How the job fraud checker decides — and what it cannot know

1. What is checked

Six checks, run in order, each producing signals with evidence, a source, a timestamp and a confidence:

1. Evidence extraction. Email addresses and links are pulled from the pasted text so a reader who only pastes a message still gets the recruiter and job checks. Text from an offer-letter PDF is extracted in the browser and scanned like pasted text.
2. Company. The name given, or a brand named in the text, is matched against companies.json (63 employers, each with official domains and a careers URL where one resolved on 2026-09-15). States: verified (in the dataset), mentioned (named in the text only), not in dataset, not supplied.
3. Recruiter and domain. The address's domain is classed: official (the company's domain or a subdomain), free-mail (38 providers), lookalike (same label on another TLD; the company's label plus tokens such as -hr, -careers, -india; one or two edits away; the brand embedded in a longer label), government (gov.in, nic.in, bank.in and the other official suffixes), or corporate, not on file.
4. Job listing. The link's host is classed the same way, with two extra classes: listed on a job portal or social network (a place, not a verification) and chat link (wa.me, t.me).
5. Fraud patterns. 30 regular expressions over the text, line by line, in five categories. A same-line negation (“we never ask for any fee”) cancels payment matches on that line, so an employer's own warning does not score as a demand.
6. Impersonation. A brand from the dataset contacted from a free or lookalike address; a job link that imitates a verified domain; a government job offered from a non-government domain (halved when no contact domain was given at all).

2. How the risk score is calculated

Deterministic and additive. Risk signals add their weight within their category; each category is capped: payment 45, communication 30, documents 20, job 35, impersonation 30, recruiter 35. Trust credits — recruiter on the official domain 25, job link on the official site 20, company in the dataset 5, corporate (non-free) recruiter domain 5 — are subtracted, and halved when any payment signal is present. The result is clamped to 0–100.

The score is shown only when the coverage rule is met. With one field alone — a company name, a title — the page reports what it could not verify instead of a number. Any AI assistance a reader might add outside this page (to transcribe a screenshot, say) contributes text only; the score is computed here from that text by the same rules.

Every pattern, with its weight and source

Structural signals outside this table: free-mail recruiter 20 (30 when a brand is named), lookalike recruiter domain 35, recruiter domain on a low-cost TLD 12, job link on a chat app 20, shortened job link 10, job link imitating a verified domain 30, job link not on the named company's site 15, job site on a low-cost TLD 10, brand named but address not its domain 30, recruiter domain not the named company's 20.

3. Evidence limitations

• No network. The page cannot open the job link, fetch the company's site or query WHOIS; the site's security policy allows it no outbound connection, which is also what keeps your message private. “Established” therefore means “in the verified dataset”, not “registered years ago”.
• Dataset size. 63 employers is a seed. Absence from it is neutral. The Indian job market has millions of genuine employers who will show as “not in dataset”.
• Recruiter identity. A person's name cannot be verified here. Only the domain they write from can.
• Pattern matching. Regular expressions match words, not intent. Hindi and Hinglish are covered for the commonest phrases only. Wording the advisories do not describe is not detected.
• Files. Real-text PDFs are read; scanned PDFs and PDFs with glyph-id fonts are reported as unreadable. Screenshots are read only where the browser has a built-in text detector. No external OCR is loaded.
• No complaint data. Fraud reports are limited to advisories published by the impersonated employer or a government body. Complaint databases were not scraped: their terms of use and the complainants' privacy were not verified.

4. False positives and false negatives

False positives — a genuine offer scored MEDIUM or above: a small firm or consultant recruiting from Gmail; a genuine onboarding email listing Aadhaar, PAN and bank details for payroll; a job description that quotes a high daily rate for skilled contract work; a recruiter on a new corporate domain; a company fraud-alert page pasted in whole (its negations cancel same-line fee matches only). False negatives — a fraud scored LOW or INSUFFICIENT: a message that never mentions money until later; a fee demand phrased in a way the patterns do not cover; a lookalike domain of a company not in the dataset; a screenshot the browser could not read. This is why the level is a prompt to verify through the official channel, not a verdict.

5. “Unverified” is not “fraudulent”

Unverified means this page could not confirm something from its datasets. Not verified (✕) means the evidence contradicts the claim — the domain imitates a real one, the link opens a chat app. High-risk indicators detected means the message contains the specific patterns the employers and the government name as fraud. The page never says that a person or company is a fraudster: it shows the evidence and the arithmetic, names what it could not check, and tells you which official channel settles it.

