The fastest tell in a recruiter email is the part most people skip: the domain after the @. Read it slowly and a lot of scams give themselves away.
The rule
A real recruiter at a real company emails from that company's primary domain, the same one you reach by typing the company name into your browser. A free address or a near-miss domain is a reason to stop and verify, especially if it comes with a fast offer or a request for money or ID.
How to read the address
- Ignore the display name. Look at the actual address, the text after the @.
- Compare the domain letter by letter to the company's real domain.
- Watch for free domains (gmail.com, yahoo.com, outlook.com) on a corporate role.
- Watch for lookalikes: extra words like "-careers" or "-hr," a different ending like .net, or a small misspelling. That is a lookalike domain.
What it looks like in a scam
A polished email that names a real company, sent from a free or near-miss address, with a quick offer and an early ask for your bank details or a photo of your ID. The mismatch between the name and the domain is the giveaway, a hallmark of recruiter impersonation.
What to do
If the domain does not match the real company, do not reply with personal details. Verify the recruiter through the company directly, as in how to verify a recruiter, and report a fake to the FTC. On a phone, tap the sender's name to reveal the full address, since email apps hide it behind the display name by default and that is exactly what a scammer counts on. To check an address fast, paste the message into the free checker.