Jay Jones was laid off near the end of 2023, and his daughter was about to be born. That is the part of the story most people skip past, but it is the part that explains everything that came after. He was not a researcher with a grant or a journalist with an assignment. He was a man with a newborn on the way, a severance clock ticking, and a laptop open to a job board, doing exactly what tens of millions of people do every single day.
Then the recruiters started messaging him. And something about them was off.
Not dramatically off. Not the obvious, badly spelled, too-good-to-be-true kind of off that anyone would catch. These were polished. They had headshots and job titles and company names you recognised. But Jones, who had spent his career around verification and fraud work, kept noticing small things that did not sit right. A recruiter whose entire digital existence was one LinkedIn profile and nothing else. A corporate hiring manager emailing from a free consumer address. A company that claimed a decade of operation but whose web domain had been registered a few weeks earlier.
So he did what almost nobody does. Instead of blocking the account and moving on, he opened a spreadsheet.
What happened over the next two and a half years is genuinely hard to hold in your head. By his own public accounting, Jones has now documented and had removed tens of thousands of job listings he says were never real. The number he has attached to his campaign is 57,952. His own website puts the running total higher, past 58,500. A petition he filed cited 55,308 as of the middle of this year. Those figures do not contradict each other so much as they show you what kind of number this is. It is not a finding. It is an odometer. Every time he goes back to work, it climbs.
Alongside the listings, he says he has flagged more than 7,000 fake recruiter profiles, and disrupted over a thousand hijacked accounts belonging to real people whose identities had been quietly taken over and repointed at job seekers.
The thousand-plus hijacked accounts deserve their own moment, because they are the strangest part of all this. These were not invented people. They were real professionals, with real careers and real connections, whose accounts had been taken over and quietly redirected. The photograph stays. The work history stays. The decade of genuine endorsements from genuine former colleagues stays. Only the purpose changes. Someone who has spent fifteen years building a professional reputation becomes, without knowing it, the friendly face on an operation aimed at people in trouble. Most of them found out only because a stranger with a spreadsheet noticed and filed a report.
All of this was, for a long time, one man’s private obsession. It stopped being private this summer, when the state of Texas got involved.
The Attorney General’s office there opened a formal investigation into LinkedIn over what it describes as fake and misleading job opportunities advertised to people who were paying for the privilege. The legal instrument is a Civil Investigative Demand, which is a compulsory request for documents, and the office has asked the company to hand over internal material about its advertising, its marketing, its verification practices, and specifically what it tells subscribers about job listings.
The money angle is what gives the investigation its teeth. A Premium Career subscription runs about $40 a month, and a Premium Business one around $70. The state’s position is that people are paying those fees on the strength of a promise about the quality of the job market they are buying access to, and that a meaningful share of what they find there may be inactive, already filled, or not attached to any real hiring intention at all. Attorney General Ken Paxton framed it simply, saying the company has a duty to actually deliver the service it advertises to people who are paying for it.
It is important to be precise about what this is, because it is easy to read the headline and conclude that something has been proven. Nothing has. This is an investigation, not a finding. No charges have been filed and no lawsuit has been brought. A Civil Investigative Demand is the state asking questions, and the company is entitled to answer them.
LinkedIn, for its part, has not conceded any of it. The company says its goal is to help job seekers find their next role and that its policies require posted jobs to be authentic and accurately represented. On the fraud side specifically, it says its automated systems catch and remove the overwhelming majority of spam and scam content before any user ever sees it, and that it proactively blocks the large majority of fake accounts it detects. Those are real numbers and they are almost certainly true in percentage terms. The uncomfortable arithmetic is that a platform with billions of pieces of content can block 99 percent of something and still leave an enormous absolute quantity standing.
The state’s release also points to something broader than any one company. It notes that independent studies have estimated ghost listings may account for somewhere between a fifth and a third of online job adverts generally. That is an estimate, and estimates in this area vary widely depending on who is counting and what they count. But it matches the lived experience of nearly everyone who has looked for work recently, which is part of why this story travelled the way it did.
It is also worth separating two things that get tangled together, because the investigation sits exactly on the seam between them. Outright fraud, the invented recruiter with the stolen photograph, is one problem. The ghost job is a different one, and in most places it is entirely legal. A real company with a real page posts a real-looking vacancy it has no current intention of filling. Sometimes that is a firm keeping a pipeline warm for a role it expects to open next quarter. Sometimes it is a policy requiring a position to be advertised externally when an internal candidate has already been chosen. Sometimes a listing is simply left up long after the seat was filled, because nobody’s job description includes taking it down. None of that is a crime, and none of it involves a scammer. It still means a person spent an evening writing a cover letter into a void.
