A Recruiter Texted You About a Remote Job. Here's How to Tell If It's a Scam

A message arrives. It is short, it is friendly, and it is from a recruiter at a company you have actually heard of. There is a job — remote, flexible, no experience needed — and there is a number attached to it: a daily rate, or a weekly one. There is no job description. All you have to do is reply.

This is not our usual subject, so it is worth saying why it sits on a computer-repair site. Job scams reach people exactly the way the fake-toll text and the "Microsoft security alert" pop-up do — on a device, in an app, through a link — and they leave a similar mess behind. The money side ends up with a bank. What is left on our bench is a laptop that got "set up for onboarding": remote-control software installed, a browser full of saved passwords, and an email account somebody else can now read. That half of it is our trade, and almost nobody writes about it.

So this is the version we would give you across the counter. What the current wave actually looks like, how it takes money from people who are being careful, the handful of sentences from the FTC and the FBI that are genuinely worth memorising, and the free checks that settle the question before you have lost anything. Where a point belongs to another guide of ours, we link it instead of repeating it.

The new twist is that the hook is the reply itself

On April 30, 2026 the FTC published a consumer alert titled "That job offer text is probably a scam." Its opening describes the shape of it in six words: "fake recruiters offering fake jobs, stealing real money."

The pattern the alert sets out is specific enough to use. The fake recruiters "claim to be with legit companies you might know" and say they are hiring for work you can do from home — the FTC gives "online assessor," or just as often a plain "remote position," as the examples. And they "often mention pay (sometimes daily or weekly rates) without any details on the actual job."

That inversion is the most reliable tell in the whole con, and it is worth understanding rather than just memorising. In a real hiring process the duties arrive before the rate, because the rate is derived from the duties — somebody had to decide what the work is before finance could decide what it pays. A message that leads with money and has nothing to say about the job has that backwards, which means the money is the product being advertised, not the compensation for anything.

Then comes the part the FTC flagged as new. Instead of asking you to click a link, they ask you to reply with "YES" or "INTERESTED." The alert's instruction is blunt: "Don't do this, no matter how "professional" the graphics or message looks and sounds. They want you to engage so they can scam you."

This twist is cleverer than it looks, because it is aimed squarely at the advice everyone has already learned. Years of warnings have trained people not to tap links in unexpected texts — so the hook was redesigned to need no link at all. The requested action looks like the most harmless thing in the world: one word, no attachment, no website. What it actually does is confirm that a real person reads that number, which is the thing being purchased. We cover why any reply to a stranger makes things worse — and why "reply STOP" is the same trap in a different costume — in our guide to spam texts; the short version is that silence is the only reply that gives them nothing.

The gamified job: the balance goes up while the money goes out

The biggest single category inside job scams has a name that tells you most of what you need: the FTC calls them "Task scams — or gamified job scams." The framing line from the FTC's own research is the best one-sentence test anyone has written for this: "if the work feels more like an online game than an actual job, you can bet it's a scam."

The work is deliberately trivial — the FTC describes "simple repetitive tasks such as liking videos or rating product images," and the FBI's version is "rating restaurants or "optimizing" a service by repeatedly clicking a button." You do it inside an app or web platform that, in the FTC's words, "creates the illusion you're racking up commissions with every click." The game design is explicit: "Tasks are often assigned in sets of forty, with the promise of leveling up once you complete your set," and you might even get "a so-called double task that earns a bigger commission."

Two details make this work on people who would describe themselves as sceptical. The first is that you really do get paid, at first: "Many people report getting small payouts at first, which give them greater trust in the system," and the FTC's later alert puts a figure on it — "usually $5 to $20." That is not generosity, it is the cheapest possible purchase of your belief, and it is the moment the con stops being a story and becomes evidence.

The second is the turn. At some point you are told you must deposit your own money to unlock the next set of tasks and to withdraw the earnings the app is showing you — "usually in crypto." And the earnings are not real. The FBI's description is the flattest statement of it: "Scammers direct victims to a fake interface, which shows victims are earning money, though none of it is available to them to cash out." The app is not a workplace with a payment problem. The app is the entire scam, and the balance in it is a number somebody typed.

