In this guide
Checking employers and job offers
Cloned job sites and phishing emails that imitate job boards
How fake job boards and phishing emails imitate real job sites, the signs to check before logging in or paying, and where to forward suspicious emails.
How the cloning works
A phishing email imitates a job site or employer: 'Your application needs attention', 'An employer viewed your profile' or 'Confirm your account to keep receiving alerts'. The link leads to a page that looks real but collects your login, card details or uploaded documents. Some fake job boards list real-looking vacancies to gather personal data or charge 'application fees'.
The National Cyber Security Centre and the US Federal Trade Commission both publish guidance on recognising phishing and reporting it.
Signs to check before you log in or pay
| Check | What a warning looks like |
|---|---|
| The web address | Misspellings, extra words or an unexpected ending after the last dot |
| How you arrived | Through a link in an unexpected message rather than your own bookmark |
| Urgency | Your account will be closed or an employer will move on unless you act now |
| What it asks for | Your password to another service, card details for an 'application fee' or documents before any interview |
| Sender address | Does not match the site's real domain |
Illustrative example
A look-alike address
Before
Genuine: careers.example-retail.com
After
Look-alike: careers-example-retail.com.jobs-portal.net
The real site is defined by the end of the address. Everything before the final domain can be chosen by anyone.
Safe habits
Habits that defeat most cloned sites
- Bookmark the job sites and employer portals you use and go through those bookmarks.
- Use a different password for each site, with a password manager.
- Turn on two-step verification where the site offers it.
- Never type a one-time code into a page you reached from a link.
- Do not pay to apply for jobs.
If you entered details on a fake page
- Change the password on the real site and anywhere you reused it.
- If you entered card details, contact your card provider straight away.
- Forward the phishing email: in the UK to report@phishing.gov.uk; in the US, the FTC explains how to report phishing.
- If you uploaded identity documents, follow the guide on what to do if you shared details with a job scammer.
Common questions
Are job alert emails safe to click?
Many are genuine, but you can avoid the risk entirely by opening the job site through your own bookmark and finding the role there.
A site asked for a fee to apply. Is that ever normal?
Paying to apply for an advertised job is a strong warning sign. The US Federal Trade Commission says it is always free to apply for federal jobs and that honest employers never ask you to pay to get a job.
Sources
- NCSC: phishing scamsNational Cyber Security Centre · UK · checked 3 October 2026
- NCSC: report a scam emailNational Cyber Security Centre · UK · checked 3 October 2026
- FTC: how to recognise and avoid phishing scamsUS Federal Trade Commission · US · checked 3 October 2026
- GOV.UK: avoid and report internet scams and phishingGOV.UK · UK · checked 3 October 2026
- FTC: job scamsUS Federal Trade Commission · US · checked 3 October 2026
Put it into practice
See how Luceria helps with thisDrafted with AI assistance and checked against Luceria’s editorial standards. Examples are illustrative, not real people’s results. Spotted something out of date? Tell us.