Security awareness for recruiters: phishing, passwords, 2FA and API keys
A short lesson told through two recruiters: a fake sign-in email, a reused password, a caller posing as support, and an AI agent given an API key. The habits that keep agency data safe.
Ask AI about this
Emma follows two recruiters at the same agency, Sarah and Tom, through three things that really happen to recruitment teams, and the habits that stop each one.
Watch it on Recruitly Play (4 min 6 s), part of the Get set up series.
A fake sign-in email
Sarah is told her account is locked. She checks the sender, recruitly-help dot co, and hovers over the button to see it goes to the same fake address. She deletes it and warns her team. Check the sender and the link before any sign-in, and if in doubt, open Recruitly yourself.
A reused password and a fake support call
Sarah's password is the same as her social and shopping accounts. When one leaks, a thief tries it on Recruitly and is stopped by the code from her authenticator app. That is why two-factor sign-in is compulsory. He rings pretending to be Recruitly support and asks for the code. Recruitly will never ask for your code. Sarah hangs up, changes to a password she uses nowhere else and keeps her recovery codes safe.
An AI agent with an API key
Tom connects a free AI model hosted by another company to source candidates, and pastes in his API key. A key reaches the CRM with no password and no code. A CV with hidden text tells the agent to email the candidate list out, and it does. Tom disables the key in API Keys, switches the agent off and tells the admin, who checks whether it must be reported, which under data protection law can be due within 72 hours.
Recruitly never connects AI with a key: when you connect Claude or ChatGPT you sign in yourself. Give your key only to tools you trust, such as the Chrome extension or Zapier, and keep it in a password manager. See security, single sign-on and GDPR.
Will Recruitly ever ask for my two-factor code?
No. Anyone asking for it is not Recruitly, so hang up and change your password.
Is it safe to give an AI agent my API key?
Only for tools you trust. A key reaches your CRM without a password or code, so anything holding it can read what you can.