For the applicant refreshing their inbox, those two problems are indistinguishable. The silence feels identical. That overlap is part of why the numbers in this area are so contested, and why any estimate of how many listings are not real depends enormously on what the person counting decided to count.
What makes Jones’s work land, though, is not the totals. It is the texture.
There was a recruiter he found operating under the name Linda Anthony. Same name, same photograph, multiple accounts, each one claiming a different title in a different place. One version was a contract recruiter at a firm in one state. Another was a contract specialist at the same firm, in a different state entirely. Same face, looking out of every profile. Jones described the experience of pulling on that particular thread as one rabbit hole opening into another.
More troubling than the invented people were the borrowed companies. Jones documented fake vacancies posted against the genuine pages of large, well-known employers, including a major carmaker and a large financial services firm. When a listing sits on a real company’s page, it arrives wrapped in that company’s logo, its follower count, its verification marks, its entire accumulated credibility. A job seeker doing everything right, checking the employer, looking for the badge, can still walk straight into it. And in some cases the companies themselves have said plainly that they do not hire for the roles being advertised in their name.
He also mapped out what he alleges are networks of shell company pages, clusters of fabricated employers posting hundreds of listings between them, all funnelling applications away from the platform and toward systems nobody can see. His allegations about what those systems are for are serious. He says they harvest personal information, in some cases push malware, and in some cases extract money outright.
Here is where you have to be careful, and it is worth saying so directly. Those are Jones’s characterisations, drawn from his own documentation. They have not been established in court. He is one person, working from open sources, following patterns. His work has drawn coverage from major news organisations and he now speaks to law enforcement and corporate security audiences about it, which suggests professionals take him seriously. But his numbers are his numbers, and they should be read that way.
What is harder to dispute is who these operations aim at. The people most likely to answer a suspicious recruiter are the people who cannot afford to ignore any message at all. Someone recently laid off. Someone new to a country and unfamiliar with how hiring normally works. Someone in low-paid care work, applying to a dozen places a week. The tactics Jones catalogues include asking for sensitive personal documents before anyone has been hired, moving the conversation off the platform almost immediately, and requesting fees for equipment or training. Each of those only works on somebody who is already stretched thin enough to say yes.
Jones has turned a good deal of what he learned into practical advice, and it is unglamorous in a way that makes it more useful. Look at whether the recruiter exists anywhere else on the internet. A person who has genuinely been hiring for fifteen years leaves a trail. If the single LinkedIn profile is the whole of them, that is a signal. Look at the email domain. Someone recruiting for a major corporation should not be writing to you from a free consumer address. Look up when the company’s web domain was registered, because a business claiming twenty years of history with a domain three weeks old is telling on itself. Check whether the vacancy also appears on the employer’s own careers site, because the good ones almost always do.
His favourite technique is the simplest. Ask an unscripted question. Real scams run on templates, and a fraudulent recruiter working from a script has nothing prepared for a candidate who wants to know about the benefits package, or who is leaving the role, or how the team has grown in the last year. The conversation either stalls or goes strange, and you have your answer in about ninety seconds.
He is candid that reporting is where the frustration lives. He has described the process as constant friction, opening case after case on the same networks, watching pages come down and near-identical ones go up. That is a familiar shape to anyone who has worked in platform safety. It is not necessarily evidence of indifference. It is evidence that removal is cheap for the platform and even cheaper for the people building the fakes.
And that, in the end, is what the state investigation is actually probing at. Not whether fraud exists on the internet, which is not in dispute anywhere. The question is narrower and sharper. If a company sells a paid product on the promise of a better hiring marketplace, what does it owe the people who pay for it about the condition of that marketplace. Nobody has answered that yet. The investigation may answer it, or it may quietly conclude, or it may end in a settlement nobody reads. Those are all real possibilities.
What has already changed is smaller and more concrete. Tens of thousands of listings are down that would otherwise still be up. Thousands of invented recruiters no longer exist. Over a thousand people got their own professional identities back without ever knowing they had lost them. That happened because one person, at the worst possible moment in his own working life, with a baby coming and no income, decided that the pattern he was noticing was worth writing down.
He could have done the entirely reasonable thing. Block, report, move on, keep applying. Almost everyone does. The gap between that and what he actually did is not talent or resources. It is just the decision to keep a record.
Jones now works in fraud prevention professionally, which is the tidy ending, and it is a real one. But the better ending is less tidy. The spreadsheet is still open. The count is still moving. Every so often the total on his site ticks up again, and somewhere a person who was about to send their passport scan to a stranger does not.
If you have applied into silence recently and quietly concluded that the problem was you, this is worth sitting with. Sometimes it was you, and sometimes the market was just brutal. But some meaningful share of those listings were never going to answer anybody, because there was nobody on the other end to answer. That is not a comfort exactly. It is just true, and one man spent two and a half years proving it one line at a time until a state government picked up the file.