A message sounds like the perfect career move: flexible working hours, above-average pay and a quick start. The supposed recruiter knows details from the CV, writes without errors and invites you to a video call at short notice. Exactly this professionalism is no longer sufficient proof of authenticity today. Generative AI can personalize messages, imitate voices, alter images and provide convincing content for fake recruitment pages.
Who "Detect AI job scams will, should therefore not only look for typos or an odd video image. What is crucial is whether the employer, the position, the contact person and the process can be confirmed via a second channel chosen by the applicant. This guide shows applicants in Austria which warning signs matter, when which data are plausible, and what to do immediately after a payment or data disclosure.
How generative AI is changing job scams
The core of many fraud models is not new: criminals entice with an attractive job, build trust and then demand money, data or a dangerous action. What is new is the quality, speed and adaptability of the deception. According to EuropolAI-generated deepfakes are now part of the cybercrime toolbox. Language models can tailor social engineering more closely to language, cultural context, and personal information.
As a result, some familiar warning signs lose their significance. A grammatically correct email can still be fake. A professional profile picture can be synthetic or stolen. A familiar-sounding voice does not prove that the claimed person is actually speaking. Even an elaborately designed website is not evidence of a legitimate recruitment agency: Watchlist Internet is currently warning about fake recruitment agencies that imitate real companies with look-alike domains and professional web design.
That does not mean that every unusual call is a live deepfake. Classic phishing, stolen identities, spoofed phone numbers, and pressure via messengers remain common methods. The right response is therefore neither panic nor an immediate accusation. It is: interrupt the conversation, do not provide any further data, and verify the identity independently.
Five typical goals behind a fake job
1. Upfront payments and task scams
Victims are first asked to complete small online tasks and may even receive a small payout. Afterwards, payments are requested to unlock larger commissions, packages, or supposedly blocked balances. The amounts increase as time pressure and psychological pressure build. One from the \"Tyrol Chamber of Labour a documented current case began with a supposedly simple side income via TikTok and ended within a day with a loss of 4,000 euros.
2. Identity theft
An ID photo, proof of residence, date of birth, social security number, and bank details together make up a valuable identity package. The Austrian Federal Criminal Police Office points out that criminals can use copies of IDs to open accounts, conclude contracts, take out loans, or commit crimes under a false name, among other things.
3. Access data and accounts
A supposed applicant portal requests a password that those affected also use elsewhere. A link leads to a fake Microsoft, Google, or bank login. Or a supposed technical check requests remote maintenance software. The goal is not the CV, but access to email, cloud, bank account, or existing work equipment.
4. Malware
The invitation to the interview may include an executable file, an Office document with macros, or an unfamiliar video program. Even a purported aptitude test can download malware. Reputable companies clearly explain the systems they use and provide a verifiable contact for technical questions. A spontaneous installation under time pressure is not a normal part of an application process.
5. Money laundering and goods forwarding
Activities in which private accounts are asked to receive and forward payments, or packages are to be sent to changing addresses, are particularly risky. The supposed task may sound like payment processing, quality control, or logistics. In reality, applicants can be misused as financial agents or as intermediaries for fraudulent transactions.
Twelve warning signs applicants should take seriously
- Unsolicited initial contact via messenger: The entire communication should immediately take place via WhatsApp, Telegram, or a similar closed channel.
- Unusually high pay for minimal work: Wenige Minuten Arbeit pro Tag sollen ein Vollzeitgehalt oder garantierte Provisionen bringen.
- Sofortige Zusage: Es gibt weder ein plausibles Gespräch noch eine fachliche Prüfung, trotzdem soll der Vertrag umgehend unterschrieben werden.
- Ähnliche, aber falsche Domain: Ein Buchstabe, Bindestrich oder Domainende weicht von der offiziellen Firmenadresse ab.
- Freie Mailadresse: Eine vermeintliche Konzernrecruiterin schreibt ausschließlich von einem beliebigen Gratis-Mailkonto.
- Kontaktperson nicht verifizierbar: Neither the company website nor the official switchboard can confirm the name or the assignment.
