Free tools Windows power users keep installed
One-click scans. No signup required.
This was a documented January 2024 scam campaign, not evidence of a new August 2026 incident. Qualys researchers reported that criminals used Facebook-related outreach to impersonate recruiters, move targets into private chats, send convincing employment documents, request government-issued identification, and instruct victims to deposit or cash a check for supposed work equipment or software. The scheme could expose victims to identity theft, bank fraud, and financial liability.
Similar job scams continue to use social platforms. The safest rule is simple: independently verify the employer before sharing sensitive information—and never pay money, deposit a check, or move funds for an alleged employer.
As an Amazon Associate I earn from qualifying purchases.
The scam in one minute
The reported pattern was:
- Facebook offer: A user encounters a remote-work opportunity or receives an unsolicited message.
- Impersonated recruiter: The sender claims to represent a recognizable company or brand.
- Private chat: The conversation moves away from Facebook to an app such as GoChat or Signal.
- Fake employment documents: The recruiter sends a polished offer letter or contract.
- Identity request: The victim is asked for a government-issued photo ID and potentially other personal information.
- Fake-check transaction: The victim is told to deposit or cash a check and use the money to buy equipment or software.
The check may later be identified as fraudulent or reversed, while the victim’s identity documents and banking information remain useful to criminals.
The reported campaign was described by Dark Reading on January 11, 2024, citing Qualys researchers. That report identified Qualys as one of the brands being impersonated; it did not show that Qualys recruited through Facebook or participated in the scheme.
#1 Best Overall
How the Qualys impersonation campaign worked
According to the report, scammers used recognizable branding, corporate addresses, logos, names, and signature lines to make fake employment documents appear authentic. The reported outreach allegedly involved compromised legitimate Facebook users contacting people in their networks, although the available reporting does not establish a platform-wide Facebook breach.
Qualys said it did not post job listings on social media and directed applicants to its own website and reputable employment sites. The report also said attackers were targeting multiple brands, but it did not publicly identify every company involved.
GoChat and Signal were reportedly used as communication channels. That does not mean those services were themselves malicious or compromised. Criminals can use legitimate messaging tools to move conversations away from the original platform, where the victim has less context and fewer convenient reporting options.
Why the offer can look convincing
A logo or contract proves very little. Fraudsters can copy public information from a company’s website, including:
- Corporate logos and branded PDF templates
- Office addresses and phone numbers
- Executive names and job titles
- Legal-sounding contract language
- Real job descriptions and terminology
- Signature blocks and email formatting
A professional-looking document is therefore only a claim of authenticity. Verify the job through a channel the recruiter did not provide.
The strongest warning signs
Recruitment-process red flags
- You receive an unsolicited offer or are hired unusually quickly.
- There is no credible interview, or the entire interview occurs through text or a messaging app.
- The job description is vague, generic, or promises unusually high pay for little work.
- The recruiter pressures you to act immediately.
- The recruiter cannot be verified through the employer’s official website.
- The sender uses a free email provider, a misspelled domain, or a lookalike domain.
- You are required to install an unfamiliar app before you can apply or interview.
- A contract arrives before normal screening, interviews, or reference checks.
Meta’s job-scam guidance specifically warns about employers that hire without an interview, conduct interviews only by text or messaging app, provide little company information, or promise high pay for little work.
Money and check red flags
- An application, placement, training, background-check, equipment, or reservation fee.
- A request to deposit, cash, forward, or transfer money for the employer.
- A check sent before you have performed work.
- Instructions to buy equipment, gift cards, cryptocurrency, or software and send money back.
- A request to use your personal bank account for payroll, vendor payments, or “testing.”
- A demand for cryptocurrency or another payment to unlock supposed earnings.
Meta says employers should not require upfront payments or ask applicants to accept money, cash checks, or transfer funds on the company’s behalf.
Identity and account red flags
- A request for a driver’s license, passport, Social Security number, bank account, or tax information before the employer has been independently verified.
- A demand for both the front and back of an identity document.
- A request to send personal information through Messenger or an unverified chat.
- A form hosted outside the company’s official domain.
- A login page requesting Facebook, email, or banking credentials.
Meta advises users not to provide personal or financial information directly in Messenger and to check that legitimate employer forms use secure HTTPS browsing. HTTPS alone is not proof that a site is genuine, however; a fraudulent site can also use HTTPS.
How to verify a remote job safely
Do not verify the offer by replying to the recruiter, calling the number in the contract, scanning its QR code, or clicking its links. Use an independent route:
- Save evidence first. Screenshot the post, profile, messages, phone numbers, email addresses, documents, URLs, and payment instructions.
- Open a new browser window. Do not use links supplied by the recruiter.
- Type the employer’s domain manually or use a trusted search result.
- Open the official careers page and search for the exact job title and location.
- Check the details. Compare the job description, recruiter name, domain, location, and application process.
