Uptick in New Jersey Employment Scams

A recent NJCCIC (New Jersey New Jersey Cybersecurity and Communications Integration Cell) Weekly Bulletin cited an uptick in New Jersey employment scams that target and exploit individuals seeking employment.

The NJCCIC is the Division of Cybersecurity under the New Jersey Office of Homeland Security and Preparedness. It exchanges cyber threat intelligence and conducts incident response for governments, businesses, and citizens in New Jersey.

Scams Start with Reconnaissance

The employment scams start with cybercriminals performing reconnaissance on potential targets. They gather information from a variety of sources. These include things such as past data breaches, public data, social media, and data purchased on the dark web.

Communication Through “Spoofing”

The bad actors then communicate with their targets through email, text messages, and other methods regarding job opportunities coming from legitimate job postings. In addition, they may post fraudulent job postings through legitimate online employment boards and websites. Typically, they impersonate legitimate employers and recruiters and “spoof” legitimate domains. To “spoof” a domain means to falsify or imitate a domain name to deceive recipients or systems into thinking that a message or connection comes from a trusted source, when it actually comes from a malicious or unauthorized one.

The threat actors express the target’s potential fit for a vacant position and attempt to engage the target further.

Coca-Cola Example

One campaign found by the NJCCIC involved threat actors quickly sending large amounts of spam emails before they are detected and shut down, impersonating Coca-Cola and its branding. The emails contained a link with the Coca-Cola name in the URL, but actually directed the target to a malicious website. The website prompts the victim to update their browser. If clicked and installed, sensitive information and devices may be compromised.  

In this campaign, a text message outlined the position’s benefits, flexible hours, average pay, and other job details. Often, bad actors ask to continue the conversation on a separate Chat platform to avoid detection. Typically, legitimate employers don’t do this.

“RED FLAGS”

Employment scams often involve stealing personally identifiable information (PII) or monetary funds. They even go to the extent of conducting fake online interviews. Bad actors may ask for personal information, application fees, or background checks. They may also send fraudulent invoices with instructions to pay online with a promise of reimbursement.

Suspicious indicators include:

• vagueness from the purported employer or recruiter
• the job sounding “too good to be true”
• upfront requests for personal and financial information
• urgency to respond or accept a job offer
• using unofficial communication methods

RECOMMENDATIONS

• Refrain from clicking links and opening attachments from unknown senders
• Examine potential offers by contacting the company’s human resources department directly
• Navigate to websites directly for authentic job postings
• Refrain from contacting or clicking on unknown telephone numbers
• Avoid downloading software at the request of unknown individuals
• Report malicious cyber activity to the FTC, the FBI’s IC3, and the NJCCIC.
• If victimized, report the scam directly to the respective employer or employment listing service.
• If PII compromise is suspected or detected, contact your local law enforcement department

For more technology trends and topics, follow our LinkedIn page! 🖥️

➡️  Check Out Our Business Testimonials!