An unexpected recruiter message can be completely legitimate. It can also be surprisingly easy to imitate.
Recruiters routinely contact professionals who have not applied for a job and may not be actively looking. That is a normal part of executive search, headhunting and professional recruiting.
The difficulty for candidates is that an impersonator can now reproduce many of the same surface details: a polished profile, a plausible title, familiar recruiting language and a convincing-looking document or link.
The risk can arise when those details encourage you to act before you have established who is actually behind the message. That might mean opening a file, following a link, moving the conversation elsewhere or providing information that you would normally share later in a hiring process.
A short verification routine can give you more context before you do any of those things. It does not require a lengthy investigation. In many cases, a few ordinary professional checks are enough to decide whether the conversation makes sense to continue.
A Short Verification Routine
Begin with information you can establish independently. Once the recruiter’s identity and organization make reasonable sense, turn your attention to the role and the hiring process being described.
Open a New Tab Before Following an Unfamiliar Link
If a recruiter you do not yet know sends you a link, you do not need to use that link as your first source of information. Search for the organization independently and locate its website yourself.
On the site, look for ordinary signs that the organization has a coherent professional presence:
- Clear “About” and “Contact” information
- A company domain that fits the organization’s name
- Content and navigation that are reasonably consistent with an established business
- Branding and contact details that match what you have been told
See Whether the Recruiter Can Be Connected to the Organization
Once you have located the organization independently, look for reasonable ways to connect the sender to it. A team, people or leadership page may help. So may a professional profile, company directory listing or other credible reference point.
Compare the person’s name, title and organization with what was stated in the original message.
Ask to Continue Through a Professional Company Channel
A company-domain email can be a useful next step when the recruiter works for an organization that uses one.
Depending on the circumstances, you might ask the recruiter to:
- Email you from their organization’s professional address
- Send the meeting invitation from the same professional account
Those details provide additional corroboration and establish a more traceable professional communication path. They should not be treated as absolute proof by themselves: domains can be imitated, accounts can potentially be compromised, and smaller or independent recruiters may use different systems.
Ask Enough About the Role to Understand the Conversation
Once the recruiter’s identity is reasonably established, look at the opportunity itself.
At an early stage, a recruiter may be able to discuss:
- The general purpose, level and responsibilities of the position
- Location or work arrangement where relevant
- What the first conversation is intended to cover
- The anticipated interview or selection process, if known
- An approximate next step or timeline
Recruiters will not always know every detail, and employers can change timelines or interview plans. The useful question is whether the person can provide a coherent explanation of the opportunity and of what they are asking you to do next.
Use an Official Posting When One Is Available
A role hosted on an employer website, agency job board or recognizable applicant-tracking system gives you another source you can examine independently.
Not every legitimate search has a public posting. Confidential recruiting is common in executive search, replacement hiring and other sensitive assignments.
When a public posting cannot be provided, a recruiter may still be able to give you useful context such as:
- A high-level description of the role, sector and scope
- Location or work arrangement where it can be disclosed
- Seniority and broad responsibilities
- What information is being withheld and why
- The next step if you decide you would like to hear more
If You Already Clicked or Opened Something
If you followed a questionable link or opened an unexpected file and are now concerned, what matters next depends on what actually occurred.
Visiting a webpage is different from entering a password. Downloading a file is different from running it. Providing personal information creates a different set of concerns again. Avoid assuming the worst, but do not ignore something that may require attention.
Depending on the circumstances, useful steps can include:
- Limit further exposure if necessary. If you downloaded or executed something suspicious and believe the device may be affected, disconnecting it from the network can be appropriate while you investigate.
- Run appropriate security scans. Use trusted security software or your employer’s IT/security resources if the incident involves a workplace device.
- Change credentials that may have been exposed. Prioritize the account involved and any other account using the same or a closely related password.
- Enable multi-factor authentication where available. MFA can add another barrier if a password has been exposed.
- Review account activity and alerts. Look for unfamiliar sign-ins, password resets, transactions or changes to security settings.
- Keep and report useful evidence. Screenshots, sender information and URLs may be helpful when reporting suspicious outreach to the platform or another appropriate party.
