Aaron Fulton · Follow
6 min read · Sep 18, 2022
--
Today I received an email from a recruitment agency called surge staffing. My first through was cool! A head hunter has found me and has a fabulous role which will be perfect fit for my skills. I instinctively wanted to hit reply and start the conversation (Not that I’m actually looking to change jobs) but thought I should take a closer look. Before replying I thought it would be prudent to do some due diligence on the company before sharing all my personal details in my CV which I’m sure could be used for identity theft if they fell into the wrong hands.
This blog post explains some tools for doing due diligence on the company and how they helped me determine if they were legitimate or not.
Often there are giveaways in the email itself and includes things like spelling mistakes, bad grammar, or if the email reads badly.
Here is the email I received:
The email actually reads pretty well with no obvious spelling or grammar mistakes. “Senior Headhunter” is capitalized when it shouldn’t be but that is not really enough to be a red flag.
The first warning sign was in the email signature when the email is from “emma” listed both in the email header and the signature, however the email is signed “Julia Young”. Did the person forget their own name? Maybe they were sending on behalf of their boss (as they might if there were an Executive Assistant) but this does not look like it is the case.
The email appears like a standard copy and paste email but that in and of itself is not a reason to be concerned.
Legit : Scam ratio
0 : 1
On the surface the website appeared legitimate. But on closer inspection there were a few red flags. The first thing I look for is the contact information. So they are a recruitment agency but they have no phone number. That seems odd. How will customers contact them?
Legit : Scam ratio
0 : 2
On closer inspection when visiting the website, the URL changes from the .info address in the email to a .com. This means that they are using a different domain for their email than their main website. It is normal to use a companies primary domain for email, not a secondary one; in the case that this is a scammer might indicate that the .com address is blocked for scamming.
Lets check this by going to https://mxtoolbox.com/blacklists.aspx and checking both the .info and the .com address The results of this test interesting show that the .com was fine but the .info was blocked by a couple of sites.
Legit : Scam ratio
0 : 3
Does Google recognize the website for surge staffing?
Nope. Surge Staffing is a legit company but not website is different. This might mean that if this was a scammer they might be trying to pass themselves off as a legit company.
Legit : Scam ratio
0 : 4
By this stage a clear picture was emerging that the recruiter was was actually just a scammer. But for the sake of completeness, lets kept going with the due diligence. Does the company exist in a companies register?
The company should be registered in each country they operate in. I picked the Australian office as I’m familiar with the Australian companies website: https://connectonline.asic.gov.au/RegistrySearch/
hmmm. There appears to be no surge staffing. I tried a few different combinations but nothing showed up.
Legit : Scam ratio
0 : 5
I also tried to find their physical address. Again I looked up the Australia office. This appears to be a legitimate address but it is an office block which probably houses many businesses so while this is not a red flag, it is also not proof that they do have an office there.
Legit : Scam ratio
0 : 5
Next up is the security certificate. This can be accessed by click in the lock icon in the web browser. The site appears to be protected by Lets Encrypt — a popular free security certificate service. No red flags here but also no proof that the site is legitimate.
Legit : Scam ratio
0 : 5
My favorite test is to use the way-back machine. This is a website that periodically takes snapshots of pretty much the whole internet and stores them forever. You can browse back and have a look at any snapshot. If it is a long-standing company, you’d expect to see a history of pages going back some years. However, if it is a site which has just been stood up quickly as a front you’d expect to find no history. In this case there was no history.
Legit : Scam ratio
0 : 6
I could have also inspected the email headers for the DKIM and SPF checks, but I assumed that there were both going to be a PASS or else the email would not have ended up in my inbox. Sure enough, both a pass.
Legit : Scam ratio
0 : 6
Finally, if that was enough proof that this was a scam, a quick google search for “surgestaffing scam” bought up this blog post
Legit : Scam ratio
0 : 7
In conclusion this blog post outlines some tools you can use to identify if a company is legitimate or a scammer
Tool 1: Read the email carefully
Tool 2: Do they have a legit website and contact info?
Tool 3: Is the company recognized by Google?
Tool 4: Check the companies register
Tool 5: Check the Physical address
Tool 6: Security Certificate
Tool 7: Way back machine
Tool 8: Email headers
Tool 9: Search for “<company name> scam”
Surge Staffing is a recruitment scam so report them.
