この記事は日本語でもお読みいただけます。
Over the last six months, TokyoDev has received a handful of reports from our clients about fraudulent applications, in which candidates purport to be different people than they actually are. As a relatively niche job board that helped Japanese companies make 93 hires last year, the overwhelming majority of our applicants are real people. Nevertheless, this trend is disturbing.
All these reported scammers share one particular characteristic: they claim to be Japanese citizens living abroad, or recently returned to the country. One reason for this commonality is that our clients are actively seeking to hire more bilingual Japanese citizens, who are rather rare to begin with, so our clients are far more likely to interview these candidates than if they had claimed another, non-Japanese identity.
Reports to us have mentioned that they believe these scammers are North Koreans, a possibility that has been reported elsewhere. My theory is that these scammers are actually assuming a Japanese identity in order to target American and other international companies. The typical Western person won’t be able to easily differentiate whether someone comes from Japan or North Korea based upon appearance and English accent alone. Pretending to be Japanese saves them from having to use video or audio filters during interviews.
The end goal of these people is not entirely clear. At best, they want to get paid money directly. At worst, they’re performing industrial espionage or looking for opportunities to inject malware into their target’s network. Regardless, even if they’re all caught, the time they waste and the distrust they sow is incredibly harmful.
In this article, I’ll outline what I’ve witnessed and the measures we’ve taken so far. By compiling the signals we’ve seen, and our best techniques for catching scammers, we can hopefully stop companies who use TokyoDev (and even those who don’t) from actually hiring these candidates.
Attributes of a scammer
Besides claiming to be a Japanese citizen, these are other attributes common among scammers applying via TokyoDev. While these don’t guarantee that someone is a scammer, if an applicant has any of them, proceed with caution.
Resident of Japan with a US phone number
It is easy and cheap for anyone in the world to get a virtual US phone number, and use VoIP to answer it. This makes the numbers attractive to scammers, as they can say they’re based in the US and have a legitimate-looking phone number to prove it.
I’ve frequently seen scammers say they’re currently in Japan, but list a US phone number. While I suppose it is possible for someone to be a resident who has only recently relocated to Japan and not have gotten a local phone number, the chances of this are quite slim.
Non-existent Japanese phone number
The Japanese government places restrictions on who can get a phone number. To get a virtual phone number, you need to be a resident of Japan. Non-residents are able to get a Japanese voice SIM, but they must physically be in Japan to receive it and present ID when doing so.
While there is a black market to get around this, using it increases the cost and risk. Likely because of this, I’ve seen cases of scammers putting fake Japanese phone numbers on their resumes. If someone calls the number, the game will be up, so I guess they’re just counting on it never being called.
Senior candidate with a generic portfolio website
Scammers are usually trying to appear quite senior, with eight or more years of experience. Some of them will provide a link to a “portfolio” website, often hosted on a subdomain of a free hosting service, such as GitHub pages. The website usually feels very generic and just lists their skills and projects. It doesn’t have any unique content, like a blog.
I’ve seen legitimate junior candidates create something like this, but good senior candidates won’t waste their time. If they have any website at all, the most they’ll do to sell themselves is post a link to their resume.
Worked at famous companies, but most recent one is “anonymous” or “stealth”
I’ve seen scammers who will say they previously worked for famous big tech companies, such as Amazon, Google or Meta, but list their most recent employer as “anonymous.” I suppose they’re doing this to strike a balance between creating an attractive profile, and being able to withstand basic scrutiny.
However, legitimate candidates will normally list who their current employer is. I know of one scammer on TokyoDev who tried this tactic out, but later moved on to listing minor companies instead, perhaps because he realized pretending to be ex-FAANG made him too obvious.
What doesn’t work to catch them
Here are some techniques we’ve investigated that initially seemed promising, but won’t consistently catch scammers.
IP address-based detection
Some applications from candidates that claim they’re based in Japan do have non-Japanese IP addresses, but many fraudulent candidates also will have Japanese ones. Furthermore, those addresses often can’t be caught by VPN detectors; it appears that they are using residential Japanese ISPs. There are less ethical services that will provide you with a residential proxy, so it seems that these candidates have clued in and started using them.