6. Privacy

Nothing you paste, attach or type is transmitted, logged or stored. The engine, the datasets and the PDF reader are loaded with the page; the analysis runs in your tab; the site's Content Security Policy permits the page no connection to any other origin. Mobile numbers, Aadhaar numbers and PAN in your own text are masked in the result. No outcome logging is implemented in this version; if it is added it will be anonymised and limited to structured signals (which pattern ids fired, the level), never the text.

7. Datasets and sources

• career-data/fraud/sources.json — v1.0.0 · current · effective 2026-09-15 · review after 2026-12-15
• career-data/fraud/companies.json — v1.0.0 · current · effective 2026-09-15 · review after 2026-12-15
• career-data/fraud/patterns.json — v1.0.0 · current · effective 2026-09-15 · review after 2026-12-15
• career-data/fraud/indicators.json — v1.0.0 · current · effective 2026-09-15 · review after 2026-12-15
• career-data/fraud/reports.json — v1.0.0 · current · effective 2026-09-15 · review after 2026-12-15

Each dataset records its source, source URL, publisher, collection date, effective date, confidence, methodology and version. Sources:

• Infosys — Recruitment Fraud AlertInfosys Limited · employer-fraud-advisory · read 2026-09-15 · conf 0.9
  • “Infosys does not charge/accept any amount or security deposit from job seekers during the recruitment process.”
  • “Infosys never requests for fees for any purpose during or after the hiring process.”
  • “The hiring process involves at least one interview (virtual or in-person). Infosys will not request for an interview on any instant messaging applications.”
  • “The Infosys Recruitment team corresponds from email addresses with the domain “@infosys.com”.”
  • “In case any generic email ID ending with Gmail/Yahoo domain is copied while receiving a job offer or interview call, please be alert on the likelihood of a scammer.”
  • “The Infosys Recruitment team does not request or require personal documents like bank account details, tax forms or credit card information as part of the recruitment process.”
• TCS — Recruitment Fraud Alert (India careers)Tata Consultancy Services Limited · employer-fraud-advisory · read 2026-09-15 · conf 0.9
  • “TCS does not ask for any sort of payment or security deposit from candidates at any stage of the recruitment process.”
  • “The firm never sends out job offers from free internet email services like Gmail, Rediff Mail, Yahoo Mail, Hotmail, and so on.”
  • “Sends hiring emails via domain (@tcs.com) only”
  • “TCS does not approach through messaging apps, unofficial emails, social media, job portals, training, or agencies”
  • “Scammers often offer fake jobs and interview at TCS, promise to provide training, or falsely claim your selection through unsolicited messages on messaging applications like SMS, WhatsApp, or Telegram”
  • “Such fake offers are often followed by registration forms/admit cards, interview calls, appointment letters, and official-looking email IDs”
  • “TCS Helpline for recruitment fraud or queries: Phone Number - 1800-209-3111 Email Id - careers@tcs.com”
• MEA advisory — Indian nationals travelling to Cambodia and South-East Asia for jobs (reported by Akashvani News)Ministry of External Affairs, Government of India, via Prasar Bharati (newsonair.gov.in) · government-advisory · read 2026-09-15 · conf 0.8
  • “anybody who takes up a job in Cambodia should do so only through authorised agents approved by the External Affairs Ministry”
  • “fake jobs are for posts such as of ‘Digital Sales and Marketing Executives’ or ‘Customer Support Service’ by dubious companies involved in call-centre scams and crypto-currency fraud”
  • “recruiting Indian nationals by taking a simple interview and the typing test, and are offering high salaries, hotel bookings along with return air tickets and visa facilitation”
• Sanchar Saathi — Chakshu: report suspected fraud communicationDepartment of Telecommunications, Government of India · reporting-channel · read 2026-09-15 · conf 0.9
  • “Chakshu facilitates citizens to report the suspected fraud communications with the intention of defrauding telecom service users for cyber-crime, financial frauds, non-bonafide purpose like impersonation or any other misuse through Call, SMS or WhatsApp.”
• National Cyber Crime Reporting Portal and helpline 1930Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs · reporting-channel · reachable 2026-09-15 · conf 0.8
• eMigrate — registered recruiting agents for overseas employmentMinistry of External Affairs, Government of India · reporting-channel · reachable 2026-09-15 · conf 0.7
• Official careers pages — resolved on the collection dateEach company's own website · verification · read 2026-09-15 · conf 0.85

Reporting channels recorded: National Cyber Crime Reporting Portal · Helpline 1930 · Sanchar Saathi — Chakshu · eMigrate (MEA) · The company's own fraud-alert or careers contact. A dataset is never edited in place after publication: a change is a new version, the previous file is archived under fraud/historical/ and checksummed here.