PhishingCalendlyFacebookGoogleMeta
Scammers are sending job seekers fake interview invites with a link to what looks like a Calendly page for a call with a Meta recruiter. You pick a slot, then it asks you to log into Facebook and then Google “for security” — but the login windows are fakes, right down to a web address bar showing a real Facebook address. They grab your password and your 2FA code, and pass the code to the real site straight away, before it expires. Full write-up from Malwarebytes Labs.
The move
Booking a call never needs your Facebook or Google password — so if a job page asks you to log in, close it and check the invite by going to the company’s real careers site yourself.
Practise it: Would You Click? →
For teachers
Talking about this in class
This one’s aimed at job seekers, and older students looking for a Saturday job, work experience or an apprenticeship are job seekers too. An interview invite from a big name feels exciting, which is exactly what makes the lure work. Open with a scenario: someone in Year 11 has applied for loads of things, then gets an email inviting them to book a call with a Meta recruiter. What would make them pause before entering anything?
The misconception to tackle is “I’d spot a fake because the web address looks right.” These kits draw a fake address bar inside the page showing a real Facebook address. A good answer shifts the test from how it looks to what it’s asking: why would booking a phone call ever need you to sign into Facebook or Google, with your password or the login code those accounts send you? That’s the tell.
The habit to land: a login box that appears where it shouldn’t is the warning, whatever address or padlock it shows. Go direct: open the real careers site yourself. Swipe to Survive makes a quick starter: students sort scam texts from real ones by the pressure and what each one asks for, whether that’s a fee, a login or a code.
If a student says they’ve already entered details, lead with reassurance: they’re not in trouble and it isn’t their fault. Then the practical step: change that password, and anywhere else they use it, sign out of every other session, and check the recovery email and phone number haven’t been changed. A code can be passed on, so a passkey, where the account offers one, is the stronger lock. Then follow your school’s usual route for passing on a concern.