metier/scam_patterns.json at main · molemantis/metier · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
  "_comment": "Métier scam-technique database. Each entry is one recruiter-scam tell matched against the message body. Loaded into the scam_patterns table on startup; the DB also accepts live additions. To add a technique, append an entry and restart (or INSERT directly). polarity: 'risk' raises the scam score, 'trust' lowers it. weight = points (0-100 scale, engine caps the total).",
  "version": 1,
  "patterns": [
    {"category": "fee", "match_type": "keyword", "pattern": "resume writing fee", "weight": 45, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Legitimate recruiters are paid by the employer. A candidate never pays to apply or get hired."},
    {"category": "fee", "match_type": "keyword", "pattern": "background check fee", "weight": 45, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Employers cover background-check costs; charging the candidate is a scam tell."},
    {"category": "fee", "match_type": "keyword", "pattern": "training fee", "weight": 45, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Paid training before hire is a classic advance-fee scam."},
    {"category": "fee", "match_type": "keyword", "pattern": "placement fee", "weight": 45, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Placement fees are paid by employers, never candidates."},
    {"category": "fee", "match_type": "keyword", "pattern": "equipment deposit", "weight": 45, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Real employers provide equipment; a deposit request is a scam."},
    {"category": "fee", "match_type": "keyword", "pattern": "certification fee", "weight": 40, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Required paid certifications tied to a job offer are a pay-to-play tell."},
    {"category": "fee", "match_type": "keyword", "pattern": "processing fee", "weight": 42, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Onboarding/processing fees are never charged to candidates by real employers."},
    {"category": "fee", "match_type": "keyword", "pattern": "onboarding fee", "weight": 42, "severity": "critical", "polarity": "risk", "title": "Upfront fee requested", "explanation": "Onboarding is an employer cost; charging for it is a scam."},
    {"category": "fee", "match_type": "keyword", "pattern": "starter kit", "weight": 35, "severity": "high", "polarity": "risk", "title": "Paid starter kit", "explanation": "'Starter kits' you must buy are a common job-scam mechanic."},
    {"category": "fee", "match_type": "keyword", "pattern": "refundable deposit", "weight": 40, "severity": "high", "polarity": "risk", "title": "Refundable deposit requested", "explanation": "'Refundable' deposits rarely are; no legitimate hire requires one."},
    {"category": "fee", "match_type": "regex", "pattern": "buy (your own )?(equipment|laptop|gear)", "weight": 38, "severity": "high", "polarity": "risk", "title": "Asked to buy equipment", "explanation": "Being told to buy your own gear before starting is a scam tell."},

    {"category": "pii", "match_type": "keyword", "pattern": "social security", "weight": 32, "severity": "high", "polarity": "risk", "title": "Sensitive personal info requested early", "explanation": "SSN should never be shared before a signed offer."},
    {"category": "pii", "match_type": "regex", "pattern": "\\bssn\\b", "weight": 32, "severity": "high", "polarity": "risk", "title": "Sensitive personal info requested early", "explanation": "SSN should never be shared before a signed offer."},
    {"category": "pii", "match_type": "keyword", "pattern": "bank account", "weight": 30, "severity": "high", "polarity": "risk", "title": "Banking details requested early", "explanation": "Bank/routing details before hire paperwork is a data-harvesting tell."},
    {"category": "pii", "match_type": "keyword", "pattern": "routing number", "weight": 30, "severity": "high", "polarity": "risk", "title": "Banking details requested early", "explanation": "Routing numbers are not needed before employment is confirmed."},
    {"category": "pii", "match_type": "keyword", "pattern": "direct deposit setup", "weight": 28, "severity": "high", "polarity": "risk", "title": "Direct-deposit setup before offer", "explanation": "Direct deposit is set up after hire, never during outreach."},
    {"category": "pii", "match_type": "keyword", "pattern": "passport number", "weight": 30, "severity": "high", "polarity": "risk", "title": "Government ID requested early", "explanation": "Passport/ID before a formal offer is identity harvesting."},
    {"category": "pii", "match_type": "keyword", "pattern": "driver's license", "weight": 26, "severity": "medium", "polarity": "risk", "title": "Government ID requested early", "explanation": "Driver's license before an offer is unnecessary and risky."},
    {"category": "pii", "match_type": "keyword", "pattern": "date of birth", "weight": 22, "severity": "medium", "polarity": "risk", "title": "DOB requested early", "explanation": "Date of birth before hire paperwork is a data-harvesting tell."},
    {"category": "pii", "match_type": "regex", "pattern": "verify your identity", "weight": 20, "severity": "medium", "polarity": "risk", "title": "Early 'identity verification'", "explanation": "Requests to 'verify your identity' with documents just to start are suspicious."},

