"Researchers built a fake company to study fake employee scams." — Researching Employment Scams (Schneier.com)
Researchers' method: creating a sham employer
The sole public fact reported in the source is straightforward: researchers established a fake company and used it as a platform to investigate what the source calls "fake employee scams." The brevity of that description leaves the mechanics—how the company was presented, how long it existed, what data were collected, and which safeguards were in place—unreported in the source itself. Still, the single action the source records is precise and consequential: a research team elected to simulate an employer as part of their study design.
What the term "fake employee scams" signals
Beyond the procedural note about a fake company, the source names the phenomenon under investigation: fake employee scams. The phrase frames the activity as a specific class of deception that targets employment relationships or the employment process. The source does not define the term, supply examples, or describe the behavior's mechanics; it only identifies that such scams exist and that they were the chosen subject of the experiment.

Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEthical and operational questions implied by the approach
Launching a sham company to observe deception raises a cluster of ethical and operational questions, none of which the source answers but all of which are implied by the reported method. Issues that naturally follow from the bare fact reported include informed consent, potential harm to people who interacted in good faith with the fake employer, the handling and protection of any personal data collected, and the legal environment in which the experiment took place. The source provides no detail on whether the researchers sought review from an institutional review board, anonymized data, or disclosed the study to participants after the fact.
How employers, job seekers, and researchers might react
- Employers: The use of a sham employer as a research tool could prompt employers to consider how research exercises intersect with marketplace reputations. Employers might be alert to potential confusion if a fake company uses branding or messaging similar to legitimate firms, though the source does not indicate any such similarity.
- Job seekers: Individuals responding to job solicitations or offers from an entity later described as a research construct could face emotional or practical consequences; the source does not state whether people were knowingly enrolled or debriefed, only that a fake company was created.
- Researchers: Those in academic or applied research settings may read the single fact as an example of an experimental strategy—simulating an operational environment to observe fraud in situ—but the source leaves unanswered what protocols were used to limit risk and preserve ethical standards.
Methodological implications for studying deception
The decision to build a fake company, as reported, illustrates one methodological stance toward studying deceptive practices: embedding investigators within the environment they intend to study. That stance trades off control and observational fidelity against concerns about deception and participant welfare. The source does not provide outcome data or methodological reflection; readers must therefore treat the reported act itself—constructing a fake company—as the only available evidence of how these particular researchers approached the problem.
In practical terms, the reported approach suggests a desire to collect first‑hand interactional data rather than relying solely on retrospective interviews, reports, or publicly available artifacts. It implies that researchers judged direct engagement with scam dynamics to be essential for their inquiry. Exactly what they observed, how representative those observations are, and what conclusions they drew remain unstated in the source.
A narrow fact, wider questions
The report in the source is intentionally compact: a single declarative sentence naming the action and the object of study. From that slender fact come several unavoidable questions about transparency, participant protection, legal exposure, and how findings—if and when released—would be contextualized. The public record provided here does not answer those questions, but it does mark a clear choice by the researchers to use a fabricated company as their research apparatus.
That choice—plainly reported and otherwise unexplained—will be the central datum for any follow-up reporting, peer review, or policy discussion. It is also the simple, reproducible fact that any critic, collaborator, or regulatory reviewer can verify or challenge: researchers built a fake company to study fake employee scams. What remains to be seen, and to be documented by further reporting or publication, is how they built it, who they affected, what they learned, and what measures were taken to manage risk.
Original story: https://www.schneier.com/blog/archives/2026/09/researching-employment-scams.html