Even the hesitation is anticipated. The FTC notes that "if you hesitate to deposit money, scammers will often invite you to a group chat where newcomers hear supposed success stories from (fake) experienced workers." If you ever find yourself in a chat where strangers are reassuring you about withdrawing money, every one of them may be on the other side of the table.

Two buzzwords are common enough to function as keywords: the FTC lists "product boosting" and "app optimization," and the FBI makes it a formal red flag — "The job description uses the term "optimization" and involves relatively simple tasks." If a job offer uses the word optimization and cannot tell you what you would be optimising, you already have your answer.

What this looked like the last time the FTC counted it

The numbers matter here mostly for scale, so it is worth being precise about where they come from and how old they are. The FTC's data spotlight "Paying to get paid: gamified job scams drive record losses" was published on December 12, 2024, and its figures come from fraud reports to the agency's Consumer Sentinel Network classified as job scams and employment agencies.

Reported losses by year, from the spotlight's own footnote: $90 million in 2020, $131 million in 2021, $179 million in 2022, $286 million in 2023, and $223 million in 2024 through June alone. The FTC's own summary of the trend is that reported losses "increased more than threefold from 2020 to 2023" — and then the first half of 2024, on its own, came to about two and a half times the whole of 2020. The spotlight adds the caveat that belongs with every fraud statistic: "Since the vast majority of frauds are not reported, this likely reflects only a fraction of the actual harm."

The task-scam share is the part that shows a genuinely new thing arriving rather than an old thing growing. Working from hand-coded samples of job-scam reports, the FTC identified no task scams at all in its 2020 sample. Then 0.6% in 2021, 1.6% in 2022, 5.6% in 2023 — and 38.8% in the first half of 2024. In headcount that is roughly 20,000 people in six months, against about 5,000 in the whole of 2023.

Payment method moved with it. Crypto losses to job scams ran at about $41 million in the first half of 2024 against about $21 million in all of 2023, and the FTC's conclusion is worth keeping in mind as a filter of its own: "People now report losing far more money to job scams using cryptocurrency than any other method of payment." A job that needs you to open a crypto account is not a job that has a payroll department.

The FBI red flag nobody thinks to check: nobody asked for references

On June 4, 2024 the FBI's Internet Crime Complaint Center published a short public service announcement on work-from-home scams, Alert Number I-060424-PSA. It lists three red flags, and the first two are the ones you would expect: you are "directed to make cryptocurrency payments to your employer as part of a job," and the job description "uses the term "optimization" and involves relatively simple tasks."

The third is the one we have never seen anyone mention, and it is the best item on the page: "The scammer does not require any references as part of the hiring process."

Sit with how strange that is as a warning sign. Every other red flag in every scam guide is about something unpleasant being added — a demand, a threat, a deadline. This one is about something pleasant being absent. Real hiring is full of friction: references, an interview with a named person, a background check, tax paperwork, an IT account that has to be provisioned by somebody. All of it is tedious and all of it is load-bearing, because it is the organisation satisfying itself that you are real.

A process with none of that friction is not an unusually efficient employer. It is an organisation that has no interest in whether you can do the work, because there is no work. The frictionlessness is not a perk thrown in to attract you — it is a direct consequence of the job not existing, and it is visible from the outside before any money has moved.

The check that clears, and then does not

The second money mechanic is older than task scams and still catches people, because it turns on a banking rule that almost nobody has been told about. In the April 2026 alert's wording, they "might say they have a check you need to deposit — and then ask you to send them money back."

The job-shaped version usually arrives after you have been "hired." You need equipment to work from home, so your new employer sends a check to cover it and asks you to pay their approved vendor for the laptop, the headset, or the software. The FTC's page on fake checks lists exactly this excuse among the standard ones — money supposedly needed "to buy supplies for a job."

Here is the rule that makes it work, quoted because the exact wording matters: "By law, banks have to make deposited funds available quickly. Even if you see the funds in your account, that doesn't mean it's a good check." And then the consequence: "Fake checks can take weeks to be discovered and untangled. By that time, the scammer has any money you sent, and you're stuck paying the money back to the bank."

Read those two sentences together, because between them sits the whole trap. Seeing the money in your balance feels like proof the check was good — it is the most natural possible inference, and it is simply wrong. Availability is a deadline the bank has to meet, not a verdict it has reached. Weeks later the check is reversed, the money you forwarded is gone, and the shortfall is yours. The FTC is also clear that spotting the forgery yourself is not a realistic plan: "These scams work because fake checks generally look just like real checks, even to bank employees."

