Loading page
About this tool
Anatomy of fraudulent offer letters, fee demands and lookalike HR domains, with a scanner that weighs the same markers in any recruiter message.
This explainer takes a fraudulent job offer apart line by line — the selection with no interview, the salary that does not match the work, the "refundable" registration fee, the careers page on a domain the company does not own — and explains why each part is there. A scanner scores any recruiter message you paste against 13 weighted markers, including the task-based work-from-home pitch that leads into an investment scam, and inspects every link's registrable domain. The rule underneath all of it is simple: a genuine employer never charges a candidate to be hired.
Open Job Offer Phishing Anatomy on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Any request for a registration, training, ID-card or security fee scores 14 points on its own, because no legitimate employer asks for one.
Per-task earning offers, Telegram-only threads and USDT payouts are scored too, since that is where the largest losses come from.
Every rule executes in your browser, so a chat you are unsure about is never uploaded.
No. Legitimate employers and their recruitment agencies do not charge candidates anything — not registration, training, ID cards, background verification, a laptop or a refundable security deposit. Any fee demand, however small or however it is labelled, means the offer is fraudulent.
Look at the domain after the @ and the domain of the careers link, not at the words inside them. Genuine recruiters write from the company's own domain and link to its own site; a free Gmail or Outlook mailbox using the company's name, or a lookalike domain like nexora-careers-hr.online, is the whole tell.
Because "refundable" makes a small first payment feel reversible and therefore safe. It also sets up the next request: once the first amount is paid, further fees for verification, tax or release of the salary follow, and none of it comes back.
They are the entry point of an investment scam. Small payouts arrive for the first few tasks, then you are asked to deposit your own money to unlock higher-paying tasks, and the balance shown in the app cannot be withdrawn. If money has already been sent, call 1930 and file at cybercrime.gov.in; this is general guidance, not legal advice.