A short, plain-English explainer for anyone who is job-hunting right now, or whose adult child is — and for the parent who might get asked to front the money for a "home-office equipment package" so a new job can start on Monday.
TL;DR. A recruiter contacts a job seeker on LinkedIn, Indeed, or WhatsApp claiming to hire for a real company. The interview is short, the offer is generous, the start date is next week. Then one of two things happens. The "employer" mails a fake check for $3,000 to $5,000 and asks the new hire to deposit it and wire most of it to an equipment vendor — or the new hire is asked to pay upfront for a training kit. Either way the money is gone, and under federal Reg CC the bank can claw the deposit back a week later. Real employers do not work this way.
How the approach actually starts
It almost never feels like a scam at the front door. The recruiter has a real-looking LinkedIn profile, the right job title at a real Fortune 500 company, and a message that opens with a specific detail from the job seeker's resume. Sometimes the contact is through Indeed, sometimes a cold WhatsApp note saying a hiring manager passed the name along. The BBB describes this opening as deliberately personalized — criminals scrape public resumes so the first message feels like a warm referral (bbb.org/article/news-releases/22087-bbb-tip-employment-scams).
The job title is almost always something a smart non-specialist could plausibly do from home: data-entry assistant, executive assistant, customer-experience associate. A written offer arrives within 48 hours after a single short interview — often WhatsApp video with the camera off. The FTC notes that an offer arriving that fast, with no real interview, is one of the clearest tells (consumer.ftc.gov/articles/job-scams). The new hire then fills out what looks like a real I-9 and W-4, handing over a Social Security number. Even if the rest falls apart here, the identity data has moved.
The fake check piece, explained at the bank's level
A few days after the offer letter, a FedEx envelope arrives with a check for $3,000 to $5,000. The note says it is for the home-office setup, and directs them to deposit it and forward the bulk (often $3,800 of a $4,000 check) to the "preferred equipment vendor" by Zelle, wire, Western Union, or MoneyGram. The vendor is fictional. The receiving account belongs to the scammer or a mule. This is the classic overpayment scam.
Federal banking rules get used against the victim. Under Regulation CC, U.S. banks must make most check deposits available within one to two business days — but availability is not the same as the check clearing. A forged check can be returned by the issuing bank seven, ten, sometimes fourteen days later. The FBI's IC3 has published advisories on this pattern (ic3.gov/Media/Y2023/PSA231121).
Day one, deposit the check, see the funds. Day two, wire the money out. Day eight, the bank claws the deposit back. The wire is gone, the account is overdrawn by the wired amount, and the customer is liable. Once the cash is on a Western Union receipt or in a stranger's Zelle, very little of it reverses.
The upfront-fee variant — when parents get pulled in
The second version skips the check and asks the new hire to pay upfront — usually $400 to $1,200. The pitch is reimbursement on the first paycheck, or a vendor discount available only if the employee orders directly.
This is where a parent often gets pulled in. The adult child has been job-searching for weeks, finally has an offer, and is short the upfront cost. A phone call goes home: could you front me $800 for the work-from-home kit, I will pay you back on the first paycheck. The parent sends a Zelle. The first paycheck never comes, because there is no job. AARP's scams-and-fraud library is the right starting point (aarp.org/money/scams-fraud).
One sentence to remember: a real employer never asks a new hire to pay for equipment before the first day. The laptop ships from corporate IT on the employer's dime. Reimbursement, if it exists, happens after onboarding through expense channels — not as a wire to a vendor the new hire has never heard of.
Recruiter red flags worth knowing by heart
None is proof on its own, but two or three together is the moment to slow down.
The interview runs on WhatsApp or Telegram. Real hiring managers use a corporate Zoom, Teams, or Webex link from a corporate email domain — not a personal WhatsApp account.
The hiring manager's LinkedIn profile is new, thin, or off by one letter. Many scam profiles were spun up in the last three months. Check the email domain: a real recruiter at Pfizer does not use Gmail, and a real recruiter at Salesforce does not use "salesforce-careers.com."
The offer arrives within 48 hours, and money moves before day one. Legitimate hiring does not move that fast. A real employer does not send a check before the start date, does not ask a new hire to pay a vendor, and does not collect a Social Security number outside an HR portal on the company's own systems. Any of those is the moment to verify the recruiter through the company's published careers page — not by replying to the email in hand.
If a check already showed up or money already moved
The first few hours matter more than the next conversation.
Do not deposit the check. If it is still on the kitchen counter, photograph both sides and shred it. Do not call the number on the cover letter — that line rings the scammer.
If the check was already deposited, call the bank's fraud line tonight using the number on the back of the debit card. Tell them it is a suspected forged check from an employment scam, and that no wire has gone out yet if that is still true. The bank can often place a hold before any further movement.
If a wire, Zelle, Western Union, or MoneyGram transfer already went out, call the sending institution within the hour. Bank wires have short reversal windows, sometimes under 24 hours. Zelle reversals are harder but not impossible if reported fast. Western Union and MoneyGram have fraud-recall procedures that work only if the cash has not been picked up. Speed is the only lever.
File a report with the FTC at reportfraud.ftc.gov. Add a filing with the FBI's IC3 at ic3.gov if a wire or large dollar amount left the household. The BBB Scam Tracker also takes employment-scam reports. If a Social Security number went into the fake onboarding, treat it as identity theft too: place a free credit freeze with all three bureaus and file an affidavit at identitytheft.gov.
Where to go next
The Resources library has printables you can keep at hand. The Blog index has more in the same voice — explainers on imposter calls, romance and investment cons, and the first-hour checklist for any household where money has already moved.