TRUVEXA’s analysis of confirmed job offer fraud cases has identified a near-universal conversation structure that appears across virtually all variants of this rapidly growing crime category.
The unsolicited approach. 94% of confirmed job fraud cases begin with an unsolicited WhatsApp message referencing the target’s LinkedIn profile or industry experience. The message uses the target’s correct name, current employer or professional area to establish credibility.
The premium opportunity framing. The fraudulent offer is always significantly better than market rate: higher salary, remote work, flexible hours, immediate start. TRUVEXA identifies “opportunity inflation” — offers that exceed realistic market expectations by more than 30% — as a high-risk signal.
The urgency and bypass pressure. Legitimate recruitment processes have defined timelines. Fraudulent recruitment consistently applies deadline pressure and asks targets to bypass normal verification steps — not applying through official channels, not verifying with the company directly, not using official email addresses.
The payment request. The scam culminates in a payment request framed as a security deposit, training fee, equipment cost or work-from-home setup fee. Legitimate employers never charge candidates.
TRUVEXA detected the Phase 3 pattern with 96.2% accuracy in confirmed job fraud cases. If you have received an unsolicited job offer via WhatsApp and any payment has been requested, stop all contact and report to cybercrime.gov.in immediately.