the parking lot of the Costco on East Independence Boulevard, phone lighting up between loading grocery bags into the trunk - scan complete, zero dark web hits, one new email flagged as unfamiliar. That flagged email lined up almost to the hour with when I'd submitted the fake application. Norton 360 didn't stop anything by itself, and neither did LifeLock the one stretch I paid for it years back, both are early warning lights, not locks on a door.
That part wasn't earned through diligence, either. Years earlier I'd signed up for a free year of monitoring that came bundled with a data-breach settlement, then let it lapse without ever checking whether it had caught anything. It hadn't. Not once. I'd just assumed silence meant nothing was wrong, which is its own kind of risk.
If a scammer had actually gotten my SSN through that fake payroll link, IdentityTheft.gov is the place that matters more than any app's score — it generates the actual affidavit the IRS and Social Security Administration expect to see, and that paperwork carries more weight than a dashboard ever will. Monitoring, identity theft insurance, and restoration service get sold like they're one purchase, and they're not — one watches, one pays out, one does the cleanup. I've written before about comparing McAfee vs LifeLock for monitoring family identity security, if you want the fuller side-by-side on two of the bigger names.
Signs a Remote Posting Isn't What It Claims
A few patterns showed up consistently once I started paying attention. A salary sitting twenty to thirty percent above what similar roles pay in this market, with no clear reason given, is worth a second look instead of excitement. Communication that moves to Telegram, WhatsApp, or Signal instead of staying on email or a scheduling tool is not how reputable US companies run hiring. A job description so vague it never names specific software or local compliance requirements is often a template stretched across a dozen fake postings. Any request to "verify" a driver's license or Social Security number before a face-to-face conversation, video or otherwise, is a hard no regardless of how urgent it sounds. And the sender's email domain tells you almost everything - @gmail.com or @outlook.com instead of the company's own domain is not a minor detail to overlook.
This doesn't require turning into a security hobbyist. It requires one rule, applied the same way every time: no verified human, no personal information, regardless of what stage of the process someone claims you're at. A legitimate hiring manager is never offended by a candidate asking to confirm they're real; the ones who get defensive about it are telling you something useful on their own (marketing copy still loves the word "shield", an actual hiring scam doesn't care what your app is called). The salary was never the actual signal worth watching. Whoever is asking you to "verify" something is.