- Position exists only in the message: Das Inserat fehlt auf der Karriereseite und lässt sich auch über seriöse Jobplattformen nicht nachvollziehen.
- Vorauszahlung: Für Schulung, Ausrüstung, Freischaltung, Versicherung, Kryptowährung oder eine Vermittlungsgebühr soll zuerst Geld fließen.
- Sensible Daten zu früh: Ausweis, Bankverbindung oder Sozialversicherungsnummer werden verlangt, bevor Arbeitgeber und Vertrag verifiziert sind.
- Unbekannte Software: Für Interview oder Test soll eine Datei außerhalb eines etablierten App-Stores oder offiziellen Anbieterportals installiert werden.
- Druck und Geheimhaltung:The opportunity will expire within minutes; family, the bank or your previous employer should not find out.
- Inconsistencies:Company name, address, phone number, contracting party, salary or place of work do not match.
A single signal does not necessarily prove fraud. However, multiple anomalies or a demand for money warrant an immediate stop.Europol describes exactly this typical chain: attractive ads on social or professional platforms, subsequent shift to closed messengers and finally financial or personal exploitation.
Deepfake or just a bad connection?
Unnatural lip movements, changing lighting, rigid facial expressions, incorrect reflections or a voice without matching room acoustics can be noticeable. However, they are not a reliable test. Compression, virtual backgrounds, poor cameras and unstable connections produce similar effects. Conversely, high-quality manipulations can be very convincing.
The Austrian Rundfunk und Telekom Regulierungs-GmbH emphasizes that advanced deepfakes can be difficult for average users to detect and that no freely available detection tool is 100% reliable. Also ENISA classifies deepfakes and abused AI chatbots as a means for realistic, targeted social-engineering attacks.
Therefore, don't primarily check the face, but the identity and the process. End the call courteously and call back using the company's main number you looked up yourself. Ask the switchboard to connect you to the human resources department. A number shown on the display or a link from the same message is not an independent channel.
The seven-minute check before the next step
- Search for the company yourself: Do not open the link that was sent; instead type the company name and web address yourself.
- Compare the domain character by character: Check the sender's domain, careers page and legal notice. Watch for swapped letters and unusual endings.
- Confirm the contact person independently: Call the official headquarters or use a contact form on the real website.
- Verify the position: Search for the ad on the company website, at the AMS or on the platform where it was allegedly published.
- Cross-check company data: The public "WKO Firmen A-Z hilft bei der Prüfung von Name, Standort und Kontaktdaten österreichischer Unternehmen.
- Check the process for plausibility: Fragen Sie nach Abteilung, Vorgesetzten, Tätigkeitsort, Auswahlstufen und schriftlichem Vertrag. Antworten müssen zusammenpassen.
- Set a payment limit: Zahlen Sie nichts, um einen Job, ein Guthaben oder eine Interviewstufe freizuschalten.
Direct contact from recruiters is generally normal. Our guide to Active Sourcing explains how legitimate outreach typically progresses into a transparent selection process. A genuine offer should also be systematically verified before acceptance; for that, the Job Offer Checklist.
Which data are appropriate at which stage of the application process
Initial contact and application
Name, professional contact details, CV and relevant proof of qualifications are usually sufficient. Remove personal details from certificates that are not needed if they are irrelevant to the selection process. At this stage, an employer usually does not need online banking access, PINs, TANs or credit card details.
After a verified offer
For contract and payroll, additional information becomes plausible later: address, date of birth, bank account details and social security information. The timing and method of transmission are decisive. First confirm the employer, contact person and contracting party. Then send sensitive documents via a traceable, secure channel and not in a spontaneous messenger chat.
If a copy of an ID is really necessary
The Federal Criminal Police Office recommends marking a required copy with a watermark such as "COPY", recording the recipient, purpose and date, and blacking out information that is not required. This reduces its value for misuse. Also clarify why the copy is needed, who will process it, and how it will be transmitted securely.
