My startup was recently the center of an elaborate recruiting scam. If you've recently gotten a gmail address and a "Senior Recruiter" Fathi Saeed, please know that this is not legitimate outreach.

In this article, I wanted to share what the experience was so that other targets know it’s a scam and so that other entrepreneurs know what these scams look like for the future.

What Happened This Time Around

I run a 40 person company called Kapwing based in San Francisco. Currently, the only role we’re actively hiring for is our Software Engineering Manager. However, we were notified by more than 30 people in the last week that someone is impersonating me (the CEO) to offer a video editing job that pays $90/hour.

This recruiting scam targeted people who are video editors. Video editors are also Kapwing users, so it breaks my heart that our potential customers could get burned by this scam  💔.

Step 1: Outreach

The scam starts with a fake email impersonating me, the CEO. The job seeker is told that they've been "shortlisted for a virtual screening/interview." The initial email comes from [email protected] and is signed with my name. It often has no subject.

Sometimes, the person submitted an application on a job board.

Phase 2: Written Interview

If the candidate is interested, they’re supposed to reach out to a different gmail address, [email protected], to schedule an interview with a supposed senior recruiter, Fathi Saeed. Once they reach out, they’ll get a Google Doc with a 20-question interview asking about their experience and background.

One of the people who received this Google Doc shared it with me. The "interview" is 20 questions long. I was surprised to see that it looks pretty legit other than the "Kapwing's Company" header.

Phase 3: Offer Letter

The “applicant” gets a job offer letter PDF, supposedly from our HR department. The email may come from [email protected].

Once they accept, the job seeker is asked to send bank deposit info to the crooks. Victims might get money taken from their bank account. No one has yet reported money or identity stolen, but of course there would be a delay before they notice.

How to Tell It’s a Recruiter Scam

tl;dr -- This outreach and interview with Fathi Saeed is not real, and [email protected] is not a legitimate company email address.

Here are a few signs that show why this recruiter email is suspicious. Any job seeker wondering about a correspondence should question outreach that has these qualities:

1. The emails come from a gmail address, not the company domain. All Kapwing employees have a @kapwing.com email, so job candidates would not get outreach from us from a gmail address. And you can always find the people who work at Kapwing on LinkedIn.
2. Asking for money or unnecessary personal info before you’ve signed a contract. We would never ask a candidate to send us bank info over email; we only ask for direct deposit information through our secure HR system (Gusto) after a candidate signs an official job offer.
3. No open job posting: Check to see if a job posting is open on the company’s job page (with an HTTPS in the header). If not, it may be a scam. When we do recruiting outreach, we generally include the link to the official job posting in the initial email. The only exceptions (where we might do outreach before putting up a public job description) are people management or executive roles.
4. Offering a job with no video interview. People who come to work at Kapwing will always have a video or phone interview before getting an offer.

Broken English, typos, no LinkedIn links, and inconsistent information may signal a recruiting scam. For example, in this case, candidates received the “offer letter” with our old company logo in the letterhead instead of the new logo we introduced recently. The offer letter was also signed by a random "Advisor" named Tom Gahm (who actually doesn't exist) rather than the CEO.

The initial email also had no subject line, and there were some typos throughout. But both of these are mistakes that a scrappy startup could easily make.

What To Do To Verify the Legitimacy of Recruiter Outreach

As a startup, we do send emails to job seekers sometimes about positions that are open at Kapwing. We also get plenty of third-party recruiters who send us resumes and ask us to pay commission if that candidate is hired. As a result, I know that there's a lot of inbound recruiting communications, and it can be difficult to distinguish the real from the scam.

However, if you get an email about a job that seems too good to be true, it probably is. Listen to your gut if there are warning signals, and be aware of your own vulnerability. Here's two courses of action you can take if you’re concerned that you may be the target of a recruiting scam:

1. If you're at all suspicious, visit the company’s website and send an email to their corporate email address. Candidates can also ping someone (like a Recruiting or HR lead) from the company on LinkedIn to ask them if the posting is real. Don't be shy – we would never penalize a candidate for asking us about a legitimate job opening. In fact, we would probably appreciate it as a sign of enthusiasm.  
2. Respond to the supposed recruiter with questions that require a 2-4 sentence response. Legitimate recruiters will be familiar with questions about company culture and the position, but someone with broken English or no affiliation to the company will struggle and may give themselves away. Some questions could be:

• What is unique about Kapwing’s company culture?
• What opportunities are there for growth in this role?
• How does this role serve the company’s mission?

Why Did We Get Targeted

I’m not sure why these crooks designed an elaborate scheme around Kapwing. One reason may be that we had a video creator position listed online a while ago. Since then, we’ve taken it down, but the evidence of the old job description still appears in various directories and credible job boards online like AngelList.

Video editing is a high-skill task that’s relevant for our business. It’s possible that these scammers run this playbook with video editing positions specifically and thought our company, with a fast growing YouTube channel and a big presence on Google as an online video editor, was a believable fit.

I also had a #hiring frame around my LinkedIn profile.

What To Do if Crooks are Impersonating Your Company

When we found out that scammers were impersonating me and Kapwing, we wanted to act immediately to keep vulnerable job seekers safe from thieves. Unfortunately, we couldn't take much action to report the issue. Here’s how we responded and how we recommend other startups respond if they’re the center of a recruiting scam:

1. Get back to people when they message/email you! We quickly wrote a canned response for our customer support email and prioritized scam targets to let people know this is not a legitimate opportunity. I responded to every one of the 13 video editors who sent me a LinkedIn message, and we asked each person to report the emails as phishing.
2. CEOs can post on their LinkedIn profile about the scam and publish a blog post to notify targets that search for these fake email addresses on Google.
3. Remove the “I’m hiring” frame on LinkedIn (temporarily). Ensure that outdated job postings are removed from live job sites.

How do other companies avoid ending up in this type of scam? And how are you supposed to respond if someone is impersonating you? I wish I had more that I could do to defend video editors who have been targeted.

I hope that this article helps people who might be targeted by this scheme and avoids theft. Please reach out to us at [email protected] – a legitimate email on the company domain – with any follow up questions or information! Or subscribe here to our blog to follow the startup journey.