A recruiter sends a file or asks you to install an app: what to check first

A familiar-looking file is not proof

A recruiter may legitimately send a calendar invitation, job brief, presentation task or meeting link. But company logos, polished language and a plausible role title can be copied. Government cyber-security advisories have documented fake job offers, technical interviews and coding tasks used to steal credentials, funds or sensitive information.

Start with the hiring relationship, not the attachment. Can you find the same vacancy on the employer’s own careers page? Does the sender’s address match a real company domain? Can you reach the organisation using contact details you found yourself? If not, do not use the message as your only source of truth.

Check a remote interview invitation link before you join →Verify the vacancy before you share information →

Match the requested action to the hiring stage

A simple interview confirmation rarely needs broad control over your computer. Be extra careful if a first contact asks you to install remote-access software, disable security controls, use a personal email account, transfer money or provide identity and bank information before there has been a normal interview and verified offer process.

CISA advises caution with email attachments even when the sender seems known. That is not a reason to treat every attachment as malicious; it is a reason to verify independently when anything feels unexpected. Ask the recruiter to place the material in the official applicant portal or to confirm the file name and platform through a verified company channel.

• A meeting link or calendar invitation from the same verified recruitment system you already used.
• A document with a clear purpose that matches the role and stage of your application.
• A software request that names the provider, permissions and support contact before installation.
• A route you can confirm through the employer’s official careers site or existing applicant portal.

Use a safer way to inspect an unexpected attachment

Do not rely only on the displayed sender name. Compare the full email domain with the employer’s official site, and inspect the link destination before opening it. If a file type, password-protected archive or installation request is unexpected, pause and ask for confirmation through a known channel rather than replying to the same message.

Keep your operating system, browser and security software current. Avoid enabling macros or changing device security settings merely to open a recruitment file. If a legitimate assessment needs specialist software, it should come with a clear explanation, a recognised vendor route and a way to contact support.

Know why remote-access software needs extra scrutiny →Secure the email account you use for applications →

If you opened it already

Do not panic or assume that opening a message automatically means your device is compromised. Disconnect from a suspicious process if you still can, avoid entering credentials or payment details, and document what happened. Run the normal security checks available on your device and contact your workplace or personal security support where appropriate.

If you shared a password, change it from a trusted device and turn on multi-factor authentication where available. If you sent money or sensitive financial information, contact the payment provider promptly and use the relevant fraud-reporting route in your country.

Recruitment-file safety checklist

• Confirm the vacancy and recruiter through an official route you find independently.
• Compare the sender domain and link destination with the employer’s genuine domain.
• Ask why a file or app is required at this exact hiring stage.
• Do not install remote-control tools, disable security settings or enable macros because of an unexpected message.
• Use a verified applicant portal or known support route when you need confirmation.
• Never pay for a job, interview tool, training file or equipment order.
• Save evidence of suspicious messages and report fraud through the relevant official route.

Use the broader remote-role verification framework →Browse current checked roles →