The job that hired you before you finished the interview

I. The Position Is Still Open

She found it on a Tuesday night.

Denise, fifty-one, had been out of work for four months. The layoff came in November, one of those Friday-afternoon emails where HR asks you to return your laptop by end of business. She had a mortgage, a car payment, and a daughter finishing her second year of college. She had applied to sixty-three jobs. She knew the number because she kept the spreadsheet on the same laptop she had mailed back in a FedEx box.

The listing said: Remote Customer Onboarding Specialist. $26 per hour. Flexible schedule. Start immediately.

The company name was a real company. A logistics firm. Mid-size, regional, the kind of name you have seen on the side of a truck without registering it.

She applied at 11:14 PM. By 11:47 PM, she had a reply.

Not an automated acknowledgment. A message. From a person named Kevin Marsh, "Senior HR Coordinator," sent from a Gmail address, asking if she was available for a brief screening interview the following morning via WhatsApp.

She said yes.

That was the intake form's first question. It was also the last one with a correct answer.

Read that next part carefully.

The interview lasted nineteen minutes. No video. Just text, through WhatsApp, Kevin Marsh typing questions in complete sentences with slightly formal punctuation. What is your availability? Do you have a quiet workspace? Are you comfortable handling customer data with discretion? Denise answered each one. Kevin told her she was an excellent fit. He said he would send the official offer letter within the hour.

The offer letter arrived in forty minutes. It had the real company's logo on it. It had a salary, a start date, and a benefits summary. It looked like every offer letter Denise had ever received in thirty years of working.

At the bottom, it said to complete the attached new hire packet to begin the onboarding process.

The packet asked for her full name, her home address, her Social Security number, her bank routing number and account number for direct deposit, and a clear photograph of her driver's license. Front and back.

She was at her kitchen table. It was almost 1 AM. She had a job.

She filled it out.

II. What the Packet Is For

Here is what the intake form is not for.

It is not for payroll. There is no payroll. There is no company. The logistics firm whose name appeared at the top of the offer letter has never heard of Kevin Marsh. Their actual HR department is in a building three states away, and their actual hiring process involves a phone screen, two in-person interviews, a background check run by a third-party vendor, and four to six weeks from application to offer.

What the packet is for is collection.

A Social Security number plus a bank routing number plus a copy of a driver's license is worth, depending on the market and the buyer, somewhere between $80 and $500 on a data broker's list. That is the floor. If the collector is sophisticated, the haul is used directly: a new credit card applied for in Denise's name, a tax refund redirected, a bank account drained.

According to the FTC, losses from job scams rose from $90 million in 2020 to more than $501 million in 2024. That is not the number of people who almost sent their information. That is the number representing money already gone, already wired, already converted to gift cards and handed across a drugstore counter. The average victim lost approximately $2,200 in 2023.

Five hundred and one million dollars does not come from one intake form. It comes from a machine that processes intake forms the way a factory processes parts. Volume. Standardization. The same offer letter, the same Kevin Marsh, the same nineteen-minute WhatsApp interview, running simultaneously in hundreds of tabs across hundreds of cities.

Denise was not a victim of a person. She was a victim of a process.

That distinction matters more than it sounds.

III. The Three Versions of This Crime

The intake form runs three variations, and it is worth knowing all of them because they do not always look alike.

The first is the information harvest. The new hire packet is the product. Once the SSN and bank account number are submitted, the "job" evaporates. Kevin Marsh stops replying. The listing disappears. Denise calls the real company and learns they have no record of her application. She has not lost money yet. But the information she submitted is already somewhere she cannot reach it.

The second is the fee extraction. Before the first day, the supervisor sends a message. Welcome to the team. To get you set up, we need you to purchase your remote equipment package. The cost is $350. We reimburse on your first paycheck. Please purchase Google Play gift cards from any major retailer, photograph the activation codes on the back, and send them to this number. Sometimes it is not gift cards. Sometimes it is a Zelle transfer. Sometimes it is a wire. The amount varies, $50 to $500, calibrated to feel like a plausible employment expense. The reimbursement never comes. Kevin Marsh stops replying. The listing disappears.

