Pharma Bloodbath IX: You Are a Perfect Match for a Role I Will Not Name — the LinkedIn CV-Rewrite Scam

Dear #MoreThanCareer community,

It is now the most reported scam aimed at job seekers on LinkedIn. It adores the green #OpenToWork halo, and it gives itself away with one character: the one after the @. I read LinkedIn’s research, the Verbraucherzentrale warnings and far too many fake recruiter profiles so you do not have to. Augen auf (eyes open).

Today’s villain. The most reported scam aimed at job seekers on LinkedIn in 2026 is not the crypto thing or the WhatsApp thing. It is more elegant and far more insulting. Someone tells you that you are wonderful, asks to see your CV, then tells you that CV is the only thing standing between you and greatness — and that, for a small fee, they can fix it. The irony, which we will return to, is that I run a legitimate CV rewriting service, so I have spent a year watching people impersonate my whole profession with a Gmail address and the confidence of a man selling bridges. Let us ruin their afternoon.

First, the data, because “trust me” is what the scammer says too

According to LinkedIn’s own figures, over a third (37 per cent) of all job scams reported on the platform globally now involve offers to write or improve CVs — services that deliver poor or misleading results, often produced with free AI tools — and the people running them are twice as likely to drag you off LinkedIn into a private chat.¹ Thirty-seven per cent is not a fringe con. That is the market leader.

Why now? LinkedIn data cited in the UK shows roughly half as many openings per applicant as in 2022, and hiring jumps about 44 per cent each September as graduates flood in: twice the desperation, conveniently seasonal.¹ The platform’s own survey of 8,512 professionals across the US, UK, India, Germany and Brazil found 21 per cent say they were scammed and another 30 per cent had a near miss.² LinkedIn says it blocks 99.7 per cent of fake accounts before they are reported,¹ a figure I would find more soothing if the surviving 0.3 per cent were not all, apparently, in my messages.

How the scam works: a four-act play, performed nightly in your inbox

Act one: the flattery. A “recruiter” messages you, unprompted, to say your profile is a superb match for a role they are filling. This is the part designed to switch off the same instinct that would otherwise notice the account has only ten followers.

Act two: the CV request. They ask for your CV “to put you forward.” You send it, because that is a normal request, and because being asked feels like progress in a search that has felt like shouting into a well.

Act three: the diagnosis. The pivot, in two flavours. One: “Your CV is strong, but it will not pass my client’s ATS, your score is too low.” This is the “ATS Score” scam, and it works because so much genuine ATS panic floats around LinkedIn that the lie has camouflage.³ Two: “Your CV does not fit this client, it needs rewriting.” Either way the verdict is identical: what you wrote is broken, and brokenness is billable.

Act four: the upsell. Now the money appears. Either they sell you the rewrite directly (a modest fee, reimbursable once you are placed, naturally), or, more cunningly, they recommend a “trusted” CV writer who is in on it and pays a kickback.^{3 4} What you get back is a CV mangled by the same free AI tool you could have abused yourself, or nothing at all, or your data is now off-platform and in interesting hands.⁴ One exasperated target documented that the “resume writer” who messaged her had supermodel looks, a base in Japan, and three connections total — roughly the professional footprint of a houseplant.⁵

The principle, from the FTC, deserves a tattoo: legitimate recruiters do not charge you. Not for placement, CV review, training, or “background checks.”⁶ Recruiters are paid by the company that hires you. If someone in the hiring process asks you to pay, they are not in the hiring process. They are in the you process.

The single character that unmasks most of them: whatever follows the @

A real recruiter at a real company emails from that company’s own domain. If I write to you about More Than Career, it comes from andreas.schulz@morethancareer.de. Full stop.

Scammers cannot do this, because they do not own the domain, so they fake the look of it by smuggling the company name to the wrong side of the @. You get andreas.schulz.morethancareer@gmail.com, or, impersonating a real employer, andreas.schulz.bayer@gmail.com. At a glance, on a phone, your eye sees “Bayer” and relaxes. But the only part of an email address that means anything is the bit after the @, and there sits gmail.com, a mailbox any human on earth can open in ninety seconds.^{3 6}

The rule, in one line: a company’s name belongs after the @, not before it. “@bayer.com” is a company. “bayer@gmail.com” is a stranger who has heard of Bayer. No multinational runs senior recruitment from a free Gmail account.

