A ghost job posting is a fake vacancy created to lure applicants into sharing personal data, paying bogus onboarding fees, or exposing credentials. The role may never exist, or it may be used as a cover for broader fraud. The tactic targets candidates as well as employers.
What a ghost job posting is really doing
A ghost job posting is not just an empty vacancy. It is a deliberate deception that exploits the trust people place in recruitment, turning a familiar hiring process into a fraud channel for data theft, payment scams, or credential harvesting.
The tactic works because applicants expect a real employer, a real role, and a real workflow. When those expectations are abused, the listing becomes a social-engineering surface, not a normal hiring notice.
How ghost postings target applicants and employers
For candidates, the immediate danger is disclosure: names, contact details, work history, identity documents, banking details, or login material can be collected under the pretext of onboarding. For employers, ghost postings can also be used to impersonate the brand, damage hiring reputation, or funnel victims into a broader fraud operation.
The same pattern can serve multiple objectives. A fraudulent recruiter may harvest data, induce bogus application fees, or redirect victims to lookalike portals that capture credentials or payment information. The fake vacancy is the lure; the real objective is usually the downstream abuse.
Why the tactic succeeds
Ghost job postings are effective because hiring is one of the few ordinary business processes where strangers are expected to share sensitive information early. The scam benefits from urgency, optimism, and the assumption that a professional-looking posting has already passed some basic legitimacy check.
They also exploit process fragmentation. A posting may appear on one site, a recruiter may communicate on another channel, and onboarding may move to email, forms, or third-party portals that are hard for the applicant to verify. That handoff creates room for impersonation and inconsistent checks.
What organisations should verify and control
Employers should assume that public job ads are part of their external attack surface. The safest response is to make recruiting channels easy to verify, keep application workflows consistent, and ensure that candidates know which domains, email patterns, and portals are legitimate.
Applicants should be told not to pay fees, share sensitive documents too early, or reuse passwords on recruiting portals. Where hiring workflows collect personal data, the organisation should limit collection to what is necessary and be explicit about when and how identity checks happen.
Risk and Threat Considerations
Ghost postings create a direct fraud and identity-exposure risk because they use the credibility of a hiring process to elicit data, payments, or credentials. When the posting is tied to a real brand, the same tactic can also erode trust in legitimate recruitment channels and create reputational damage for the impersonated organisation.
Failure mechanism: The attacker relies on a believable vacancy, a plausible employer narrative, and a staged application or onboarding flow to persuade the target to disclose information or move off-platform into a controlled channel.
Impact: Victims may suffer account compromise, identity misuse, financial loss, or exposure of personal records, while the organisation may face impersonation complaints, candidate trust loss, and follow-on fraud investigations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 — Cybersecurity Supply Chain Risk Management | Recruitment fraud affects external trust and brand-facing processes. |
| PR.AA-01 — Identity and Credential Management | Ghost postings exploit credential and identity collection during hiring. | |
| Recommendation — Define approved recruiting channels and validate third-party hiring touchpoints. Restrict collection of sensitive applicant data to verified, legitimate workflows. | ||
| CIS Controls v8 | CIS-5 — Account Management | Applicants may be steered toward account creation or credential use in fake onboarding. |
| CIS-14 — Security Awareness and Skills Training | Candidates and recruiters need training to spot fake vacancies and onboarding fraud. | |
| Recommendation — Require verification before any hiring portal account or access path is trusted. Train staff to recognise recruitment scams and verify suspicious candidate interactions. | ||
| NIST SP 800-53 Rev 5 | PM-23 — Supply Chain Risk Management Plan | Recruitment channels and third-party job platforms can be abused as trust dependencies. |
| Recommendation — Document and govern third-party hiring channels as part of supply-chain risk management. | ||
Practitioner Guidance
Why practitioners should care: Recruiting fraud is often treated as a consumer problem, but it is also a brand and trust problem for the employer. Hiring teams should know exactly which domains, contact addresses, and application steps are official, and those details should be easy for candidates to confirm.
What to watch for: Pressure to act quickly, requests for payment, unusually early collection of sensitive documents, and shifts to unofficial communication channels are all warning signs. Candidates and recruiters alike should treat those patterns as a reason to verify before proceeding.
Practitioner takeaway: The strongest defence is clarity, make legitimate hiring paths easy to verify and make fraudulent ones easy to question.