If sensitive personal, financial or workplace information may have been compromised, the appropriate response can depend heavily on what was disclosed and where you are located. Consider contacting the relevant financial institution, employer, platform, cybersecurity professional, legal adviser or authorities appropriate to your circumstances.
Patterns Worth Checking
An Attachment Arrives Before Much Context
An unexpected file from an unfamiliar sender is a reasonable point to stop and establish who sent it before opening it.
Basic Identity Questions Keep Going Unanswered
One missing reference point may mean very little. Repeated resistance to ordinary verification deserves more attention.
Pressure Increases While the Role Remains Vague
Genuine hiring can move quickly, but urgency becomes more concerning when there is still very little concrete information about the job, organization or process.
What To Do Next
Ask to Continue Through a Professional Channel
If appropriate for the organization, ask the recruiter to continue from a recognizable company email account.
“Happy to continue. Would you mind emailing me from your company address and sending the meeting invitation from there?”
Ask for the Official Posting Where Available
See whether the role appears on the agency website, employer site or another official recruiting system.
“Can you share the official posting on your website or the employer’s site? If the search is confidential, a brief role summary would be helpful.”
Match Your Response to What Actually Happened
If you are concerned about something you clicked, downloaded or shared, identify the specific exposure first. That will help you decide whether you simply need to stop, change a password, scan a device, report the message or seek additional help.
Key Takeaways
- Use independent sources to establish an unfamiliar recruiter’s identity where practical.
- A company-domain email, professional profile, official website and coherent process can corroborate one another, but no single signal is conclusive.
- Public postings are useful when they exist; confidential searches may legitimately work differently.
- Pay attention to combinations of inconsistencies rather than treating one unusual detail as a verdict.
- Before opening, clicking or sharing something consequential, make sure you understand who is asking and why.
- Reasonable verification questions are a normal way to handle unfamiliar professional outreach.
A Little Verification Goes a Long Way at First Contact
An unfamiliar recruiter does not need to be treated as suspicious simply because the introduction was unexpected. In many areas of recruiting, unexpected introductions are the business.
What candidates now have to account for is how easily those introductions can be imitated.
That makes the first few minutes of a new conversation a useful time to establish some basics. Find the organization independently. See whether the person can reasonably be connected to it. Move the conversation onto a recognizable professional channel where appropriate. Ask enough about the role to understand why you are being contacted and what would happen next.
None of those checks needs to turn into an investigation, and none provides an absolute guarantee. Together, however, they give you more information than the original message alone.
If the details begin to fit together, you can continue the conversation with a better understanding of who is on the other side. If they become harder to reconcile, you have a sensible reason to hold off before clicking, opening, sharing or committing to anything further.
That is a useful place to begin this series, because nearly every topic that follows comes back to the same practical question: do you have enough reliable context for the next step you are being asked to take?
*Important Notice: The tips and tools in this “Safer Job Search” series are provided by Stoakley-Stewart Consultants Ltd. for general educational and informational purposes only. They do not constitute legal, financial, cybersecurity or other professional advice, and no lawyer-client, fiduciary or advisory relationship is created by reading or using this content. Individual circumstances, laws, regulations, technologies and platform practices may differ or change. Readers should exercise their own judgment and, where circumstances warrant, seek advice from an appropriately qualified professional in their jurisdiction. Stoakley-Stewart Consultants Ltd. makes no guarantee as to outcomes and disclaims liability for actions taken or not taken in reliance upon this material.
Looking for an Experienced Recruitment Partner?
Good recruiting depends on clear communication, professional accountability and a process that candidates and employers can understand. If you are hiring, or considering your own next career move, we would be pleased to speak with you.
For Employers & Hiring Managers
Work with an experienced recruiting firm that understands how much an employer’s reputation depends on the way candidates are approached, represented and kept informed throughout a search.
Explore Our Employer Services →For Candidates & Job Seekers
Explore current opportunities with Stoakley-Stewart Consultants and learn more about the positions our recruiters are currently working to fill.
Browse Current Opportunities →