Why the green #OpenToWork halo is also a target on your back

The badge tells real recruiters you are available. It also tells scammers, with a cheerful green ring, that you are available, anxious and checking your messages with the frequency of someone refreshing a delayed train app.^{4 5} The very signals you use to get found — the badge and the public “I was just laid off” post — double as a flare for bad actors scanning for the freshly vulnerable.^{4 6} I am not telling you to rip the badge off. For some of you it works. I am telling you that wearing it means switching on a second filter, because you have volunteered for the front of the queue.

Why pharma people get hit specifically

Our CVs are dense and genuinely hard to write well, so “your CV will not pass the ATS for this regulatory affairs role” sounds plausible to a pharmacovigilance professional in a way it never would to a plumber. The lie fits our anxieties like a tailored lab coat. We also have a large pool of international candidates who need visa sponsorship, which makes “I can fix your CV and get you sponsored, just pay this fee” land perfectly. No genuine German employer charges you to be hired or front-loads sponsorship behind a CV invoice. That is not an offer. It is Lehrgeld (tuition paid through painful mistakes), and the syllabus is regret.

The irony tax, which I am obliged to point out, being in the CV business

The richest part of this scam is what the fraudsters deliver: CVs rewritten by the same free AI tools their victims could have misused at home for nothing.¹ They charge money to launder a free product through a stolen identity. This is awkward for me, because I do sell CV and LinkedIn rewriting, and I would like you to tell me apart from the man in Japan with three connections. So here is the honest differentiator, free of charge. A real provider does not cold-message you pretending to be the hiring recruiter for a job that does not exist, does not invent a client to manufacture urgency, writes from their own domain, and lets you decide in your own time. The test is not whether someone offers a paid service. Plenty of legitimate people do, including me. The test is whether they lied to get there. Scammers always lie first and bill second. That sequence is the whole tell.

The international tour, since misery loves a comparison

DACH (home). A 2024 Greenhouse survey via Statista found German job seekers most often met fake offers on social media (35 per cent) and job portals (30 per cent).⁷ The Landeskriminalamt NRW and the Verbraucherzentrale stress the rule that matters: treat unsolicited contact, especially when you never applied, as the first red flag, and never hand over personal data.^{8 9} Vertrauen ist gut, Kontrolle ist besser (trust is good, control is better) was built for this.

United Kingdom. Ground zero for this variant: the CV-rewrite warning came from LinkedIn’s UK data, timed to the September graduate surge.¹

Rest of the EU. Same script, localised. Your one structural advantage is the GDPR: if you sent data in error, you have an enforceable right to demand its deletion, and German consumer bodies publish template letters for it.¹⁰

United States. The FTC’s “do not pay to get paid” is the cleanest defence ever written,⁶ and the US is where AI is dissolving the old tells: the FBI’s IC3 now flags AI-generated fake profiles and even deepfake video interviews, so “the message looked real” protects no one.¹¹

India and Southeast Asia. India’s Cyber Crime Coordination Centre logged about 22,495 crore rupees in cybercrime losses in 2025, with fake job offers an established category.¹² And one sober sentence amid the jokes: a large share of the global fake-job-offer machine runs from compounds in Southeast Asia, and the UN has documented that some of the people sending these messages were themselves trafficked there through fake job offers.¹³ When you block, report and move on, you decline to feed something genuinely dark.

The top seven things job seekers can actually do

1. Read the email address before you read the compliment. Make checking the @ a reflex; if the domain is not the company’s own, you are done.^{3 6} For junior and international applicants: this is your highest-leverage move. A real DACH offer comes with a written contract, a verifiable address, a domain-matched email, and zero upfront fees.

2. Decouple your CV from your panic. Your CV is almost certainly fine; the scam’s whole engine is convincing you it is not. If you want a real second opinion, get it from a provider you found and vetted yourself, not one who appeared in your DMs claiming to be the hiring recruiter.

3. Never pay anyone inside the hiring process, full stop. Placement, CV review, ATS work, training, “matching”: all free to you, because the employer pays the recruiter.^{6 14} Memorise the FTC’s four words: do not pay to get paid.

4. Treat verification as competence, not rudeness. A calm “happy to share my CV once you confirm the role and your company page” filters scammers instantly, because the fakes lose interest the moment you ask them to be real.²

5. Wear #OpenToWork with a second filter on. If it works for you, keep it, but accept you have moved to the front of the queue, so apply extra scepticism to anything that arrives because of it.^{4 5}

6. For executives and C-level: your risk is that your face becomes the bait. Deepfake interviews and cloned profiles increasingly impersonate real leaders to lend fake funnels credibility.¹¹

7. For the 50-plus reader: a direct word. The market already undervalues your experience, and the con weaponises that exact frustration with “your CV just is not landing, let me fix it.” Your CV is not why the market is hard; the market is hard. A real senior process is slow, named and human. A fast, flattering, fee-attached approach is an insult with an invoice.

