Explainer: Employment fraud – resume scams, advance fees, and money mules

Natalie Detsik explains how resume upgrade scams lure jobseekers with fake roles, charge fees to “fix” their CVs, and can escalate to identity theft or money muling.

Introduction

Digital recruitment has made hiring faster, more international, and more accessible. The same infrastructure has also created an increasingly attractive environment for fraudsters by providing direct access to potential victims, extensive publicly available professional information, and a credible reason to initiate contact.

Modern employment fraud no longer relies solely on fictitious job advertisements. It can combine recruiter impersonation, personalised approaches, advance-fee mechanisms, identity theft, and, in more complex cases, the recruitment of victims as unwitting money mules.

One emerging variation can be described as Resume Upgrade Scams. For European banks, PSPs, fintechs, employers, recruitment platforms, and Financial Crime Prevention teams, understanding how the components interact is critical because a seemingly simple recruitment approach can evolve into a wider financial crime journey 

What is Employment Fraud?

Employment fraud is an umbrella term for schemes in which a real or fictitious employment opportunity is used to deceive a victim.

Fraudsters may impersonate legitimate employers, recruiters or executive-search professionals; reproduce genuine vacancies; advertise non-existent roles; construct an entire recruitment process around an opportunity that does not exist.

The intended outcome typically falls into three categories: 

• Money – obtaining upfront payment or repeated advance fees;
• Identity – collecting personal, financial or identification data for misuse;
• Accomplices – instructing purported employees to receive, transfer or convert funds on behalf of the supposed employer. 

A vacancy offered by employment fraudsters can therefore be much more than the subject of the scam. It can represent the entry point into a broader financial crime journey involving payment fraud, identity misuse, and money laundering.

The fraud journey – from resume upgrade scam to advance-fee scam to money mule recruitment

The fraud journey usually includes six stages:

1. Target sourcing and identification 

Fraudsters identify potential victims through professional networking platforms, job portals, social media, and publicly available sources. A professional profile can reveal employment history, seniority, certifications, specialist expertise, location, and whether somebody is actively seeking a new role. This information enables highly tailored outreach.

AI can further accelerate this process by helping fraudsters identify suitable targets and personalise (multilingual) messages at scale.

The fraud journey therefore often begins before the intended victim receives the first message.

2. Initial approach – employment fraud activated 

Once a target has been identified, the fraudster sends a personalised approach while impersonating a recruiter, a hiring manager or an executive-search consultant.

The message usually starts with positive feedback on the victim’s career and introduces a supposedly confidential mandate for which the person is presented as an excellent match. The opportunity is deliberately aligned with the victim’s real experience: a Compliance Director is approached about a Compliance Director role; a senior executive about an executive or Board mandate.

Specific employers, roles, projects or certifications may be referenced to demonstrate purported knowledge of the candidate’s background.

The purpose is straightforward: justify the unsolicited contact, reduce the victim’s vigilance and make the invented recruitment story credible.

3. Trust-building – grooming activated 

If the victim responds, the fraudster continues the dialogue by sharing a job description, discussing responsibilities, remuneration, reporting lines or high-level employer information. The conversation may unfold over multiple messages – with the “recruiter” repeatedly reinforcing the victim’s suitability for the role.

At this stage, the objective is not payment – it is credibility. By maintaining a consistent presence and building familiarity, the fraudster establishes the trust needed for the next stage of the scheme. 

4. Manufactured defect – resume-upgrade scam activated 

Once sufficient trust has been established, the victim will usually have shared their CV/resume with the fraudster. This is where a resume upgrade scam begins.

The “recruiter” suddenly identifies a problem with the document. The CV/resume apparently lacks critical keywords, is incompatible with the employer’s ATS (Applicant Tracking System), receives a low ATS score, fails to demonstrate sufficient “executive positioning”, or is simply not “Board-ready”. This contradiction is deliberate: the same professional profile that supposedly made the candidate a “perfect match” for the position is now presented as insufficient. 

Psychological pressure increases by introducing urgency – the victim may be told that a Board meeting, shortlist deadline or hiring decision is approaching and that the CV/resume must be corrected immediately. And the fraudster obviously holds the solution. 

5. Payment extraction – advance-fee fraud activated 

The solution appears at the same time as the problem – and from the same source from where the problem came.

The “recruiter” recommends a specific CV/resume writer, ATS optimisation service, certification provider, career consultant or similar specialist and presents the paid service as necessary for the application to proceed.

