A recruiter says a biotechnology company wants to hire you as a remote translator for $30 an hour. The message names real people and moves the interview to Teams or Zoom.
The offer looks much weaker when one detail is checked: the sender is not using the company’s domain.
Overview
The email borrows a real biotechnology company’s reputation
A job seeker reported receiving an unexpected offer for a remote translator position at “Arctoris Biotechnology Ltd.” The recipient did not remember applying.
The email promised $30 an hour, paid training, performance bonuses, and customer-satisfaction bonuses. It directed the applicant to add someone named Steven on Microsoft Teams or Zoom and supplied career@arctoris.info as the contact.
Arctoris is a real biotechnology company. Its official website, careers page, and published contact information use arctoris.com, not arctoris.info.
Real employee names do not authenticate the sender
The message was signed by “Sally” and pointed to “Steven.” People with those first names have appeared in public Arctoris materials, which makes them easy for an impersonator to find and reuse.
Searching a name and finding a genuine employee proves that the person exists. It does not connect an unrelated email address or Teams profile to them.
Teams and Zoom are tools, not proof of employment
Real employers use both services, but anyone can create a display name, profile image, or meeting link. A private chat keeps the applicant away from the company’s switchboard and official hiring system.
Warning signs include:
- The recipient did not remember applying for the role.
- The sender used
arctoris.infowhile the real company usesarctoris.com. - The interview moved immediately to a private Teams or Zoom contact.
- The attractive pay and bonuses appeared before qualifications were discussed.
- Real employee names were offered without an independently verified contact.
- No matching vacancy appeared through the official careers route.
- The applicant was expected to trust links and addresses inside the suspicious message.
- Personal documents or payroll details could be requested before a real interview.
A genuine employer will not object when an applicant confirms a surprising offer through the company’s official website.
How the Arctoris.info Recruiter Scam Works
Step 1: A real, specialized company becomes the cover
Biotechnology firms publish leadership names, research areas, office locations, policies, and polished branding. Those details give a fake recruiter enough material to write a convincing introduction.
When the applicant searches the company name, genuine results appear and lend credibility to a message the company did not send.
Step 2: A lookalike domain controls the replies
The difference between arctoris.info and arctoris.com is small on a phone. The visible company name can be correct while every reply travels to infrastructure outside the real employer.
Companies sometimes own several domains, but the relationship must be confirmed through the main corporate site, not asserted by the alternate domain.
Step 3: Attractive terms create momentum
Remote work, clear hourly pay, paid training, and bonuses answer the questions job seekers care about. The pitch may say the vacancy is urgent, encouraging the recipient to contact the interviewer before checking the source.
The $30 rate is not impossible. It is valuable enough to keep the applicant engaged and ordinary enough to avoid sounding like a lottery win.
Step 4: Public employee names become props
A scammer copies names from a staff page, press release, or professional profile. The email signature and chat account then appear to match real people.
Only the real employee’s official company address or confirmation from Arctoris can link that person to the offer.
Step 5: The interview moves away from official systems
The applicant is told to add a username or join a private meeting. The “interview” may happen entirely by text, allowing the operator to follow a script and avoid showing a face.
A legitimate remote interview can use Teams or Zoom, but it should connect to a verified corporate email and a vacancy the company recognizes.
Step 6: The applicant is asked for something valuable
The next demand may be a passport, Social Security number, bank information, payroll form, background-check fee, or money for home-office equipment. A fake check may be supplied to make the purchase look funded.
The original report stopped before every possible demand was documented. Treat these as common branches, not proof that each one occurred in this case.
Step 7: The company name is discarded when challenged
If the applicant contacts the real company or questions the domain, the recruiter may claim to be a contractor, switch email addresses, rush the deadline, or disappear.
Another fake employer can reuse the same interview script with only the names and logo changed.
The Domain Check That Breaks the Story
Open the real Arctoris careers page by typing the address or reaching it through a trusted search result. Compare the listed vacancies, application links, and contact domain with the email.
The company’s official about page consistently uses arctoris.com. An email from arctoris.info does not inherit that website’s credibility merely because the word before the dot is identical.
Inspect the full sender address, reply-to address, and every link. Display names can say “Arctoris Careers” while replies go elsewhere. A button can display the official domain but open a lookalike page.
Check when the alternate domain was registered and whether it publishes a real company identity. Recent registration, hidden operators, thin pages, or no long-term history strengthen the impersonation concern.
Do not test the email by replying with questions. Contact Arctoris through a phone number or form on arctoris.com and ask whether the vacancy, named recruiter, and arctoris.info domain are authorized.
How a Fake Job Can Cost Money
An equipment scheme sends a counterfeit or reversible check and instructs the applicant to buy a laptop from an approved vendor. The “vendor” is controlled by the scammer. When the check fails, the purchase remains the applicant’s loss.
A payroll scheme collects bank details and identity documents. The information may be used for account fraud, new accounts, tax fraud, or more tailored phishing.
A background-check variation charges a fee or sends the applicant to a site that harvests card information. Real employers may run checks, but the provider, consent, and payment policy should be verified with HR.
Some fake recruiters ask the applicant to receive payments, purchase cryptocurrency, or forward packages. That turns the “employee” into a money or parcel mule.
The FTC’s job scam guidance warns that honest employers do not ask candidates to pay for a job or deposit a check and return money.
MalwareTips has seen similar tactics in the fake pharmaceutical interview scam and fake data-entry offers that collect payroll information. The industry changes; the payment and identity requests remain.
