Job search · Updated 10 September 2026

How to Spot an AI Job Scam (Before You Reply)

Generative AI deleted the red flag that job-scam advice was built on. The good news is that it could not touch the one that actually matters.

Stop grading the message and start verifying the employer. A scam offer now reads exactly like a real one, because the typos and clumsy grammar that used to give it away cost nothing to fix with a language model. What no amount of polish can change is the shape of the fraud: at some point the scammer needs your money, your bank details or your identity documents, and a genuine employer hiring you needs none of those. So the test is not "does this look professional?" but "which way is value moving, and did I confirm this company through a channel I found myself?"

The red flag that AI deleted

Look at the advice students are still given. The University of Washington's Career & Internship Center page on identifying scam and fraudulent job postings lists "poor spelling and grammar" among its warning signs. That was excellent advice for twenty years, and it appears on almost every university and government checklist you will find.

It no longer does any work. Writing fluent, correctly formatted English is the single thing language models are best at, and it is now free. An official at the Identity Theft Resource Center, quoted in the Better Business Bureau's 2026 employment scams update, put the change bluntly: "It is so much easier to do using AI." The BBB describes fraudsters using it to spin up fake websites, applications and other trappings of a real company at speed.

Every text-level signal is now cheap to fake — the grammar, the tone, the tidy offer letter, the careers site that looks plausible at a glance. The volume has moved accordingly. The FTC's job scams page reports that scam reports "have tripled from 2020 to 2024," with losses climbing from $90 million to $501 million. The BBB counted nearly 50,000 employment scam reports to its Scam Tracker across three years, with reports doubling in 2025.

The rule that still works: watch which way value moves

Every scam variant on record has the same structural requirement. Before you have done any real paid work, something of value has to travel from you. Nothing about AI changes that, because it is how the fraud makes money.

The FTC states the principle twice, in two sentences worth memorising. "Honest employers, including the federal government, will never ask you to pay to get a job." And: "No honest potential employer will ever send you a check to deposit and then tell you to send on part of the money."

The FTC names reshipping scams, task scams and boss imposter scams among the current forms, and one more line covers the pitch itself: "If someone offers you a job and claims that you can make a lot of money in a short period of time with little work, that's almost certainly a scam." Unlike grammar, an implausible wage is a claim about the world, and a scammer cannot make it plausible by writing it better.

Why "the check cleared" means nothing

This is the mechanism that catches careful people. From the FTC's guide to fake check scams: "By law, banks have to make deposited funds available quickly. Even if you see the funds in your account, that doesn't mean it's a good check. Fake checks can take weeks to be discovered and untangled."

Availability is not clearance. You watch the money appear, reasonably conclude the check was real, and forward the portion you were told to forward. Weeks later it fails, and as the FTC puts it: "By that time, the scammer has any money you sent, and you're stuck paying the money back to the bank." Sent by wire, it settled in minutes and is effectively unrecoverable.

The campus version, which is more convincing than you expect

Scam offers aimed at students are tuned to the one thing you do trust: a university address.

The University of Hawaii's job offer scam page lists the lookalike domains used against its students — "@havvaii.edu, @uhhawaii.edu, @manoauniversity.edu" — the kind of substitution you read straight past. It describes the pattern: emails impersonating the university, a phone number so you respond by text or call, and requests for "detailed personal and/or financial information without asking for an interview."

Worse, the sender can be entirely genuine. UW warns you may "receive a job offer from a trusted email address, such as an @uw.edu email address," and adds: "do not immediately trust an employment offer in your inbox." Compromised student accounts send the next wave — Hawaii notes offers asking students to "provide access to University email, or get users to send more scam emails." A .edu sender is not verification.

A five-minute check before you reply

1. Find the company yourself. Open a new tab and search the name. Never navigate through a link, phone number or address supplied in the message — that is the whole trick.
2. Run the FTC search. Verbatim from their advice: "Look up the name of the company or the person who's hiring you, plus the words 'scam,' 'review,' or 'complaint.'"
3. Check the posting exists on the employer's own careers page. A real opening is almost always listed where the company controls the page.
4. Compare the domain character by character. Not the display name, which is trivially spoofed — the full address, read slowly.
5. Make contact through the channel you found. Ask the company's published number or HR address whether the role and the recruiter are real. One email ends the question.
6. Send it to your career centre. UW's own advice is to "run the offer by us," and they have almost certainly seen that exact message.
7. Hold your documents back. No Social Security number, bank details or passport scan before a real interview and an offer you have independently confirmed.

Using AI to check a job — and the prompt that fails

The obvious move is to paste the message into a chatbot and ask "is this a scam?" Don't rely on it. The model can only read the message, so it grades tone, grammar and formatting — precisely the signal that stopped working. A polished scam gets a clean bill of health, a blunt email from a real recruiter gets flagged, and the model may state confidently that a company exists when it has no way to know. Worse, a reassuring answer can talk you out of the five-minute check you were about to do.