Wording for a gentle verification
Message to the contact person: „Thank you for the offer. For security reasons, I verify new recruiting contacts through the company's official headquarters. Please provide your department, extension number, and the job reference number. I will then get back to you via the publicly listed company contact.“
Call to the head office: „I was contacted by a person named … regarding the position …. Can you confirm that this person is recruiting for your company or on your behalf and that the mentioned position is currently open?“
If a payment is requested: „I do not make advance payments during the application process and I will not provide any financial account access. Please send me the complete company and contract information from your verified corporate address.“
Three real-world cases: How the decision is made
Case 1: The perfect email from the almost-right domain
An applicant receives a detailed message about her profile. The company's name and logo appear correct, but the domain contains an extra hyphen. The real careers page does not list the position. The company's headquarters knows neither the sender nor the assignment. Outcome: do not reply via the link provided; save the message and headers; inform the company and the platform.
Case 2: The side job with increasing deposits
A contact promises commissions for reviews or clicks. After initial tasks, the applicant is asked to deposit their own money to unlock a higher level and a payout. The balance is just a number in an unfamiliar interface. Result: stop immediately, don't pay anything more, secure documentation and contact your bank or payment service. The prospect of recouping a previous loss with the next payment is exactly what keeps the scheme going.
Case 3: Suspicious video interview
The person on the call appears delayed, answers follow-up questions evasively and even demands a photo of an ID during the call. A technical fault is possible, but the process is not plausible. The applicant ends the conversation without accusation, looks up the company’s real phone number and has the contact person and the position verified. Result: it’s not the image quality that matters, but the independent confirmation.
What to do if money, data, or software has already been transmitted?
- Contact your payment provider immediately: Inform your bank, card issuer or payment service and ask about blocking, recalling the payment or other security measures.
- Secure evidence: Save the listing, URLs, emails, chat logs, phone numbers, profiles, payment receipts and file names. Do not delete the chat prematurely.
- Secure access: Change affected and reused passwords from a clean device. Enable multi-factor authentication and check active sessions.
- Isolate the device: Disconnect any device with suspicious software from the network and have it inspected by a professional. Do not allow any further remote access.
- Notify the abused organization: Report the case to the legitimate company and the platform. This helps warn others who may be affected.
- File a report: Contact the police with the secured documents. In cases of ID misuse, you should also ask the responsible document authority about the next steps.
- Expect follow-up attempts: After a scam, alleged recovery services, authorities, or lawyers may demand money again. Verify these contacts independently.
The Arbeiterkammer Oberösterreich warns explicitly against fake jobs that already request bank details, ID copies, or the social security number during the supposed application process. Our general Phishing Guide supplements practical protective measures for email accounts and suspicious links.
FAQ on fake recruiters and AI job scams
Is a recruiter allowed to contact you via LinkedIn or WhatsApp?
Yes, the channel alone does not prove fraud. However, a reputable contact will accept an independent verification, provide a traceable employer, assignment, and position, and will not demand payment. Switch to a confirmed company channel for sensitive steps.
Can I trust a video interview if the person looks real?
Appearance is only one indicator. Verify the identity via the official company headquarters, the email domain, and a traceable job posting. This exact combination protects you even if a deepfake is not visually detectable.
Do I have to pay for work equipment in advance?
Spontaneous advance payment to a recruiter, private account, crypto wallet, or unknown merchant is a strong warning sign. Clarify equipment and costs in a verified contract. Do not let yourself be pressured by a discount that is allegedly about to expire.
What is the most important single check point?
Independent re-verification via an official contact you have researched yourself. It breaks through the closed information world of the fraudster: the message, website, phone number, and video call no longer all come from the same source.
Conclusion: It is not the perfect image, but the second channel that protects you.
AI makes fake recruiters more convincing, but it doesn't make applicants defenseless. Those who verify the employer, the position and the contact person via official channels, refrain from making advance payments and only share sensitive data after a verified offer remove the basis for most fraud schemes. Save the seven-minute check and apply it especially to unexpected, unusually well-paid or highly accelerated offers.
