Fake Job Offer Email UK

Variant 1 — Unsolicited “high-paying remote role” cold email

From: A generic-looking corporate address (hr@globalconsultingpartners.com, recruitment@bridgewater-partners[dot]net) or a Gmail / Outlook address claiming to represent a recruiter.

Subject: “Your CV caught our eye — £65k+ remote role” / “Exclusive opportunity matching your profile” / “Direct invitation: remote consultant”

Body: A polished message references the recipient’s LinkedIn / Indeed profile and offers a remote role at a noticeably-high salary (typically £55-90k for a junior-sounding role, or six figures for a senior framing). The interview is brief: a Telegram / WhatsApp chat, sometimes a 10-minute video call. The “onboarding” pivots to either: (a) task-payment platform deposits, (b) requesting full identity documents for “background checks”, (c) asking for a small payment to process visa / tax registration / equipment.

Red flags:

• Unsolicited cold email with a salary above market for the implied seniority. Real recruiters at real firms don’t cold-email entry-level candidates for £75k roles. Salary-to-role mismatch is the diagnostic feature.
• Interview is on Telegram / WhatsApp / Signal rather than via the recruiter’s ATS. Real recruitment uses Zoom / Teams / phone calls scheduled through Calendly / Greenhouse / Workday. Off-corporate-channel interviews are scam-shaped.
• The “company” can’t be cross-checked on Companies House. Real UK employers appear on Companies House with verifiable directors, accounts, address. Scam recruiters either invent companies or impersonate dormant real ones.
• Recruiter email is on a generic domain. Real corporate recruiters use addresses on the employer’s domain (name.surname@reed.co.uk). Gmail / Outlook / ProtonMail addresses are non-corporate.
• Onboarding involves deposits or external task platforms. Same diagnostic test as our LinkedIn scam-message guide: no legitimate UK employer asks staff to deposit money or work via external task platforms outside an HR system.
• Identity-document harvest. Many scams request passport scans, NI number, DOB, address — sometimes framed as “DBS check preparation”. Real DBS checks are initiated by the employer at their own cost via verified providers (uCheck, Disclosure Scotland), not by the candidate uploading documents to an external recruiter portal.

Variant 2 — Fake recruitment-agency email impersonating real UK firm

From: A typosquat of a real UK recruitment agency: careers@reed-uk-careers.com, recruitment@hays-talentpro[dot]net, noreply@adecco-direct[dot]co.uk.

Subject: “Confirm your application for [real-looking job title]” / “Final stage: role at [Real UK firm]”

Body: The email references the recipient’s application to a role that may or may not actually exist (Reed / Hays / Adecco all aggregate roles from many real firms). The link routes to a fake agency portal that captures username + password (allowing the criminal to log into the real agency account if credentials are reused) or harvests full identity documents for “onboarding”.

Red flags:

• The email domain is not the real agency’s. Real Reed: reed.co.uk / @reed.co.uk. Real Hays: hays.co.uk. Real Adecco: adecco.co.uk. Real Michael Page: michaelpage.co.uk. Anything else — especially hyphenated lookalikes — is fake.
• Login link in the email. Real agencies don’t link to login from generic recruitment emails. Type the agency’s real URL into your browser and log in directly. If the application is real, you’ll see it in your candidate dashboard.
• Identity-document request via portal. Real agencies request ID via verified background-check providers (uCheck, Personnel Checks, Disclosure Scotland) sent via separate verification links from the provider’s own domain, not via an agency-branded form on a lookalike domain.
• Application you don’t remember submitting. If the email references “your application to [Role]” and you don’t actually remember applying, the scam relies on you assuming you must have. Real agency emails reference a specific role by ID + date.
• Verify by logging in to the agency’s real portal directly. Real applications are visible in your account. If the application isn’t there, the email is fake.

Variant 3 — Fake executive-assistant / PA / personal-shopper advance-fee scam

From: A “wealthy individual” (often claiming to be a CEO, doctor, athlete, or musician, sometimes specifically named to lend plausibility) — jane.smith.exec.assistant@gmail.com or similar.

Body: The sender claims to need a remote personal assistant / personal shopper / private secretary for £500-£1,000 per week for 3-5 hours of work. The recipient is “perfect”. After a brief “interview” via email, the sender sends a (fake) cheque or bank transfer for £3,000-£5,000, asks the recipient to deposit it, retain a few hundred pounds as the first week’s pay, and forward the rest to a “supplier” / “florist” / “assistant’s sister”. The cheque or transfer eventually bounces / is reversed as fraud, and the forwarded money is gone.

Red flags:

• Unrealistic pay for unspecific work. £500-£1,000 per week for 3-5 hours is far above market for any genuine remote PA role.
• The “principal” is travelling / unavailable for video call. Always “in transit”, “in surgery”, “on tour”. Real high-net-worth principals interview their staff in person or via verified intermediaries.
• The first “task” involves receiving and forwarding money. No legitimate PA role is structured as “deposit my cheque, send me change”. This is the cheque-overpayment scam in PA clothing, identical to the Facebook Marketplace overpayment scam in mechanic.
• UK banks typically take 2-6 working days to confirm a cheque has fully cleared. The scammer relies on the “available balance” appearing in the recipient’s account before the bank confirms the deposit is real. By the time the bank reverses, the forwarded money is unrecoverable.
• Forwarded money goes to crypto / Western Union / a personal account abroad. Untraceable payment routes for the “supplier”.
• Identity-document harvest as part of “onboarding”. Passport / NI / DBS data later used for identity-theft applications.