We have written before about six steps to evaluate a new potential client, three steps to spot a potential scam and, more specifically, how the overpayment scam works on freelancers. In this post, we cover how this scam works and how to protect yourself from having your CV stolen or falling for a stolen CV. Resume theft has become increasingly widespread in the last years, and today it’s perhaps the second most common scam affecting both online freelancers and outsourcers.
How does the CV theft scam work?
The scammer(s) will take the CV/resume of a reputable freelance translator or interpreter, edit it and pass it off as their own, sending it to translation agencies and end clients, or posting it to online translation and freelancing portals.
Sometimes, the scammer will use their own alias, building an entire fake identity around another person’s achievements and credentials. But, oftentimes, what they will do is keep the real professional’s name, and simply replace the email address and phone number with their own.
When it comes to translation, the scammer will simply pipe the text through a machine translation engine and disappear as soon as they have received the payment, leaving the real translator to receive the backlash when the client discovers that the text delivered was machine translated. In the case of interpreting, the scammer will usually take remote interpreting jobs until their lack of qualification becomes evident, at which point they will usually “burn” the identity they have built for the scam and begin from scratch.
CV theft can simply lead to poor-quality work and damaged reputations, but it may also end up in identity theft. In our previous blog post on tips, tricks and templates for your translation resume, we mentioned that one of the reasons why you should be mindful of the information you share on your resume is that, if it gets stolen by a scammer, you don't want that file to be circulating with your phone number or home address. This is the worst scenario of a CV theft case: with enough personal details, a scammer may be able to impersonate you not just to gain a translation job, but even to steal your identity for further financial harm. Likewise, if you are hiring a freelancer, in making your payment you may expose sensitive information to a malicious actor.
How can I prevent my CV from being stolen?
As an online freelancer, one of your goals is to achieve more exposure and put your brand out there. At the same time, you will want to take reasonable measures to safeguard your privacy.
One way in which some people try to protect their information is by requesting that search engines not index their online profiles and webpages (by checking the corresponding setting or adding a “no index” tag). But this is just that, a request: search engines may choose not to honor it. So, if you don’t want something to end up on Google, you need to put it behind a password or a login screen —or don’t put it up on the Internet at all.
A potential client hoping to hire your freelance services does not need your date of birth, marital status, number of children, home address, social security or national ID number. Your CV/resume and your public online profile(s) and/or webpage should only include necessary contact information. What contact information should you include?
Most people feel comfortable sharing their email address, while others will warn you that sharing your email opens you up to spam and scam attempts —and they’ll be right. One way to give your clients a contact method without making your email address public is to use a “send email” form like the one on ProZ.com profiles: you can set up your ProZ.com profile to receive email from everyone, or just from logged-in users; and most website hosting services on the Internet offer the option to add a mailing form. What does a “send email” form do? It allows your client to message you without seeing your email address, which gives you the opportunity to evaluate them and decide if they look “legit” before you email them back.
When it comes to your email address, another way to protect yourself is to set up a personal domain for your freelancing business: first, register your own domain name in your service of choice; then, create an email address with your new domain. Then, make sure that all your public profiles and/or webpages make it clear that you only handle your business from this domain.
Regarding other contact information, some people also choose to share their phone number. This has its benefits —it allows your potential client to pick up the phone and call you with their time-sensitive offers!— but, like publicizing your email, can invite spam and scam attempts. The two primary ways to protect yourself are:
- Get a business-only phone number, which you do not use to manage the two-factor authentication of your online accounts.
- Use a “call button”, that is, a call routing service, like the one ProZ.com offers with the Plus membership: just like with mailing forms, certain websites and hosting services offer the option to add a “call button” which functions in the same way, allowing clients to call you with one click, without revealing your phone number. These services have the added advantage of allowing you to set up available hours —though, of course, if you have a business-only phone, you can just turn it off!
Other information, like Skype or Zoom username, can be a useful contact method to offer your clients. But, as we suggested in our “tips, tricks and templates” post, the best option is always to link back to your ProZ.com profile or similar, so that clients always have a way to check for your updated contact details.
You might be thinking well, that’s all great, but how do I prevent someone from taking my achievements and claiming them as their own? The short answer is that there is no sure-fire way to prevent information that you make public on the Internet from being misused. What you can do, however, is make it very complicated.
First and foremost, CVs and resumes should never be provided in editable text formats, like the DOC files you get from Microsoft Word. Any CV or resume you send or upload to the Internet should be in PDF format.
While passwords can be cracked, it’s still good practice to password-protect your PDF files. This prevents copy-pasting and editing. Many PDF editing software gives you the option to add this additional layer of protection, and cracking a password-protected file is usually more effort than a scammer will be willing to do.
Some people also recommend adding a watermark to your CV, which serves a similar purpose —it adds a layer of difficulty to editing and misusing your resume. But it can have an additional function: if you add an “invisible” watermark, in a very small font or in the same color as the page background, you can include an identifiable keyword in this watermark, and set up an alert so that Google will notify you if another copy of the file pops up somewhere.
Setting up an alert is always an easy way to flag possible cases of impersonation! To monitor your online reputation, you can create a Google Alert for your name or your business brand, and Google will notify you whenever they index any new URL which contains your chosen keyword.
How can I identify a stolen resume?
If a freelancer contacts you rather than the other way around, you’ll want to look up their name and email address on your search engine of choice. If they have a public email address or phone number, corroborate that it matches the one in the CV you were sent. And, if they don’t, use their contact method of choice to reach out. Corroborating the legitimacy of an unprompted contact is just due diligence, and you might be the one that helps someone realize they’re being impersonated.
Learn more about online risk management, subscribe to scam alerts, and browse through an archive of past reports, here »
Need to report a case of impersonation? Submit a support request »