Never paste the sensitive parts. Your Social Security number, bank details or document scans should not go into a chatbot at all — most retain conversations by default, which is the reasoning behind our privacy checklist for uploading class materials.

What AI is genuinely good at here is turning a persuasive message into a boring list of things to verify. Use these three.

1. The claim extractor. Converts the offer into a checklist instead of a verdict.

Below is a job message I received. I have removed my personal details.

Do NOT tell me whether it is a scam. Do not reassure me.

1. List every factual claim it makes: company name, address, the person
   and their title, the role, the pay, the process, any deadline.
2. For each claim, tell me exactly how I could verify it using a source
   the message did not give me.
3. List anything a normal employer would have included at this stage
   that is missing here.

Format as a checklist I can tick off.

[paste the message]

2. The money-direction audit. One question, the one that matters.

Here is a job message. Ignore the writing quality entirely - assume it
is well written, because that tells us nothing.

Answer only this: at any point in what is being described, am I asked to
send money, deposit a check, buy something, forward a package, share
banking or identity details, or move a conversation to a messaging app?

Quote the exact sentence for each one you find. If there are none, say
"no value leaves you yet" and stop.

[paste the message]

3. The verification email. The step people skip because drafting it feels awkward.

Draft a short, polite email to a company's HR address asking them to
confirm whether a job offer I received is genuine, and whether the named
person works there.

Keep it under 120 words, neutral in tone, and do not apologise or sound
suspicious. I will send it to an address I found on the company website
myself, not one from the message.

Role: [title]. Person named: [name]. How they contacted me: [channel].

The discipline is the same as anywhere else you rely on a model: good research assistant, bad authority. That is the standard in our AI hallucination checklist — treat the output as a list of things to confirm, never as the confirmation.

If you have already replied

• Stop and send nothing. Do not deposit the check, buy the equipment, or forward money. Walking away costs nothing if the offer was real, because a real employer will still be there tomorrow.
• If money has moved, call your bank now. UW's guidance is to contact your bank or card company immediately to close the account, and to contact police. Speed matters with wires and card payments.
• Report it to the FTC at reportfraud.ftc.gov, the FBI's Internet Crime Complaint Center, and BBB Scam Tracker.
• If you gave up a university login, change the password and tell campus IT — that account is about to be used against other students.
• If you gave your Social Security number, work through identitytheft.gov, which generates a recovery plan.

One thing not to do: blame yourself. These messages are written by people who send millions and keep what works, and this generation is built to survive exactly the checklist you were taught.

Where this fits in the rest of the job search

• Being findable raises your exposure. A profile written to match recruiter searches attracts real recruiters and fake ones — see writing a LinkedIn profile AI search finds.
• You contacted them first. Outreach you initiate to a company you chose is the safest channel in the search: drafting internship outreach emails.
• Know what a real process looks like. The best defence is a mental model of normal hiring, from AI resume screening through behavioural interviews to what employers permit in the interview itself.

FAQ

Can AI tell me whether a job offer is a scam?

Not reliably, because it can only read the message. A chatbot grades tone, grammar and formatting — exactly the signal generative AI erased — so a polished scam scores well and a blunt real recruiter gets flagged. It also has no way to know whether a company exists. Use AI to list what needs checking and draft the email that checks it, then verify the facts yourself.

The email came from a .edu address, so is it safe?

No. The University of Washington warns students they may get an offer from a trusted address such as an @uw.edu one and says "do not immediately trust an employment offer in your inbox," because real accounts get compromised. The University of Hawaii lists lookalike domains used against its students, including @havvaii.edu and @uhhawaii.edu. Compare the full address character by character and verify through the employer.

My bank said the check cleared. Is the money mine?

No. The FTC says banks must make deposited funds available quickly by law, that seeing them "doesn't mean it's a good check," and that fake checks can take weeks to be discovered. If you forward part of the money and the check later fails, you are "stuck paying the money back to the bank." Availability is not clearance.

What are task scams and why do students fall for them?

They arrive as flexible online work, usually by text or a messaging app, paying you to like, follow and subscribe to videos or leave ratings. The BBB describes "levels" to complete, such as a group of 40 tasks, with small real payments early to build credibility. The trap comes when withdrawing your earnings requires depositing your own money first. BBB reports the median task scam loss reached $2,300 in 2025.

Bottom line

Judge the transaction, not the prose. Fluent writing, a clean logo and a convincing careers page now cost a scammer nothing, so they carry no information about whether an employer is real. Two habits replace the entire old checklist: value never leaves you before you have been paid for real work, and you confirm the employer through a channel you found yourself. Both take five minutes, and neither cares how good the email was.