Public job boards like Indeed and LinkedIn give you access to the largest pool of candidates available but that same accessibility also comes with security risks that are often overlooked.
Job boards are a popular target for scammers and other bad actors, where they go after not just job seekers, but recruiters as well. In fact, according to the Federal Trade Commission, around $501 million was lost to job and employment agency scams in 2024. While most of these losses hit job seekers directly, recruiters face parallel risks (data breaches, brand impersonation, and mishandled candidate information).
Scammers can, for example, impersonate legitimate recruiting firms to steal candidate data or redirect applicants to fake portals, damaging the reputations of real agencies in the process. That next agency might be yours.
If you’re a recruiter, here’s how you can use public job boards safely and protect both your firm’s and your candidates’ data.
Lock Down Your Recruiter Accounts
First, start with your very own recruiter account on job boards. Every account you use must have:
- A strong, unique password.
- Multi-factor authentication enabled.
- A dedicated professional email address (and not a personal one).
A breached recruiting account can potentially expose every candidate you’ve come into contact with. And if you’re reusing passwords, one breached account risks your other accounts as well.
It’s also important to use a professional, work-only email to create these recruiting accounts. Using work-only email prevents the recruiting account from being affected if your personal account gets compromised.
If you’re working remotely at a cafe, hotel, or airport, be wary of logging into accounts over their public Wi-Fi. These networks are public, making it far easier to intercept data. If you have to log in on public Wi-Fi, a quick VPN download can encrypt your connection to prevent third parties from snooping on your activity.
Lastly, if you ever gave account access to a colleague and especially temporary staff revoke that access as soon as it’s no longer needed. Most platforms have team or sub-account features specifically for this.
Be Careful What You Post and What You Collect
Job postings themselves can also create security risks if they're too detailed. While you still need to provide enough details, some pieces of information are better shared privately at a later part of the hiring process.
For example, avoid publicly listing internal email addresses, direct phone lines to senior staff, or internal job codes. These could be used to craft convincing phishing messages that target either your organization or your candidates.
Similarly, when collecting applications, only ask for the information you actually need at each stage. While HR departments will eventually need a candidate’s social security number, passport details, or financial information, it’s not the role of recruiters to collect it.
It’s a red flag that many candidates have learned to associate with scams. Make sure to store candidate data in an Applicant Tracking System (ATS) instead of a shared email inbox or unsecured spreadsheet as well.
Note: Storing candidate data comes with legal obligations. Regulations like GDPR and CCPA determine how long you can retain it and how you honor deletion requests.
Verify Before You Engage Any Candidate
More and more fake candidates are appearing on public job boards. These fraudulent applicants submit AI-generated resumes or use stolen identities. They’ve become common enough that weeding them out should be a core part of your screening process.
Before investing significant time in a candidate, conduct a basic cross-check:
- Verify that their LinkedIn profile is active and consistent with their application.
- Double-check if their email address isn’t imitating a service or a company (for example, '@go0gle.com' instead of '@google.com')
- Be cautious of profiles created very recently.
The same logic applies in reverse. If someone reaches out to you claiming to represent a hiring company, verify their identity independently before sharing any candidate data. Always look up the company directly first before clicking any links in messages.
Monitor Your Name and Brand on Job Boards
It’s also a good idea to search for both your firm’s name and your personal name. This is to check if fraudsters are creating fake job posts under your or your company’s name.
These fake job posts can be very convincing, often being complete with copied logos and company descriptions. If you come across such fake posts, report them to the platform immediately and notify any candidates who may have already applied.
Do this on both job boards and on Google. Additionally, you might want to search your firm’s name alongside terms like "scam" or "fraud" every few months. You’d want to know as soon as possible if your company’s reputation is already being affected by fraudsters.
What to Do If Something Goes Wrong
Lastly, even with these precautions, there is still a chance of security incidents occurring. This is why knowing what to do should they happen is just as important as preventing them in the first place:
- Contact the platform’s official reporting channels if security problems arise.
- Keep screenshots, emails, dates, and links to accounts. These are crucial should you need or decide to escalate it to law enforcement.
- Immediately change passwords, enable or re-verify multi-factor authentication, revoke unauthorized access, and notify your internal IT or security team if applicable.
- If candidate data may have been exposed, inform them quickly and transparently to protect them and your firm’s reputation.
By knowing how to prevent job board-related security risks and knowing what to do should they occur, you can better protect both your candidates and your firm and continue recruiting with confidence.
.png)
.png)
.svg){kind=logo}