If you already paid or already sent your data: damage control

No lecture and no shame, because shame is the silence the scam runs on. Stop all contact at once; anger is engagement, and engagement is data.⁸ If you paid by card or shared banking data, block the card immediately — in Germany via the central hotline 116 116 — and tell your bank to attempt a recall fast.⁸ Preserve everything: screenshot the conversation, the profile, the email header showing that domain, and any payment confirmations.⁸ Report it: file a police complaint (Anzeige), report the profile to LinkedIn, and contact the Verbraucherzentrale for guidance.⁸ If you sent your CV or ID, treat the exposure as ongoing: consider a new email address and phone number, watch for accounts opened in your name, and use your GDPR right to demand deletion.^{8 10} Then tell someone. Saying it out loud is the biggest favour you can do the next person.

For recruiters and hiring managers: do not look like the scam

The trust gap is your opportunity, because more than a third of recruiters report being impersonated.² Email from your verified company domain every time, and say so: in a market where the after-the-@ check is becoming standard candidate behaviour, name@yourcompany.de is now a competitive advantage, and a personal Gmail makes you indistinguishable from a fraudster.^{3 6} State your rules upfront: we never charge candidates, never request payment for CV work, never push you off-platform. And do not actually do the scammy-looking things, because the careful candidates you most want to hire are precisely the ones ghosting you out of justified caution.

The bottom line

This scam does not break in. You let it in, because it opens with a compliment, asks for the one document you are anxious about, then offers to heal the wound it just described. It targets the #OpenToWork badge, the freshly laid off, the visa-anxious junior and the underrated 50-something: the people who least deserve it and most want the nice message to be real.

The defence costs nothing. Read the email domain before you read the praise. Keep your CV away from anyone who arrived uninvited. Never pay a soul inside a hiring process. And the moment a “recruiter” turns your CV into a priced emergency, you have not met an opportunity. You have met a salesman in a borrowed coat.

Sources & References

[1] The Independent (via AOL) — Warning to job hunters on fraudulent CV-writing services (LinkedIn: 37% of reported job scams now CV-writing; free AI tools; 2x more likely to move off-platform; 99.7% fake accounts blocked; +44% September hiring): aol.com

[2] Outsource Accelerator — LinkedIn Job Search Safety Pulse / Censuswide survey of 8,512 professionals (21% scammed, 30% close calls; recruiter impersonation over a third): outsourceaccelerator.com

[3] Cybersecurity Intelligence — LinkedIn Recruiter Resume Scams (the “ATS Score” scam; email-domain mismatch; instant CV request): cybersecurityintelligence.com

[4] Delta CX / Debbie Levitt — Identifying Fake LinkedIn “Recruiter” Accounts (#OpenToWork targeting; paid-but-undelivered services; three-connections anecdote): rbefored.com

[5] BusinessToday — Beware! Fake recruiters targeting desperate job hunters (email domain must match; money requests; #OpenToWork exposure): businesstoday.in

[6] Rolling Out — 3 Signs your dream job offer is actually a scam (legit recruiters never charge; mismatched domains; “do not pay to get paid”): rollingout.com

[7] Statista, reporting Greenhouse Software (Germany 2024: 35% fake offers via social media, 30% via job portals): statista.com

[8] ZDF — Aktuelle Betrugsmasche: WhatsApp Job-Scamming (LKA NRW advice; block via 116 116; secure screenshots; new email and number): zdf.de

[9] Verbraucherzentrale — Gefälschte Stellenanzeigen: Was ist Job-Scamming? (updated 5 March 2026): verbraucherzentrale.de

[10] Verbraucherzentrale Niedersachsen — betrügerische Jobangebote and GDPR deletion template letters: verbraucherzentrale-niedersachsen.de

[11] JobScamScore — Job Scam Statistics 2026 (FBI IC3 on AI fake profiles and deepfake interviews): jobscamscore.com

[12] InsightsonIndia — Cybercrime in India 2025 (about 22,495 crore lost; fake job offers a recognised category): insightsonindia.com

[13] UNODC — Trapped in Scam Crime (fake job offers, including on LinkedIn, feeding trafficking in Southeast Asia): unodc.org

[14] FTC Consumer Advice — Job Scams (“do not pay to get paid”): consumer.ftc.gov

© 16 June 2026 Andreas Schulz. All rights reserved.