Employment scams are increasingly being used to target job seekers, with the FBI and LinkedIn joining forces to educate applicants about fraudulent job opportunities and the warning signs of potential exploitation. The FBI's Internet Crime Complaint Center received 24,688 reports of employment scam victimization in 2025, with nearly $363 million in reported losses. The FBI defines employment fraud as a scheme designed to deceive someone into believing they have been, or could soon be, hired for a job. However, officials warn that these schemes are not always focused on stealing money from victims. They can also be used to recruit money mules, collect personally identifiable information, or force people into labor.

Employment Scams Exploit Trust in Job Opportunities

LinkedIn, which has more than 1.3 billion members across more than 200 countries and regions, said people submit approximately 10,000 job applications every minute on the platform. The company uses automated systems and human oversight to detect and remove fraudulent activity. According to LinkedIn, automated defenses remove 98.7% of detected spam and scam content before members see it, while 99.5% of detected fake accounts are stopped proactively. LinkedIn also uses verification indicators to show when certain information about people, companies, recruiters, and candidates has been confirmed. Despite these measures, the company said scammers are becoming more sophisticated, with artificial intelligence making it cheaper, faster, and easier to impersonate legitimate individuals. One warning sign highlighted by LinkedIn is when a recruiter or company representative attempts to move a conversation away from LinkedIn's messaging platform. Doing so can allow scammers to bypass the platform's protections and reporting tools.

Money Mule Scams Turn Job Seekers Into Financial Intermediaries

One major form of employment scams involves recruiting victims as money mules. Scammers may advertise legitimate-sounding positions such as cryptocurrency transaction specialist, accounts receivable assistant, remote financial coordinator, or payment processing agent. After being hired, victims may receive money in their personal bank accounts, often through peer-to-peer payment applications. They are then instructed to withdraw the funds, convert them into cash, gift cards, or cryptocurrency, and transfer them elsewhere in exchange for a small commission. The money is generally linked to other scams or compromised accounts. Victims may face legal consequences, account closures, and seized funds despite being deceived into participating.

Stolen PII Employment Scams Target Personal Information

Another type of fraud uses fake employment opportunities to collect stolen PII. Job titles may include onboarding specialist, HR assistant, compliance reviewer, or know your customer and identity verification agent. Victims may be asked to collect identity documents from customers, forward files, verify accounts, handle one-time codes, open accounts, submit applications, or organize data into spreadsheets and shared drives. Instead of directly moving stolen money, victims become part of a process designed to harvest personal information.

Forced Labor Can Begin With a Fake Job Offer

The FBI also warns that some employment scams can become gateways to human trafficking and forced labor. Victims may be offered jobs abroad or remote positions and encouraged to travel internationally, with Southeast Asia identified as a known hotspot. After arriving, victims may have their passports confiscated and be told they must repay travel costs. Some are then forced to work in scam compounds, where they are required to contact targets. Victims may face monitoring, threats, or physical abuse if they fail to meet quotas.

FBI Warns Job Seekers About Employment Scam Red Flags

The FBI and LinkedIn advise applicants to research companies carefully and watch for warning signs. For money mule scams, red flags include requests to use personal bank accounts for business transactions, bypass normal payroll systems, move money quickly, open new accounts, or use cryptocurrency and gift cards. For scams involving stolen PII, applicants should be cautious if they are asked to handle sensitive identity documents without a legitimate compliance structure, receive files through informal channels, or are pressured to bypass normal safeguards. Potential forced labor scams may involve unusually high pay for vague overseas jobs, demands for quick relocation, employer-controlled travel arrangements, vague contracts, early moves to encrypted messaging apps, or instructions to keep the job secret from family. The FBI and LinkedIn said educating job seekers can help disrupt employment fraud before victims become involved. Anyone who believes they have been targeted should contact their financial institution immediately and report the incident to the FBI's Internet Crime Complaint Center with as many details as possible.

The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime.

The FBI has issued warnings like this before, but scammers posing as IC3 employees and FBI agents continue to evolve their schemes and claim new victims.

The best-known of these scams are recovery scams, complete with FBI logos and branding that make them look far more convincing.

Facebook accounts like the one below—and yes, I reported it—with equally fake reviews prey on people who have already fallen victim to a scammer.

“Have You Been Scammed or Defrauded? We’re Here to Help.

If you’ve fallen victim to online fraud, investment scams, crypto scams, romance scams, or unauthorized transactions, Reliable Scam Recovery Inc is ready to assist you in pursuing the recovery of your lost funds.

Our experienced recovery team works with victims to investigate scam activities, trace transactions, and provide guidance throughout the recovery process with confidentiality and professionalism.

Professional case assessment

Secure and confidential support

Dedicated recovery assistance

Fast response team

Don’t let scammers win. Take the first step toward reclaiming your losses today.

Contact Ic3 Scam Recovery Inc now for support and recovery assistance.”

The scammers count on victims feeling desperate and embarrassed. They have no scruples about victimizing them all over again.

The post contains a lot of the tell-tale signs IC3 warns about. Very vague but reassuring claims: “experienced recovery team,” “professional case assessment,” “secure and confidential support” all sound impressive but provide no verifiable detail. High‑level promises like “investigate scam activities” and “trace transactions” imply special legal or technical powers, but the FBI warns that scammers make similar promises to convince victims they’re dealing with authorized investigators.

Besides setting up fake IC3 accounts, they also monitor social media for posts from victims saying they’ve reported a scam to the FBI, then swoop in posing as FBI follow‑up contacts.

