Threat Advisory: Recruitment Scams Impersonating Legitimate Employers
August 31, 2026
As part of our ongoing threat intelligence monitoring, Culture Amp's Security team has been tracking a broader industry trend in which threat actors impersonate legitimate recruiters and organizations to distribute fraudulent employment contracts and job offers. These campaigns exploit the trust and reputation of established companies to deceive job seekers, and we're sharing this advisory to help other organizations and individuals recognize and respond to this activity.
Culture Amp was one of several technology companies whose name and brand were referenced as part of this campaign.
How the scam works
The primary objective of this activity appears to be identity theft. Threat actors leverage the reputation of well-known employers to trick candidates into surrendering sensitive personal documents (such as passports, driver's licenses, and government identification numbers) under the pretext of "mandatory background checks" or "onboarding" procedures.
Common indicators
Individuals should remain alert for the following signs that a job offer or recruitment approach may be fraudulent:
Unsolicited offers: Receiving a contract for a role that you did not apply for, or without completing a formal interview process.
Suspicious sender addresses: Correspondence that appears official but originates from generic domains (e.g., @gmail.com, @outlook.com) or subtly misspelled versions of legitimate company domains.
Early or urgent requests for sensitive data: Requests for identity documents, banking details, tax information, or other personal data unusually early in the recruitment process, particularly where pressure or urgency is applied.
Limited verification of the recruiter or organization: Recruitment conducted entirely through email, messaging applications, or other channels without a clear way to independently verify the recruiter or role. Offers extended without any formal video or in-person interview. Note that even a video call is not proof of legitimacy on its own. Deepfake and voice-cloning technology can be used to impersonate real interviewers, so a video meeting should be treated as one signal among several, not definitive proof.
Culture Amp hiring practices
For reference, Culture Amp follow these principles:
Genuine openings are advertised on cultureamp.com/company/careers
Sensitive personal documentation or financial information is not requested via email before a formal, multi-stage interview process is complete.
Official communications originate only from Culture Amp email domains.
Recommended actions
If you receive a suspicious job offer:
Do not click links or download attachments.
Do not provide personal or financial information.
Verify the offer independently before acting on it, contact the organization directly through its official website or a known, published phone number, rather than relying on any contact details provided in the offer itself.
Report it to the impersonated organization through its official channels, and consider reporting it to relevant national cybercrime or consumer-protection authorities.
If personal information has already been shared, we recommend contacting local authorities and monitoring credit reports for any unauthorized activity.
Example of a fake offer of employment