The third is the fake check. This one is the slowest and the most expensive. The new hire is told she will need to purchase her own office supplies and will be reimbursed through a signing bonus. A check arrives in the mail, or as a printable PDF, made out to her name, for $2,400. She deposits it. Her bank shows the funds as available, because that is how check clearing works: availability and actual collection are not the same thing, and most depositors do not know the difference. The bank is showing her a provisional credit. The check has not actually been verified yet. Within hours of the deposit, Kevin Marsh messages again. Good news, your check cleared. Now we need you to wire $1,800 to our equipment vendor to get your workstation ordered. She wires it. Three days later, the check bounces. The provisional credit reverses. She is out $1,800, and she is the one who initiated the wire, which means the bank's fraud protections are limited. The FBI flagged this exact pattern in a warning issued in August 2025.

Three variations. One intake form. Same nineteen-minute interview every time.

IV. Why It Works

Denise is not naive. That needs to be said plainly.

She has a work history that spans three decades. She has filled out real new hire paperwork before. She knows what a legitimate job looks like. What she did not know, at 1 AM after four months of unemployment and sixty-three rejections, was how precisely the machine had been calibrated to look like a legitimate job at 1 AM after four months of unemployment and sixty-three rejections.

The machine studies the conditions it operates in. Remote work became standard during the pandemic. Hiring without in-person contact became normalized. A text-based WhatsApp interview no longer strikes most applicants as inherently suspicious, because many real companies conduct first-round screens through chat or video. The machine updated to match. Fake offer letters carry real logos because those logos are freely available online and a scanner and a PDF editor can apply them in minutes. The Gmail address feels slightly off, but Kevin Marsh explains that the company is migrating their email system, which is why onboarding is running through personal accounts this quarter.

There is an answer for everything. Every answer sounds like something a real company might say.

McAfee reported a 1,000% increase in job-related scams between May and July of 2025. One thousand percent. That number reflects, in part, the arrival of AI-generated job postings, AI-generated offer letters, and in some documented cases, AI-generated interviewers, deepfake video calls where the face on the screen is not a person at all. The BBB reports that people aged 25 to 34 account for 28% of reported cases. People 65 and older face median losses of $2,299.

The machine does not discriminate by age or education. It discriminates by circumstance. It finds people at the bottom of a job search, or at the beginning of one, or in the middle of one, and it offers them something that looks like the end of one.

That is the design. Not predatory in the way a mugger is predatory. Predatory in the way a trap is predatory. It does not chase you. It waits where you are going and it looks like what you are looking for.

V. What Comes After

Denise reported it to the FTC. She filed a complaint with the Internet Crime Complaint Center, which is the FBI's online reporting portal for exactly this kind of crime. She called her bank. The routing number and account number she submitted had already been used to attempt a small test transaction, $1, to verify the account was live. The bank flagged it. She changed accounts. She put a fraud alert on her credit file, which means any new creditor must verify her identity before opening an account in her name.

She did not get her information back. There is no getting it back. Once a Social Security number is in a system that sells Social Security numbers, it stays in that system. She monitors her credit report now the way she used to monitor her email, regularly, expecting something.

She still needs a job.

The listing that found her that Tuesday night is gone. The Gmail address Kevin Marsh used now bounces. The WhatsApp number is disconnected. The intake form has been filed and processed and passed along to wherever those forms go, and the machine has moved on to the next Tuesday night, the next kitchen table, the next applicant who answered yes when someone asked if they were available tomorrow morning.

Picture the machine not as a person who woke up one day and decided to run job scams. Picture it as an infrastructure. A server somewhere, a template library, a rotation of company names, a roster of Kevin Marshes ready to be deployed. The FTC recorded more than $220 million in losses in the first half of 2024 alone. That is not one operation. That is an industry.

It does not need you to be foolish. It needs you to be tired and looking.

Most people, at some point, are both.

The intake form is still open.