Listing your job as “partially remote” or “no remote”
Even though these fraudulent candidates are based outside of Japan, I’ve still observed them applying for jobs that require candidates to come into the office. From talking to our clients, it seems like these candidates have a story about a sick relative or injury that they’ll use as an excuse for why they can’t come into the office initially.
What can catch them
While I can’t guarantee that these measures will continue to work, right now they seem the most promising.
Ask for a Japanese phone number
Virtually every resident of Japan has a Japanese phone number, so when screening candidates who claim to be in Japan, you can call the number they list or ask them to provide one if they don’t. For extra certainty, call the number while on a video call so you can confirm the person you’re interviewing is the one answering it. While not foolproof, from what we’ve observed, this is enough to stop at least some scammers.
Screen in both English and Japanese
Scammers sometimes pretend to be Japanese citizens to mask the fact that they speak English with an accent. This can be their undoing, though, as while they may be prepared to interview in English, it is unlikely that they can speak Japanese at a native level.
By screening candidates in both languages, you may be able to identify that their language ability doesn’t match their assumed background. Clients have reported that when they switch from speaking English to Japanese, scammers often just drop out of the call.
Use an identity verification service
It’s quite common these days, when signing up for apps that involve financial transactions, to perform some type of identity verification, where you upload your ID and also go through a facial recognition process to ensure your ID matches.
While it would be too expensive and invasive to ask all candidates to go through such a process, I think it is reasonable to have candidates do this before you onboard them, especially if you’re hiring someone to work fully remotely without ever meeting them in person.
Perform onboarding in-person
If a scammer outside of Japan somehow makes it through your whole interview process, they’re only going to start working with you if they can work completely remotely from day one. Even if your company works fully remotely, completing onboarding in person will most likely catch them. Travelling to Japan may be impossible for scammers, both from a financial perspective, and because they may not even be able to secure a visa to travel here.
Use an ATS with built-in fraud protection
I’ve observed that some Applicant Tracking Systems (ATS) are starting to offer fraud protection. I have similar qualms about this as using AI for screening, since legitimate candidates are unfairly going to be skipped over.
At the same time, ATS are the only ones in a position to solve this problem at scale. When you’re processing millions of job applications per month, the patterns of scammers become a lot more obvious.
If you’re already using an ATS provider, talk to them about how they can help prevent applicant fraud. Take note of how exactly they’re doing it, and make sure you also understand what sort of legitimate applications will be screened out by them.
What is TokyoDev doing about scammers?
As a job board, we’re in a bit of an awkward situation. On the one hand, we don’t want to be the source of scam job applications. On the other, we have a duty to uphold the privacy of our applicants, and also must follow Japanese regulatory requirements that prevent us from screening candidates.
This process only catches people applying via our own job application form. As about half of our job listings direct candidates to the company’s ATS, it does nothing to prevent fraudulent applications via those systems. While we considered maintaining a list of fraudulent candidates to share with companies, we eventually dismissed this idea both because of privacy concerns, and because we think it is unlikely that companies will actually verify candidates against it.
Beyond that, I think that education around this issue is what’s most likely to make an impact, which is why I’m writing this article.
Conclusion
I expect we’re just seeing the tip of the iceberg here, and things are going to get worse before they get better. Generative AI has been a great boon to scammers, making it easier to automate sending customized job applications as well as to pass the interviews themselves.
Just like email spam was once a huge problem, and then was largely resolved, this issue will probably follow the same pattern. Right now ATS are a commodity, and there are hundreds if not thousands of options to choose from, but the prevalence of scammers could lead to a handful dominating the space. Google is able to offer some of the best spam filtering because of the huge volume of email that moves through their servers; similarly, the ATS that process the most job applications will be in the best position to detect applicant spam. I think it would be a bad thing to have a few companies serve as gatekeepers for the majority of people changing jobs, but that also is likely to be the outcome.
This is one of the reasons TokyoDev supports our local tech community, both by holding our own events and sponsoring others. If you’re looking to hire developers, you can get involved too! You’ll be doing good as well as building up your own pipeline of candidates who are not scammers, and who already have a positive association with your brand.