Two rules cover every version of this. The FTC's: "Never use money from a check to send gift cards, money orders, cryptocurrency, or to wire money to anyone who asks you to." And ours, which is about how employment actually works: a real employer buys its own equipment, or ships it to you, or reimburses you through payroll after you have been paid. No real company funds your equipment by sending you a check and naming the vendor you must forward it to. That instruction is not unusual accounting. It is the scam, stated out loud.

When the job is your address: the reshipping version

A third variant deserves its own mention because the money never passes through your hands at all, which makes it much harder to recognise as theft. In a consumer alert on December 3, 2025, the FTC described work-from-home offers with "a fancy title like "delivery operations specialist" or "quality control manager"" where the entire job is to "receive shipments, repackage them, and send them on to a new address."

What the job description leaves out is whose goods they are. Scammers "sometimes lie about being affiliated with familiar companies like Amazon or FedEx," then "use stolen credit card or bank information to send you high-dollar items (like brand new electronics)." Your role is to launder the trail: the FTC says your "job" is to "throw out the original box and receipt and send those stolen goods on to another address, often an international one, where it can't be tracked."

That instruction is the tell, and it is a gift, because it makes no sense in any legitimate business. Boxes and receipts are how real logistics works — they are the proof of what shipped, to whom, under what warranty. A company that pays you to destroy its own paperwork is not doing quality control. The FTC's verdict is a single sentence and it admits no exceptions: "Reshipping goods is never a real job."

This is the variant most likely to reach us in person, because the parcels contain computers. If brand-new electronics are arriving at your address for a job and you have been told to bin the receipt, do not unbox them and do not forward them. And note the second injury the FTC flags: if you shared "a bank account or Social Security number or a photocopy of your ID," you may have "an identity theft problem" on top of the goods. Reshipping is reported to the FTC and also to the U.S. Postal Inspection Service, at uspis.gov/report.

"Onboarding" that wants your computer — the part that reaches our bench

Everything above is about money. This section is about the machine, and it is the part of a job scam that outlives the financial loss, because software and credentials stay behind after the bank has finished its investigation. The FBI's own protection advice points straight at it: "Be cautious of unsolicited job offer messages and avoid clicking on links, downloading files, or opening attachments in these messages."

Five rules, and they hold no matter which variant you are looking at or how common each one turns out to be. First: no legitimate interview or onboarding step requires you to install remote-control software on your personal computer. If somebody wants screen-sharing access to "set up your workstation," "verify your equipment," or "configure your work profile," stop there. That is the identical mechanic to the tech-support scam we write about elsewhere — a stranger with a plausible reason to drive your machine — and giving it a job title does not change what it is.

Second: an "onboarding app," "assessment client" or "company portal" sent to you as a file through a chat app is none of those things. Real employer software lives behind a login on the company's own domain, and you normally get to it after paperwork, with an account somebody provisioned for you. If your first contact with a company's "systems" is an installer in a WhatsApp thread, that is not an early start — it is the payload. And "it looked official" is not evidence: we have written separately about how convincingly fake download pages are now built, including that they often serve the genuine file for months before swapping it.

Third: never give an employer the password to your existing email account. There is no version of onboarding that needs it. A real employer creates you a new mailbox on its own domain; it does not log into your personal one. If you have already handed it over, treat it as a hacked account and work through the cleanup properly — and do not skip the forwarding-rule step, which is the part people miss and the reason a password change on its own so often fails to lock anyone out.

Fourth: be slow with documents. Social Security number, date of birth, bank details, a photo of your driving licence — a real employer collects those after a written offer, through a named payroll provider, and generally not before you have spoken to a human who demonstrably works there. If you have already sent them, the FTC's own pointer is IdentityTheft.gov/steps, which exists precisely to get ahead of this "before identity theft happens."

Fifth, and this is the one we most often have to say twice: if something was installed, uninstalling it is not cleanup. Assume anything saved in that browser is gone — passwords, autofill, card details, session cookies that can keep somebody signed in without needing the password at all. Change the important passwords from a different device, not the affected one, turn on two-factor authentication where it is offered, and run a proper scan. Our virus-scanning guide covers doing that with the tools already on the machine.

