Most people still think of phishing as an email problem. But more and more scams are starting somewhere else entirely.
We’re seeing an increase in suspicious outreach through LinkedIn, text messages, social media platforms, and other channels where people naturally expect conversations to happen. The message usually doesn’t start with a malicious link or an obvious scam. It starts with a simple question.
“Didn’t we meet at an event?”
“Are you open to new opportunities?”
“I came across your profile and wanted to connect.”
The goal is often to start a conversation and build trust before asking someone to take the next step. That could be clicking a link, downloading a file, sharing information, or moving the conversation to another platform.
Why These Scams Work
Traditional phishing emails often relied on urgency, poor grammar, or obvious red flags.
Recruitment scams are different.
LinkedIn is built around networking. People expect to hear from recruiters, vendors, and business professionals. That makes suspicious messages feel more legitimate because they blend into normal business activity.
In some cases, scammers are even creating fake companies and posting fake job opportunities. Their goal isn’t to hire someone. It’s to collect personal information, gather identity details, or establish credibility with potential victims.
What These Scams Are Really After
Once a scammer starts a conversation, the goal is usually to get the victim to take another step.
That might mean downloading what appears to be a job description, visiting a website that mimics a legitimate login page, or providing personal information during a fake application process.
In some cases, attackers aren’t interested in the job seeker at all. They’re looking for company credentials, access to business systems, or information they can use in future attacks.
That’s why even seemingly harmless conversations deserve a second look when something feels off.
Red Flags to Watch For
One of the first things we tell people to look at is how the recruiter communicates.
If someone claiming to represent a business is using a free email address, that’s worth investigating. The same goes for requests to move conversations to platforms like WhatsApp or Telegram without a clear business reason.
It’s also a good idea to verify the company independently. Visit the company’s website, review the recruiter’s profile, and confirm that the opportunity actually exists before sharing information or downloading files.
That doesn’t automatically mean it’s a scam, but it should prompt additional verification before moving forward.
Awareness Isn’t Enough
Businesses often focus security training on email because that’s traditionally where attacks occurred.
Today, employees need guidance on how the company handles recruiting, vendor outreach, interviews, and business communications. Having clear policies around approved communication channels and hiring processes makes it easier for employees to recognize when something doesn’t fit. That’s why many businesses are incorporating these conversations into their broader cybersecurity strategy.
The goal isn’t to make people suspicious of every message they receive.
It’s to create simple habits that encourage employees to slow down, verify who they’re talking to, and ask questions before taking action.
Need Help Strengthening Security Awareness?
If you’re concerned about how your employees are being targeted through LinkedIn, text messages, or social media, let’s talk. A quick conversation can help identify gaps in your security awareness program, employee training, and overall IT support strategy before a scam turns into a security incident.
