Got a random job offer text? Check the company's real domain first

"Hi! We reviewed your profile and would love to offer you a flexible remote role. Interested? Just reply YES." No link, no attachment, nothing obvious to click. That last part is new, and it's the part designed to slip past your guard. Before you reply to a random job offer text, there's a thirty-second check that tells you whether the sender actually works where they claim.

Why the "just reply YES" version is sneakier

For years, the advice about scam texts was simple: don't click the link. So scammers adapted. The FTC's April 2026 consumer alert describes the newer version plainly: instead of asking you to tap a link, the message asks you to reply YES or INTERESTED. A local news report from ABC7 Los Angeles puts it the same way: scammers promise a paid opportunity "as long as you reply yes."

Replying feels harmless. There's no dangerous website to land on, no file to open. But a reply does two things for the scammer: it confirms your number is live and answered by a real person, and it opens a conversation they can steer. From there the pitch moves off the text app, usually to a chat app or email, where the actual scam plays out.

What the job actually turns into

The FTC alert walks through where these conversations lead. Two patterns come up:

• Fake-check scams. You're "hired," then sent a check to deposit, told to buy equipment or send part of the money somewhere. The check later bounces, and the money you forwarded is gone, out of your own account.
• Task scams. You're paid small amounts to do simple "tasks," like leaving positive ratings or reviews, until at some point you're asked to deposit your own money to "unlock" bigger earnings. That deposit is the whole point.

The FTC's bottom line is worth memorizing: real employers don't recruit you out of the blue by text, and you should never have to pay to get paid.

How common is this?

It isn't a fringe problem. Per ABC7's September 18, 2025 report, citing reported data, more than 235,000 text message scams were reported in the U.S. in the first half of 2025, resulting in $342 million in losses. The same report notes that in the first quarter of 2025 alone, the FTC logged about 29,000 reports of job or employment text scams.

(A note on where those numbers come from: they're from ABC7's reporting from September 2025. The FTC's own April 2026 alert, which describes the "reply YES" twist, doesn't itself publish these figures, so we're attributing the counts to ABC7, not to that alert.)

The one check that cuts through it: does the recruiter's domain belong to the company?

Most of these messages name a real, recognizable company, because a familiar name lowers your guard. So the fastest test isn't "is this text suspicious?" It's "does the person contacting me actually work where they claim?" And the honest answer lives in one place: the domain after the @ in their email address.

A real recruiter at a company emails you from that company's own domain. A scammer impersonating it can't, so they improvise: a free inbox (@gmail.com, @outlook.com), or a lookalike domain that reads like the brand but isn't.

The display name is no help here. "Careers Team at [BrandName]" is just free text; anyone can type anything there. Only the domain after the @ ties a message to a real organization. (The one-minute sender check walks through where that address hides in your inbox.)

Check it by hand, in under a minute

1. Don't reply yet. Not even "YES." A reply confirms your number is live and starts the conversation the scammer wants.
2. Find the company's real website yourself. Search for the company name and open its official site directly, don't use any link from the message. Note the exact domain in the address bar (for example, company.com).
3. If you were given an email address, look at the part after the @. Does it match the domain of that official website, character for character? A real recruiter's address ends in the company's own domain. A free inbox or a near-miss spelling is a red flag.
4. Watch for lookalikes. c0mpany.com (zero for the o) or company-hr.com (an extra word bolted on) are not the same as company.com. Read the domain slowly, letter by letter. We've dissected the letter-swap trick and the one-letter-off fakes in their own posts.
5. Verify the opening through the front door. If the role sounds plausible, go to the company's real careers page or call their listed number. If the job exists, you'll find it there. If it doesn't, you have your answer.

How IP Tracker speeds this up

IP Tracker is a free Chrome extension. Paste a domain, or a full email address, into the popup and it does the boring parts of the check for you. The free tier gives you 25 checks a day, with no account and no tracking. Only the value you paste is looked up.

Paste the recruiter's email address and it extracts the domain after the @ automatically, then runs a few checks at once:

• Lookalike detection. It normalizes look-alike characters (a zero standing in for the letter o, a capital I for a lowercase l, and common Cyrillic twins) and compares the result against the official domains of more than 120 widely impersonated brands. A dressed-up impostor domain gets flagged, with a banner naming the trick.
• Google Safe Browsing. Whether Google's list of reported dangerous sites has flagged the domain.
• Reputation signals. How many security vendors flag it on VirusTotal, community abuse reports, and the domain's creation date. A domain registered days ago, dressed up as an established employer, is worth a raised eyebrow.

None of that clicks anything or sends a reply. It just gives you a plain-English read on the domain before you decide whether to engage.

What can't it do?

Honesty matters more than comfort here, so a few limits worth knowing:

• It checks a domain, not a job. IP Tracker can tell you a domain looks like a known-brand impostor, or that Safe Browsing has flagged it. It can't tell you whether a given remote role is legitimate. A clean domain doesn't mean the offer is real.
• Plain free-inbox addresses aren't "bad domains." gmail.com is a real, clean domain, so it won't be flagged as dangerous. But a recruiter for a real company emailing you from a personal Gmail is still a reason to slow down. That judgment is on you.
• The brand list is about 120 brands. The most impersonated ones, not every company. A lookalike of a smaller employer may not match the list.
• Blocklists lag. Google Safe Browsing is strong on known bad sites, but a brand-new scam domain takes time to get reported and listed.

The "reply YES" text works by making the first step feel free. It isn't. Treat an out-of-the-blue job text the way the FTC suggests: assume real employers won't reach you that way, don't reply, and confirm the company and the recruiter's domain on your own before you engage.

To summarize:

• ✓ Don't reply, "YES" is the new "click."
• ✓ Find the company's real website yourself, never from the message.
• ✓ Check the recruiter's email domain against that real website, letter by letter.
• ✓ Never pay to get paid, and real employers don't hire cold by text.
• ✓ Or paste the address into IP Tracker and let it flag the obvious tricks.

Stay sharp! 😎