Top job scam patterns we're seeing in 2026

What's growing this year, what's fading, and what to watch for in the months ahead.

Each year the job-scam mix shifts. This post is what we're seeing across investigations run in the first half of 2026 — growing patterns, fading patterns, and what looks likely to be next.

Growing fast

AI-generated recruiter personas. Profile photos generated by image models, post histories churned out by language models, and replies authored in real time by a chatbot. The cost of building a convincing fake recruiter has dropped to near zero. Counter-signal: these profiles are perfect on the surface but have zero verifiable external history — no conference appearances, no podcast guest spots, no other firms in their employment history that corroborate them.

Crypto-payroll bait. 'We pay in stablecoins, send your wallet address.' Real companies that pay in stablecoins exist, but they don't lead with that. A recruiter who opens with payment rails is selling the rail, not the role.

Identity-imitation of real firms. Domains that visually match a real company (e.g. microsoft-careers.io) plus a careers site cloned almost pixel-perfect. The clone often pre-fills your data into a 'background check' form that's actually a credential harvester.

Steady volume

The equipment-fee classic. 'We'll ship you a laptop — first send $1,200 for the purchase.' Same scam as five years ago, still works, still common. Why it persists: easy to set up, easy to walk away from, small enough loss that victims don't always report.

The check-and-wire scheme. You're 'hired', sent a check, asked to forward most of it to a 'vendor'. The check bounces, you eat the wire.

Fading

The Nigerian-prince-of-jobs email. Long-form English-broken pitches over email are a dying format. Filters catch them, candidates ignore them, and the scam economy moved to chat platforms where messages are shorter and platform-level reporting is weaker.

What we expect next

Voice-cloned recruiter calls. The technology is already consumer-grade; the scam playbooks haven't fully adopted it yet. We expect to start seeing 'final-round phone screens' that are entirely synthesized in 2027.

Counter: insist on a live video call with a screen-share of the company's official platform (Workday, Greenhouse, etc.) before sharing anything sensitive.

How to use this

Don't memorize the list. Memorize the shape: scammers want money, documents, or unpaid labor, and they want them fast. Anything pushing on those three at high speed deserves scrutiny regardless of which year's playbook it's running.

Ready to investigate?

Start protecting yourself from scams and fake opportunities. Your first 5 lookups are free.