A job search can result in sharing more than your résumé with potential employers. In spring 2021, the FBI put out a press release to warn the public that cybercriminals are using fake job listings to target personal and financial information.

We talked to Mike Caldwell, executive director of TCU’s Center for Career & Professional Development, for some insights into cyber security on the job hunt.

You mentioned seeing an increase in fake or misleading job posts in the last year. Why are job hunters being targeted?

I have seen it tick upward when the job market is really strong and when the job market is really challenging. When it’s challenging, people look for ways to take advantage of job seekers who maybe have not looked for a job in a while. And right now, when there are so many job postings, it’s hard to wade through what is a good opportunity and what isn’t, what’s a reputable website and what isn’t.

During the job search process, you’re going to be asked to provide and contribute personally identifiable information — your name, your address, your phone number. Once you are employed by an organization, they may ask you to show them a driver’s license, give your Social Security card.

Job seekers may feel a little more inclined to give up more information than they would normally because they may be without a job. And that’s what I think scammers are doing in most cases — they prey on that sense of urgency. I had a student at my past college who was offered a job and asked for their bank account information. The student thought that was the normal thing to do to get set up on payroll, and had money taken from their account.

Where can people look for a job safely?

No place is completely safe. But Handshake, because of the checks and balances, is probably going to be a little bit safer. Also LinkedIn, where you can verify connections with the organization, is a little bit safer.

If you’re an active TCU student, you have a Handshake account automatically; if you’re an alum, you can input your request for an alumni account. Underneath the single sign-on option for students, there’s an alumni button. In Handshake right now we have 17,000 postings in our system; I can’t imagine how many hundreds of thousands are on Indeed right now. A number of job posting platforms have systems where they’re able to determine whether the job was posted via a virtual private network. If the person is masking the IP [internet protocol] address, that can be a red flag.

Who is Handshake for?

Handshake is primarily serving that entry-level college market. That said, it is available for alumni at TCU; our services extend to alumni for life. A number of the jobs are alumni-focused, because some of them are graduate-level positions.

“LinkedIn is generally a good option. It goes hand in hand with the advice that we always give of trying to find someone with a company or organization that you’re interested in working with.”
Mike Caldwell

The jobs that are pulled into the Horned Frogs Connect platform through our alumni office also come from Handshake. So, we’re able to help filter some of those jobs that maybe require one to three years of experience. You can even connect your Horned Frogs Connect account to your LinkedIn account.

LinkedIn is generally a good option. It goes hand in hand with the advice that we always give of trying to find someone with a company or organization that you’re interested in working with. Because then you can reach out to the person, who may be a TCU alum, and say, “Hey, I saw you had this marketing manager position open. Can you tell me a little bit more about that role? Do you know anything about that department? How’s your experience with that company or organization? Do you have any advice for someone who might be coming in and looking for that role?”

Framing it in that way helps not only verify the validity of the job posting, but it also gets your foot in the door in terms of connecting with people who are with the organization.

Does Handshake only have the job openings that companies ask to post to TCU?

It can be as local as the TCU Marketing & Communication office sharing a student worker position. It can be up a level — someone from here in the DFW area who’s posting only to TCU, SMU and a couple of the other schools in the area. And it can be national — Google, Amazon, Facebook — all of the Fortune 500 companies use Handshake. Some employers are posting to the entire Handshake network of hundreds of schools.

When on the job hunt, Mike Caldwell says to watch for red flags like an “employer” who contacts you from a blocked number. Photo courtesy of Unitonevector, iStock, Getty Images

Are there any sites that you would advise avoiding? What are some steps you can take to stay safe?

No, I think you can use them all in aggregate.

See if the posting is also posted on the company’s website. Verify that you are talking to the actual employer before providing any kind of bank account information. Verify that all the websites that are being shared with you are legitimate, that they are company websites, that it’s not a Google form that’s going somewhere else.

Something that we always share with students is if you get that out-of-the-blue email from some random person that says you’ve been offered a job or you’re invited to apply, that’s definitely something to watch out for. That’s one reason to keep a record of where you’ve applied — not only will that help you in your job search, it’ll also help keep you safe.

If the job is “We would like to hire you as a shipping coordinator; you will pick up packages, you will mail these packages” — be very cautious of that. It may seem like a legitimate job on the surface, but be extra wary of any position or job that asks you to ship, pick up or distribute packages or mail. It could be illegal, and then your name is tied to it.

In addition to recognizing red flags, how can people protect themselves?

I mentioned earlier keeping a log of jobs that you’ve applied to; that’s just a good networking practice as well. I applied on this date, this is the organization, these are my contacts with the organization, this is who I need to follow up with, this is the timeline. Make sure that you have an alert or notification set up on your phone or on the account that you’re using for your job search because you don’t want to miss an interview.

You can also set up alerts with almost every major employer where they notify you of open jobs, and sometimes you’ll get that information before it hits a job board.

If you suspect that a job is a scam, what action should you take?

If you’re using Handshake, flag it; if you’re using LinkedIn, Indeed, any of those systems — they all have a “report” option.

I strongly encourage TCU students to report anything to IT if it has come in through email. If it’s something that is serious, reach out to the TCU campus police as well, and they can investigate it. If you’re an alum, you can go to the Federal Trade Commission website and report it.

Editor’s Note: The questions and answers have been edited for length and clarity.