I Got a Fake P&G Job Offer This Week. Here's What the Scam Looks Like Now

The email knew my name and the kind of work I do. It came from nicole.mcintosh@positionassessmentteam.com, about a Digital Media Manager role at P&G, and it skipped the pitch almost entirely. No description of where my name surfaced. No context about the team. Just a link to a private scheduling page already built for me, invitation token included, on a pages.dev address. The page that started loading carried my name in its title, above the words Opening the Scheduling Page.

Start with the sender domain, because that check takes ten seconds. P&G writes from pg.com. This message wrote from positionassessmentteam.com, a name that sounds like a department and belongs to no company you can look up. The whole approach rested on the part that looked right, the job title and the branding waiting at the other end of the link, while the one part that identifies the sender said nothing at all.

Three hops, and the ask grows at each one

I followed the link the way you test a suspicious package, in a browser I could afford to lose, entering nothing. Hop one was the personalized pages.dev loader. Hop two landed on work.talententrydesk.com, behind a Cloudflare human check, the same kind of check legitimate sites use to keep bots out. Hop three arrived at meetly.interviewschedulecenter.com, dressed up as a P&G Careers scheduler.

The form there wanted the role I was supposedly interviewing for, my full legal name (it stressed that the name had to match my identification), email, phone number, a date and time, my timezone, and a consent checkbox. Real scheduling software needs a name and a time. It has no use for a name that matches your government ID.

What waited after the form

The page code gave away the next step. After submission, the flow moved to a Verify your identity screen with a Continue with Facebook button, and its failure message coached the visitor to try a different Facebook account. A scheduling tool gains nothing from your Facebook login. A credential harvesting page gains everything from it, starting with the account most people reuse everywhere else.

Tucked into the same page sat a download that never fired on my visit: Interview Preparation Materials, delivered as a ZIP file. Dormant on this run. Present in the kit.

One specimen, and a very crowded pond

Volume explains why kits like this exist. Coverage of Monster's 2026 Job Scam Report put the share of surveyed job seekers who had seen a suspicious offer at 95%, with 53% saying they had been directly targeted and email the most common channel, cited by 65% of respondents. The money follows the same curve. The FTC's job scams guidance records reports tripling between 2020 and 2024 while reported losses climbed from $90 million to $501 million.

The end of the funnel varies. Some versions stop at personal details and an identity document. The BBC case in the Sources list below ended with a realistic video interview, a technical assessment carrying malware, and a victim who lost £18,000 in cryptocurrency. The opening move in that case and in mine is identical: a recruiter, a real company's name, and a link.

Four checks, about four minutes

• Find the job yourself. Type the company's name and the word careers into your browser, open the official site, and look for the role. If the opening only exists inside the message you received, treat it as fiction.
• Read the sender domain character by character against the company's real one. positionassessmentteam.com survives a glance. It does not survive a comparison with pg.com.
• Call a number you looked up on the company's own site and ask for the recruiter by name. Use no phone number and no link supplied by the message itself.
• Stop at the first ask for money, an identity upload before any offer, or a software download. The FTC's line on this is plain: honest employers never ask you to pay to get a job.

Report the message at ReportFraud.ftc.gov when you are done. It takes two minutes and it feeds the numbers quoted above.

If you own a business, your name is a costume too

Everything above works from the candidate's chair. Flip it around and a small business has its own exposure: your company name, your logo, and your open roles are the raw material these kits consume, and the victim who loses money will remember your name as the one on the page. You cannot stop impersonators from copying a logo. You can give candidates a way to check that does not depend on trusting the message in front of them.

That way is a page on your own domain, and building it is an afternoon of work. Mine would say three things for a client: where jobs are actually posted, the single email domain real messages come from, and what the business will never ask a candidate to do, with downloads and identity checks before an offer named outright. Pair it with email sent from your own domain, set up so it passes the authentication checks in our deliverability guide, and a candidate holding a suspicious message has two independent ways to test it. Our small business cybersecurity baseline covers the rest of the setup that keeps your own accounts out of an impersonator's hands.

Two days after the email arrived, I requested the first link again. It answered HTTP 200, loader intact, and the page markup carried its own template tag: interview-loading-access-v6. Version six. The kit had been revised at least five times before my name ever went into it, and the scheduling page it builds is ready to rebuild itself around whoever is next in the list.

Sources

• FTC, Job Scams: warning signs, the rule that honest employers never charge candidates, and reporting at ReportFraud.ftc.gov
• Allwork.Space on Monster's 2026 Job Scam Report: 95% saw a suspicious offer, 53% directly targeted, email the top channel at 65%
• BBC News, September 2026: fake interview funnel ending in a malware laced assessment and an £18,000 cryptocurrency loss