A Seven-Minute Recruiter Check
First, match the offer to an application. If you did not apply, ask how the recruiter obtained your details and which public profile or referral they used.
Second, find the vacancy through the employer’s own careers page. Do not use the link in the message.
Third, contact the company using an independently located number or email. Verify the recruiter, role, alternate domain, and interview account.
Fourth, search a distinctive sentence from the email. Identical wording attached to several employers suggests a recycled scam script.
Fifth, decline to send identity documents, bank data, or money until a live interview and corporate confirmation occur. A legitimate recruiter can wait for a reasonable security check.
What a Real Hiring Trail Should Contain
A legitimate vacancy has a department, hiring manager, location or remote-work jurisdiction, job description, application record, and privacy notice. Each part should lead back to the same legal employer.
The recruiter’s message should explain how the applicant was found. If a staffing agency is involved, both the agency and Arctoris should be able to confirm the relationship.
A live interview should involve people whose company addresses and roles can be verified. Text-only interviews are not automatically fraudulent, but they make identity easier to fake and should trigger stronger checks.
Contracts should identify the legal company, registered address, duties, compensation, governing law, and signatures. Check those details against official company records rather than trusting the logo in the document.
Payroll enrollment comes after the offer and identity of the employer are established. It should use a known HR system or secure portal, not a form attached by an unverified recruiter.
Equipment should come from the employer or a documented reimbursement program. A candidate should never deposit a check and send money to a vendor chosen in private chat.
References work both ways. Applicants are entitled to ask who will manage them, where the team sits, and how the role fits the company. Vague answers are not normal merely because the job is remote.
If You Already Sent Documents
Make an inventory of every item shared: passport, driver’s license, selfie, tax number, bank form, address, signature, and account login. Different data creates different risks.
Notify the issuing authority when an identity document may be abused and ask what monitoring or replacement is appropriate. Place credit freezes or fraud alerts where your country provides them.
Tell banks that a fake employer collected payroll information. Ask them to add notes, monitor new payees and transfers, and replace account details if exposure is serious.
Watch for follow-up messages that quote the documents back to you. Possession of accurate identity data does not make the next caller a bank, police officer, or recovery investigator.
Review credit reports and government accounts for unfamiliar activity. A fake recruiter may wait before using the information, so one quiet week does not close the risk.
Tell the real company what was shared. Its fraud or legal team may recognize the campaign and can publish warnings that help other applicants avoid the same domain.
Keep the original email intact because its full headers may identify sending infrastructure that a screenshot cannot show.
Company, Address, and Fulfillment Checks
The real company uses arctoris.com
Official careers and corporate pages use the .com domain. The .info sender needs confirmation from the real company before it can be trusted.
A real office address can be copied
An address taken from Arctoris materials proves where the company operates, not who sent the email. Verify the sender through that company’s official channel.
The named recruiter must be confirmed
Finding Sally or Steven online is not enough. Ask Arctoris whether the exact person, account, and vacancy are part of its hiring process.
Fulfillment means verifiable employment
A real job produces a confirmed manager, contract, duties, payroll route, and wages from the employer. A private chat promise does not.
What to Do if You Have Fallen Victim to This Scam
- Stop contact and payments. Do not buy equipment, pay a background fee, return check funds, or complete financial tasks.
- Contact the bank. Report fake-employer fraud if you deposited a check or shared account information. Ask about stopping transfers and replacing exposed accounts.
- Preserve the evidence. Save the full email headers, sender and reply-to addresses, Teams or Zoom profiles, files, contracts, payment details, and messages.
- Notify the real Arctoris. Use
arctoris.com. Give the company the lookalike domain and names being used. - Protect identity documents. Place fraud alerts or freezes where appropriate if you shared passport, national ID, tax, or Social Security information.
- Secure email and job-board accounts. Change reused passwords, revoke sessions, enable multi-factor authentication, and review account recovery details.
- Scan suspicious downloads. Use Malwarebytes if you opened an interview file, installed software, or allowed remote access. Recover passwords from a clean device.
- Block malicious pages. AdGuard can reduce exposure to known scam and advertising domains, but it cannot verify a recruiter or make a fake check valid.
- Report the campaign. Notify the job board, email provider, meeting platform, domain registrar, ReportFraud.ftc.gov, and IC3.gov.
- Reject recovery offers. Do not pay anyone who promises guaranteed deletion of your data or recovery of equipment money.
Frequently Asked Questions
Is Arctoris a real company?
Yes. The concern is an offer using arctoris.info, while the real company’s published domain is arctoris.com.
Do real employee names prove the email is genuine?
No. Names and roles are public and easy to copy. Confirm the sender with the company through its official contact route.
Can a real recruiter interview through Teams?
Yes. The meeting should still connect to a verified company email, recruiter, and vacancy. Teams alone authenticates none of them.
Is $30 an hour proof of a scam?
No. The rate is plausible. The unsolicited offer, mismatched domain, and unverified interview identity create the risk.
What if arctoris.info is a recruitment partner?
Ask Arctoris to confirm that relationship through arctoris.com. A partner claim made only by the alternate domain is circular proof.
Should I send ID after receiving a contract?
Not until the employer, recruiter, vacancy, and secure HR process are independently verified. A polished contract can be copied or fabricated.
The Bottom Line
The Arctoris.info offer succeeds by placing genuine company details around an unverified contact route. Real names, good pay, Teams, and a biotech brand make the email look researched because it is.
Check the part the sender cannot rewrite: the real company’s domain and HR confirmation. If Arctoris cannot verify the vacancy, recruiter, and .info address through arctoris.com, there is no interview worth continuing.
