Security1 publisher2 min readPublished
LinkedIn lets verified employers strip fake staff from their company Page listings
LinkedIn now lets verified employers, which it counts at more than 700,000 companies, remove false staff from their Page's people list and search results. The impostor's profile keeps the claimed job, so the check protects only targets who look up a recruiter at a company they already know.
The Watch · Security desk
What happened
- LinkedIn now lets admins of verified company Pages remove people who falsely claim to work there from the company's associated people and from search results.
- Colleagues and classmates can confirm that someone worked or studied with them during the listed dates; the confirmation covers affiliation only, not ability.
- LinkedIn is testing a setting that would require anyone associating themselves with a company Page to verify their workplace, for example through a work email address.
- LinkedIn says its existing verification tools have verified 115 million members and more than 700,000 companies.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Removing recruiter impostors on LinkedIn now takes admin rights on a verified company Page, so a security team with no seat on its employer's Page has to go through whoever holds one.
- exposure A fake recruiter pulled from the people list still names the employer on their own profile, so their direct message looks unchanged to a target who never opens the company Page.
- constraint Pruning does nothing against recruiters from an invented startup, because the only admin on that Page is the scammer.
- exposure If the work-email requirement ships, a compromised mailbox on a company's domain becomes a route to a verified association with that company's Page, one form of the manipulated verification Malwarebytes expects.
The impostor's profile survives removal. According to Malwarebytes, the employer control does not delete the profile or erase the job claim from it [2]. Malwarebytes wrote that the new checks "may help someone determine whether a supposed recruiter is affiliated with a company they recognize" [7].
That help depends on the target recognizing the company. In recent research, according to Malwarebytes, criminals have posed as appealing new ventures as well as well-known companies. "They can invent a convincing startup, build a polished company Page, and use fake job listings or recruiters to lure applicants," the company wrote [8]. Its assessment is that the checks may be less helpful when the company itself is part of the scam [7]. Malwarebytes does not say how often recruiter scams borrow a real brand and how often they build a new one.
LinkedIn is responding to fakes getting cheaper. Generative AI lowers the cost of convincing headshots, biographies, resumes, outreach messages and recommendations, Malwarebytes wrote [10]. LinkedIn hopes four visible signals together will make a fabricated profile less persuasive: identity verification, workplace verification, peer corroboration and company Page controls [11]. Oscar Rodriguez, LinkedIn's VP of Product, told TechCrunch that the company has invested in verification because it believes authenticity will be the most valuable currency on the internet [6].
Those signals can be abused too. Malwarebytes warns that verified accounts, workplace affiliations and colleague confirmations may become more valuable to criminals. It lists three routes: stolen accounts, manipulated verification, and carefully constructed networks of fraudulent profiles [9].
The warning signs Malwarebytes gives job seekers are about behavior. They include unsolicited approaches, pressure to move the conversation off LinkedIn, requests to install software or share identity documents, and job offers that arrive before a credible interview process [12].
What to watch
- Whether and when LinkedIn takes the work-email workplace requirement out of testing; the source material gives no date.
- Reports of verified or peer-vouched LinkedIn profiles, stolen or purpose-built, turning up in recruiter lures, the abuse Malwarebytes predicts.
- Whether LinkedIn extends employer removal to flag or suppress the false employment claim on the impostor's own profile.