When the victim makes the first payment, the resume upgrade scam converges with the advance-fee fraud. The candidate pays today in anticipation of a future employment-related benefit: an optimised CV/resume, a job interview, placement on the shortlist or the job itself. The fraudster does not genuinely intend or have the ability to provide that benefit.

The first payment may be followed by further payments for CV/resume refinement, certifications, training, visa processing, or other supposed career services. The fictional role becomes a vehicle for repeated advance-fee extraction. 

6. Further exploitation – from victim to money mule 

The “candidate” can be exploited beyond money extraction.

Fake onboarding provides a credible reason to request passport copies, tax identifiers, bank details, and other personally identifiable information – thus creating opportunities for identify fraud.

In more serious cases, the “employee” may be instructed to receive customer payments, transfer funds, purchase cryptocurrency or process money on behalf of the supposed “employer”. A person who entered the recruitment as a jobseeker can become an unwitting participant in the movement of criminal proceeds.

This is where employment fraud converges with money mule recruitment. The victim may believe they are performing legitimate job responsibilities whereas in reality their account is used in a wider money-laundering chain.

Why should the European payments industry care?

Employment fraud can generate several financial events that are visible to banks, PSPs, fintechs and Financial Crime Prevention teams.

The fraud sequence may begin with a relatively modest payment to a resume writer or career-service provider. Further payments may follow – for certifications, training, equipment, administration. Identity information gathered at fake onboarding may facilitate additional fraud. If the victim was converted to a money mule, their account may receive and forward proceeds from criminal activity.

The challenge here is fragmentation: a recruitment platform may see the fraudulent recruiter. An employer may detect misuse of its brand. A PSP may observe the initial transaction. A fintech, a bank, and their

Financial Crime Prevention teams may identify suspicious flows in the client’s account. From all these stations’ separate perspectives, the events may appear unrelated. From the victim’s perspective, they are all parts of one story.

For Financial Crime Prevention teams, this suggests a broader analytical question:

“What happened to the customer before the suspicious transactions started to occur?”

Understanding the preceding recruitment narrative may help distinguish deliberate criminal facilitation from victimisation and thus expose wider fraud networks.

What are the warning signs?

Particular caution is warranted when:

• a vacancy cannot be independently verified;
•  the recruiter uses an email address or domain inconsistent the organisation they represent;
•  the candidate is told that urgent paid CV/resume improvement is required before the recruitment can proceed;
• one specific CV/resume writer, ATS specialist, certification provider or career consultant is presented as mandatory;
•  payment is requested before job interviews have taken place;
•  identity documents or banking details are requested unusually early;
• the supposed employee is asked to receive, forward, transfer or convert money. 

The following verification test is useful: verify the recruiter, the employer, the vacancy and the recommended service provider independently. And: never rely solely on the information coming from the supposed recruiter - diversify your sources of information.

What can organisations do?

Each organisation can help reduce employment fraud.

Employers can make legitimate recruitment channels easy to verify, post vacancies on official job platforms and direct jobseekers to their official career websites. Recruitment and professional networking platforms can focus on strengthening recruiter verification and detecting cloned or fraudulent accounts.

Banks, fintechs and PSPs can incorporate employment-fraud scenarios into customer educational warnings, payment interventions and money-mule detection.

Finally, Financial Crime Prevention teams can deliberately connect fraud and AML analysis and observe the customer's transactional behaviour in its entirety. Where unusual account activity pertains to an apparent employment relationship, the investigator should ask themselves: “What story is behind this type of behaviour, and how long has this been happening?”

Conclusion

Employment fraud is no longer presented as an obviously fake vacancy promising unrealistic earnings. Its emerging modern version is personalised, multilingual, patient, professionally presented and increasingly AI-enabled.

Resume upgrade scams embody this evolution particularly clearly. Combining a credible career opportunity, a manufactured professional deficiency and an apparently reasonable solution, they turn career ambition into an advance-fee payment - and potentially into identity theft, authorised payment fraud or money laundering.

Hence, when faced with a unique employment opportunity, the key question to ask is not only “Is this job real?” but also “Who benefits from the next step I am requested to take - and can I verify them independently?”

About the author

Natalie Detsik is a Financial Crime Prevention executive, international speaker and Founder & Principal Advisor of Guard & Grow Institute. She brings almost 13 years of experience across banking, payments, fintech and regulated financial services, with expertise spanning AML, fraud prevention, sanctions, transaction monitoring, customer risk, governance and regulatory remediation. Through Guard & Grow Institute, she advises organisations, delivers executive training and contributes to industry thought leadership on emerging financial crime risks. Natalie is also a frequent speaker and moderator at international compliance, fraud and financial crime conferences.