- Contact the company independently. Use a phone number or email address published on the official website.
- Ask whether the recruiter and vacancy are genuine. Send suspicious documents only through the company’s approved reporting or recruiting channel.
- Confirm the hiring process. A legitimate remote employer should be able to explain interviews, onboarding, payroll, and secure data collection.
- Stop if the offer fails multiple checks. One unusual detail may have an innocent explanation; several together are a strong stop signal.
Legitimate employers may eventually request tax or payroll information, and some may use messaging platforms. Those facts are not automatically fraudulent. The concern is the combination of unsolicited contact, weak verification, urgency, sensitive-data requests, and financial transactions.
What to do if you already responded
If you shared only your name or résumé
Stop communicating, preserve the messages, and report the account and job listing. Be alert for follow-up attempts that use information from your résumé to appear more credible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you sent a government ID
Sending an ID does not prove that identity theft has occurred, but it creates a material risk. Contact the organization that issued the document and ask about replacement, cancellation, or fraud procedures. Notify relevant banks and financial institutions if banking details were also shared. Monitor accounts, credit reports, and unexpected account-opening notices, and preserve all evidence.
If you shared bank details or tax information
Contact the bank or credit union immediately. Ask what protective measures are appropriate, including account monitoring, replacement account details, or restrictions. Change any exposed account credentials and enable multifactor authentication.
If you shared a password
Change it immediately from a known-clean device. If you reused it anywhere else, change it on those accounts too. Secure your email account first because email access can be used to reset other passwords. Turn on multifactor authentication for email, Facebook, banking, and other important accounts.
If you deposited or cashed a check
- Do not spend or transfer the funds.
- Contact your bank or credit union immediately and explain that the check may be fraudulent.
- Follow the institution’s instructions about the deposit, account restrictions, and repayment exposure.
- Do not send money back to the alleged employer.
- Do not buy equipment, gift cards, cryptocurrency, or software with the funds.
- Keep the check, images, deposit records, messages, and payment instructions.
A deposited check can appear to clear before the bank discovers that it is fraudulent. If the institution reports a loss or alleges that you participated in fraud, seek qualified legal or financial advice and provide the preserved evidence.
If you installed GoChat, Signal, or another app
Do not assume that Signal or another legitimate messaging service is malware merely because a scammer used it. Stop communicating and avoid opening further links or attachments. If the app was unfamiliar or unnecessary, remove it after preserving evidence, then review the device for newly installed applications, accessibility permissions, device-administration privileges, VPN profiles, and notification access.
Change credentials from a known-clean device, run current security scans, and contact the device manufacturer, your employer’s IT team, or a qualified incident-response professional if the app requested unusual permissions or compromise is suspected. The reported campaign does not establish that GoChat or Signal themselves were compromised.
If you sent money or cryptocurrency
Contact the payment provider, bank, exchange, or cryptocurrency service immediately. Ask whether a transaction can be reversed or flagged, although recovery is not guaranteed. Save wallet addresses, transaction IDs, receipts, messages, and payment instructions. Do not pay an additional “recovery” fee to anyone promising to retrieve the funds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to report the scam
Report it to Facebook
After preserving evidence:
- Report the job post from the post’s options menu.
- Report the recruiter’s profile or Page.
- Report impersonation if the account pretends to represent a person or company.
- Block the account after reporting it.
Meta’s impersonation-reporting guidance explains how to report profiles and Pages. The interface can differ by device, region, or whether you are logged in. Meta also provides a general reporting entry point.
Report it to the impersonated company
Use the company’s official security, abuse, fraud, or recruiting contact. Do not use contact details supplied by the suspicious recruiter. Include screenshots, profile and post URLs, email headers, phone numbers, documents, payment instructions, and the dates and times of contact.
Notify financial institutions and authorities
Notify your bank or payment provider about suspected fraud. Report identity-theft concerns and financial loss to local law enforcement and the relevant consumer-protection authority. In the United States, victims can also consider reporting to the Federal Trade Commission and asking law enforcement whether an Internet Crime Complaint Center report is appropriate.
Reporting cannot guarantee that money or documents will be recovered. It can help preserve evidence, remove fraudulent accounts, alert the impersonated company, and support broader investigations.
What this incident does—and does not—show
- It shows how criminals can combine social-media outreach, brand impersonation, fake contracts, identity harvesting, and fake checks.
- It does not show that every Facebook job listing is fraudulent.
- It does not establish that Facebook suffered a platform-wide breach.
- It does not show that Qualys recruited through Facebook; Qualys was reportedly impersonated.
- It does not show that every victim’s identity was stolen.
- It does not show that Signal or GoChat are inherently malicious.
- It does not prove that the exact Qualys-reported campaign is active in 2026.
Later job scams may use different mechanisms, including fake “task” work and cryptocurrency payments. The warning signs overlap, but the January 2024 report should not be presented as a newly discovered campaign.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