If victims remain unconvinced, the scammers may create videos depicting senior FBI officials or other recognizable public figures urging them to submit their case through a specific link “to speed up recovery.” The FBI says criminals are increasingly using AI-generated deepfake audio and video to make these messages appear genuine.

How to stay safe

First and foremost, remember that IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.

As the IC3 homepage states:

“The IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases. The IC3 will never directly contact you for information or money.”

So, if an “agent” appears in your direct messages (DMs) right after you post publicly about being a crime victim or planning to report to the FBI, assume they are a scammer until independently verified. A few other tips:

• Never pay upfront: Legitimate government agencies never ask you for advance payment to recover stolen money.
• Ignore unsolicited claims: Be highly suspicious of anyone who reaches out to you out of the blue claiming they can reverse a previous scam.
• Never share your credentials: Do not give remote access to your device or hand over your passwords and recovery phrases to unknown third parties.
• Don’t provide IDs or financial information. Scammers can use them for identity theft or further fraud.
• Use verification tools: If you receive a suspicious email, message, or phone call, you can verify its legitimacy using tools like Malwarebytes Scam Guard.
• Report scammers: If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at ic3.gov. 

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.

On June 19, three different security firms issued similar findings: That NetNut is a residential proxy network which populates a botnet called Popa, and distributes software for devices commonly found in homes, such as smart TVs and streaming boxes. NetNut’s software turns those systems into always-on residential proxy nodes that are rented to others, who predominantly use them to relay abusive and intrusive Internet traffic, such as mass content scraping, advertising fraud, and account takeover activity.

Earlier today, NetNut’s homepage was replaced with a seizure notice from the FBI and the Internal Revenue Service Criminal Investigation division. The seizure notice thanked Google, Lumen, Shadowserver and other industry partners for their help in dismantling hundreds of domains tied to the Popa botnet, which experts say has long been synonymous with NetNut’s residential proxy infrastructure.

In a blog post published today, the Google Threat Intelligence Group (GTIG) said NetNut’s proxy network is widely resold and white-labeled by a number of third-party proxy providers, and that its services are heavily sought out by cybercriminals seeking to obfuscate the source of their malicious traffic. The GTIG said that in a single week during June 2026, they observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, including cybercriminal and espionage groups.

“These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks,” Google’s GTIG wrote. “Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats.”

Google said it disabled Google accounts and services used by NetNut for malware command and control, and that it shared technical intelligence on NetNut’s software development kits (SDKs) and backend infrastructure with platform providers, law enforcement and research firms. The company also disabled apps known to bundle NetNut’s various SDKs.

Omer Weiss, legal counsel for NetNut parent Alarum Technologies, said the company was aware of the FBI seizure and cooperating with investigators.

“Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account,” Weiss said in a written statement.

Benjamin Brundage is founder of the proxy tracking service Synthient, one of the companies that published evidence last month linking the Popa botnet to NetNut and Alarum Technologies. Brundage said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it.

Brundage said NetNut’s apparent demise is likely to be a great disadvantage for the cybercrime community, which was already reeling from legal actions by Google earlier this year that seized infrastructure for NetNut’s biggest competitor — IPIDEA.

“I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown,” he said. “Also NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it.”

The NetNut and Popa botnet takedown may have another added benefit, Brundage said: Lessening the impact of large distributed denial-of-service botnets that have been built on the backs of poorly configured residential proxy services. In January, Synthient revealed how cybercriminals had built the world’s largest DDoS botnet (Kimwolf) by tunneling through IPIDEA proxy connections into the local networks of TV box owners, and infecting other Android-based devices behind the victim’s firewall.

While many of the bigger proxy providers took steps to block this activity, resellers of the major proxy networks have been far slower to respond to the threat, Brundage said.

“In terms of all these TV box devices getting compromised from the proxy network, it will have an impact on the DDoS botnets out there,” he said.

For its part, Google reckons today’s actions have caused “significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” But the company warns that proxy networks can rebuild themselves by effectively reselling other proxy services, as IPIDEA has done over the past few months.

“Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,” the GTIG report concludes. “While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers.”

As KrebsOnSecurity has warned repeatedly, most of the no-name TV streaming boxes for sale on the major e-commerce websites either come pre-installed with residential proxy software, or require the installation of proxy SDKs in order to use the device for its stated purpose (streaming pirated movies, sporting events and TV shows). Google’s advice here is sound: When it comes to TV boxes, stick to name brands from reputable manufacturers, and then be sparing and judicious with any apps you choose to install.

The sketchy TV boxes that are being commandeered by the Popa botnet and other threats all come with or require the user to install unofficial Android operating systems that do not operate within the confines of Google’s Official Play Protect store. Google says consumers can confirm whether or not a device is built with the official Android TV OS and Play Protect certification by following these instructions.

Even people without TV streaming boxes can find their smart TVs enrolled in residential proxy networks, just by installing one of thousands of apps available for download on Samsung and LG smart TVs. In a report released last month, the proxy tracking company Spur found 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one’s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components, Spur found.

Update, 4:24 p.m. ET: Included a statement shared post-publication from an attorney representing NetNut parent Alarum Technologies.

Update, July 8, 2:34 p.m. ET: The website for Alarum Technologies — alarum[.]io — now also features a seizure notice from the FBI. The company’s stock has taken a beating since the FBI action, and is currently trading at $2.62 a share, a roughly 67 percent decline over the past week.