Four free checks that settle it before you reply

None of these costs anything, and together they resolve essentially every case. One: go to the company's own careers page yourself — type the domain into the address bar rather than following anything in the message — and look for the role. If the job is not listed where the company lists its jobs, there is no job. Two: phone the company's published main number, the one on its real website, and ask whether the person who contacted you works there. A genuine recruiter will not mind this in the slightest.

Three, in the FTC's own words: "Search the employer online. Look up the name of the company or the person who's hiring you, plus the words "scam," "review," or "complaint." If others say they've been scammed by that company or person, walk away." Four, and this is the one people skip because it feels unnecessary: "Talk with someone you trust. Describe the offer to them." The FTC notes why it works beyond the second opinion — it "helps give you vital time to think about the offer." The pressure to decide now is a feature of the scam, so spending a day is itself a test.

Underneath all four sits a single filter that needs no research at all, and it is the FTC's: "Never pay to get paid or get a job. That's a sure sign of a scam." Any direction of money from you toward the employer — a deposit to unlock tasks, a fee for training, equipment you must fund, a check to forward — ends the conversation. Employment is money moving the other way. The same goes for the FTC's third rule, which is about legality rather than just risk: "Don't trust anyone who says they'll pay you to give a positive rating or like things online. No honest company will do that."

One honest caveat on the FTC's line that "Real employers will never contact you that way." Real recruiters do occasionally text, and plenty of legitimate hiring now starts on LinkedIn or by SMS, so taken literally the rule will sometimes be unfair to a genuine message. It is still the right rule to run, because following it costs you nothing: a real recruiter at a real company is also findable on that company's own careers page and reachable on its published number. So treat the message as a prompt to go and look something up — never as the thing you act on directly. Nothing legitimate is lost by verifying, and that is what makes it a free test.

If you already replied, downloaded, or deposited

In order, and none of it requires paying anybody. Stop sending money, and do not make the one last deposit the app is asking for — there is no amount that releases a balance that was never real. If a check is involved, tell your bank now, before you spend or forward any of it, and say plainly that you think it may be a fake check from a job offer; that conversation is much better had on day two than on week six.

If you shared personal details, start at IdentityTheft.gov/steps. If a device was involved, treat it as compromised rather than merely cluttered: change your important passwords from a different device, check your email account for forwarding rules and filters you did not create, turn on two-factor authentication, and scan the machine.

Then report it, because the reporting is what builds the data the warnings above are made of. Scams go to the FTC at ReportFraud.ftc.gov. The FBI takes them at ic3.gov, and its PSA specifically asks victims to "provide any transaction information associated with the scam," so gather the payment records before you file. Reshipping also goes to the U.S. Postal Inspection Service at uspis.gov/report.

Finally, expect a second wave, and know in advance what it is. People who have lost money to a crypto-based job scam are a known target list for recovery scams, and the FBI puts the warning in its own protection advice: "Do not pay for services that claim to be able to recover any lost cryptocurrency funds." We have a whole guide on that follow-up con, because it is often the one that takes more than the original.

And if you fell for it, the design is the reason, not your judgement. A con that pays you $5 to $20 up front, shows you a rising balance in a real-looking app, and seats you in a chat room of enthusiastic colleagues has been built specifically to defeat careful people. The small payout is not a lucky break in a scam; it is the scam's advertising budget, spent on you.

And when you really are hired, the scam changes shape

Worth knowing, because the job-seeking phase is not the only one with a con attached. Once you have a genuine job at a genuine employer, the attack moves to the payroll system — and the version we see most is a single edited field in a benefits portal you log into twice a year, which quietly redirects your wages and shows no symptom until payday. We have written that one up separately, including the one line on your pay stub that would have caught it.

In the meantime: if you want a second opinion on a message before you answer it, or you want a machine looked over after an "onboarding" step you have since thought better of, that is a completely normal thing to bring to us. We sort out this kind of cleanup — remote-access software that should not be there, credentials that need rotating, mailboxes with rules somebody else added — across Southern California and the Coachella Valley, in person or by remote support. And we would much rather talk you out of installing something than clean up after it.