A remote job asks you to buy equipment from an ‘approved vendor’? Stop the payment

The process looks professional. The recruiter knows your résumé, the interview covers a real role and a contract carrying a recognized company logo arrives afterward. It is a remote job, so the new employee needs a laptop, phone and software. “Procurement” even has an approved vendor. The employer will supposedly cover everything — you only need to place the order quickly or forward an excess payment.

That is the moment recruitment turns into a financial transaction. A scammer may send a false transfer confirmation, a check that initially appears to clear or a promise of reimbursement after probation. The same group controls the equipment shop. The candidate pays real money, no equipment arrives, and the employer’s earlier payment disappears or is reversed.

The method exploits more than the desire to find a job. It targets the moment when a candidate wants to look capable, avoid “difficult” questions and protect a brand-new offer.

Equipment is the pretext, not the employee benefit

Honest employers organize remote work in different ways. They may ship a configured laptop, arrange collection, reimburse an agreed purchase against a receipt or pay a formally documented allowance. The mere presence of equipment does not prove fraud.

The boundary is crossed when the candidate must send personal funds to an unknown recipient, convert employer funds into gift cards or cryptocurrency, return an “overpayment,” or buy only from a seller provided in chat. At that point, the company is not supplying tools. It is using the candidate’s bank account and trust to route a payment.

Outside countries where checks are common, the story may use a fake transfer receipt, money from a compromised account, a person-to-person payment, card checkout on a planted site, cryptocurrency or a “courier fee.” The mechanism is unchanged: money you receive or see on screen does not create a safe reason to forward your own funds.

Why an interview and contract do not authenticate the employer

Fake recruitment does not have to look amateurish. A scammer can copy names of genuine employees, job descriptions, email signatures, social profiles and corporate documents. They may conduct a text or video interview and ask reasonable questions. Producing a polished contract and signature is no harder than producing a fake invoice.

The number of professional-looking elements therefore cannot replace independent verification. A document supplied by the recruiter confirms only what the recruiter wants you to see. Confirmation must come through a route they did not provide or control.

Moving the conversation to a private messenger raises the risk. WhatsApp, Signal or Teams alone does not prove fraud, but private messaging makes the sender’s domain harder to inspect and separates the process from the company’s recruitment system. Pressure to “complete onboarding today” reduces the time available to call the company.

A 15-minute test before any payment

First, close the message links. Find the company’s official website independently and open its careers section. Check whether the role exists, whether the location and duties match, and whether the company warns about recruiter impersonation. A missing listing is not always proof of fraud, but it needs an explanation.

Next, contact the switchboard or HR using a number and address you found independently. Do not use the contact details in the recruiter’s signature or contract. Ask whether the named person is running the process, whether the offer is genuine and how the company officially provides equipment.

Inspect the entire email address character by character. A lookalike domain, added hyphen or substituted letter matters. Even a real domain should not be your only evidence: accounts can be compromised and some companies use outside agencies. The strongest result is agreement between several independent elements — the listing, HR contact, named recruiter and procedure.

Finally, ask one plain question: why can the employer not purchase the equipment directly from its own vendor? If the answer is pressure, secrecy, a limit workaround, immediate cryptocurrency or an instruction not to speak with your bank, do not pay.

Signals that should stop the process

• an offer arrives without a voice or video interview and pays far above the market;
• the recruiter uses a personal address, a lookalike corporate domain or only a messenger;
• the official careers site does not list the role and the switchboard cannot confirm it;
• you must pay for equipment, training, a background check or shipping before work starts;
• you receive “too much” money and must return the difference or pay an outside vendor;
• payment must use gift cards, cryptocurrency, instant transfer or a personal account;
• HR paperwork requests banking details or an identity document before genuine hiring;
• asking for independent confirmation triggers a threat that the offer will be withdrawn.

No single item has to settle the question. A combination of payment, urgency and no independent confirmation is enough reason to stop.

“The money is in my account” may not close the risk

In some banking systems, funds from a check can appear before the bank finally validates it. When the check proves counterfeit, that credit is reversed, while the victim’s transfer to the “vendor” was real. This is the classic version described by US authorities.

Another version uses funds from a compromised bank account. Even a real transfer does not mean you can safely forward the money. You may be drawn into moving criminal proceeds. Do not make transactions on a recruiter’s instructions; inform your bank and establish where the funds came from.

A screenshot or PDF “confirmation” never proves a transfer was sent. Check only your own account, but remember that even settled funds do not tell you whether the sender had authority to use them.

What to do if you already paid or sent documents

Contact your bank immediately and describe an employment scam. Provide the recipient, amount, time and payment method, and ask whether the transaction can be stopped or recalled. If you paid through a card network, payment app, cryptocurrency exchange or money-transfer provider, report the fraud there as well. Speed matters, but recovery is not guaranteed.

Preserve the listing, messages, contract, domains, account number, invoice, recruiter profile and receipts. Report the listing to the platform, notify the real company and report the crime through your local law-enforcement or cybercrime channel. Do not keep the conversation going to investigate the scammer yourself.

If you sent an identity document, national identifier, selfie or banking information, treat this as identity-theft exposure too. Use your country’s identity-protection mechanisms, review account recovery channels and watch for attempts to open services in your name. If you installed “company software,” stop using the device for banking and have it checked by trusted IT support.

What a real employer can do

An employer should publish the addresses it uses for recruitment and a way to verify its recruiters. The equipment procedure should be clear in the offer or onboarding process without shifting payment risk to the candidate. If reimbursement is part of the agreement, the rules, limits and required evidence should be known before purchase, and the payment recipient should not be an imposed, unverified account.

HR teams should also remember that their names and profiles can be copied. A clear careers-page notice — for example, that the company never charges applicants and never directs gift-card or cryptocurrency payments — gives candidates a reference point.

What the sources confirm, and what Breachroad recommends

The US Federal Trade Commission’s job scam guidance describes fake employers sending a check and directing a candidate to buy equipment or return an overpayment. When the check is rejected, the bank seeks repayment of the full amount. The FBI warns that fake recruiters may charge for background checks, training, equipment or supplies and use domains that imitate genuine companies. These sources establish the underlying pattern, although exact payment methods differ by country.

The 15-minute test, independent-channel rule and adaptation to different payment systems are Breachroad recommendations based on that pattern. We do not assume that every employer reimbursing equipment is dishonest; we advise stopping when a candidate must finance an unknown recipient without independent confirmation. We separately cover the case where a recruiter asks for identity documents before an interview. We help organizations make genuine communication recognizable through cybersecurity training.