    {"category": "urgency", "match_type": "keyword", "pattern": "act now", "weight": 12, "severity": "medium", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "Manufactured urgency rushes you past verification — a scam hallmark."},
    {"category": "urgency", "match_type": "keyword", "pattern": "respond immediately", "weight": 12, "severity": "medium", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "Real hiring runs on a defined timeline, not 'respond immediately.'"},
    {"category": "urgency", "match_type": "keyword", "pattern": "limited positions", "weight": 10, "severity": "low", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "Artificial scarcity is a pressure tactic."},
    {"category": "urgency", "match_type": "keyword", "pattern": "positions are filling fast", "weight": 10, "severity": "low", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "Artificial scarcity is a pressure tactic."},
    {"category": "urgency", "match_type": "keyword", "pattern": "today only", "weight": 12, "severity": "medium", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "'Today only' deadlines are designed to stop you verifying."},
    {"category": "urgency", "match_type": "keyword", "pattern": "last chance", "weight": 12, "severity": "medium", "polarity": "risk", "title": "Pressure / urgency tactics", "explanation": "'Last chance' framing is a manipulation tactic."},

    {"category": "off_channel", "match_type": "keyword", "pattern": "whatsapp", "weight": 22, "severity": "high", "polarity": "risk", "title": "Pushes to an off-channel app", "explanation": "Moving to WhatsApp/Telegram early avoids a paper trail — a strong scam tell."},
    {"category": "off_channel", "match_type": "keyword", "pattern": "telegram", "weight": 22, "severity": "high", "polarity": "risk", "title": "Pushes to an off-channel app", "explanation": "Telegram is heavily used by job scammers to evade verification."},
    {"category": "off_channel", "match_type": "keyword", "pattern": "signal app", "weight": 20, "severity": "high", "polarity": "risk", "title": "Pushes to an off-channel app", "explanation": "Pushing to encrypted personal messaging early is suspicious for a recruiter."},
    {"category": "off_channel", "match_type": "regex", "pattern": "(move|switch|continue) (this )?(to|on) (text|sms|chat)", "weight": 18, "severity": "medium", "polarity": "risk", "title": "Pushes to text/chat only", "explanation": "Insisting on text/chat instead of a real call is a common scam pattern."},

    {"category": "ai_template", "match_type": "regex", "pattern": "i hope this (message|email) finds you well", "weight": 5, "severity": "low", "polarity": "risk", "title": "Generic AI/template phrasing", "explanation": "Boilerplate opener — a yellow flag only; weigh it with other signals, since real recruiters use templates too."},
    {"category": "ai_template", "match_type": "regex", "pattern": "came across your (impressive )?profile", "weight": 5, "severity": "low", "polarity": "risk", "title": "Generic AI/template phrasing", "explanation": "Mass-outreach opener with no real personalization — a mild tell."},
    {"category": "ai_template", "match_type": "regex", "pattern": "\\[(first ?name|name|company|role)\\]", "weight": 30, "severity": "high", "polarity": "risk", "title": "Unfilled template placeholder", "explanation": "Leftover [First Name]/[Company] fields prove an unproofed mass blast."},

    {"category": "ghost_job", "match_type": "regex", "pattern": "keep your (resume|cv) on file", "weight": 18, "severity": "medium", "polarity": "risk", "title": "Ghost-job language", "explanation": "'We'll keep your resume on file' often means there is no real opening."},
    {"category": "ghost_job", "match_type": "keyword", "pattern": "work from home opportunity", "weight": 14, "severity": "medium", "polarity": "risk", "title": "Vague WFH bait", "explanation": "Generic 'work from home opportunity' with no specifics is common scam bait."},
    {"category": "ghost_job", "match_type": "regex", "pattern": "no (experience|interview) (necessary|required|needed)", "weight": 26, "severity": "high", "polarity": "risk", "title": "No interview / no experience needed", "explanation": "Real roles have a process; 'no interview needed' signals a scam."},

    {"category": "too_good", "match_type": "regex", "pattern": "guaranteed (placement|job|position|income)", "weight": 24, "severity": "high", "polarity": "risk", "title": "Guarantee that can't be made", "explanation": "No legitimate recruiter guarantees placement or income."},
    {"category": "too_good", "match_type": "regex", "pattern": "\\$\\d{3,}\\s*(/|per )?(day|hr|hour)\\b", "weight": 16, "severity": "medium", "polarity": "risk", "title": "Implausible pay rate", "explanation": "Daily/hourly pay well above market for the role is a too-good-to-be-true tell."}
  ]
}