Skip to content

Hacked LinkedIn Account or Hijacked Company Page: Stopping Fake Recruiter Scams and Recovering Admin Access

Emergency numbers differ by country. This page uses 911, the number for the United States and Canada. Many other countries use 112, 999, or another number. Find the number for your country.

Discovering that a threat actor has hijacked a verified executive, software engineer, or corporate recruiter LinkedIn profile, or taken over Super Admin control of your official LinkedIn Company Page, is a high-velocity corporate security and brand-reputation emergency. Unlike casual consumer social media hacks, LinkedIn account takeovers (ATO) are weaponized within minutes by organized cybercrime groups (Lazarus Group / Contagious Interview, fake check employment rings, and B2B invoice fraud syndicates) to post fraudulent "Remote $120k Assistant / Developer" job listings that infect applicants with trojanized coding assessments, solicit advance-fee background check payments, or drain tens of thousands of dollars in unauthorized LinkedIn Campaign Manager (Ads) spend on your corporate credit card.

If the takeover involves extortion, direct threats to physical safety, or large-scale financial wire fraud, call your local police or emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom; see emergency numbers) and file an immediate cybercrime report. Cross-reference our sibling guides on social media account takeover and hacking, social media phishing and impersonation scams, and creator channel hijacked by crypto scam livestreams as you execute the exact LinkedIn personal profile and Company Page recovery protocols below.

Do this now

  1. Check whether any surviving friendly "Super Admin" still has access to your LinkedIn Company Page (0 to 2 minutes). A LinkedIn Company Page does not have its own separate username and password; it is controlled via role-based access attached to individual employees' personal LinkedIn profiles. If even ONE uncompromised coworker still holds the Super Admin role, have them open the Company Page immediately -> click Settings (Gear Icon) -> Manage admins, and click the Trash Can (Remove) icon next to the hacked executive/employee's name AND any unrecognized rogue Super Admins the hacker added.
  2. Freeze the corporate credit card or bank account attached to LinkedIn Campaign Manager (linkedin.com/campaignmanager) and LinkedIn Recruiter (Recruiter Corporate / Lite) immediately. The first move of financially motivated LinkedIn hijackers is opening Campaign Manager to launch $5,000-per-day crypto/malware ad campaigns billed to your saved corporate Amex/Visa card, or exporting your entire candidate database out of LinkedIn Recruiter.
  3. If you are still partially logged into your personal LinkedIn account on your mobile phone app, go to Settings -> Sign in & security -> Where you're signed in and tap End all sessions BEFORE changing your password. If the hacker stole your li_at browser session cookie via infostealer malware or an Adversary-in-the-Middle (AiTM) phishing page, changing your password without terminating active sessions sometimes leaves existing mobile/API tokens alive.
  4. Check Settings -> Sign in & security -> Email addresses and Phone numbers to see if the hacker added a secondary burner email (@rambler.ru, @firstmail.ltd, @proton.me, @outlook.com) and made it Primary. If the attacker already swapped the primary email and turned on their own Two-Step Verification (2SV), do NOT create a brand-new LinkedIn account with your work email (creating a new account on the same email address breaks LinkedIn's backend database link to your old profile UID). Instead, go straight to the LinkedIn Persona Government ID Recovery Form in Part 1 below.
  5. Post an immediate Public Fraud Warning across your official website, X/Twitter, and surviving employee LinkedIn feeds warning job seekers NOT to download files, pay equipment fees, or send driver's licenses/SSNs to any job posted by the compromised account. Because applicants inherently trust a job listing posted under your real company's logo with a verified "Recruiting at [Company]" badge, every hour of silence allows dozens of job seekers to be defrauded in your company's name.
  6. Scan the compromised employee's workstation for Infostealer malware (RedLine, Lumma, Stealc) or malicious Chrome extensions (fake AI LinkedIn scrapers / ChatGPT outreach extensions). Over 65 percent of recruiter and executive LinkedIn takeovers happen not because the user typed their password into a phishing site, but because they installed a rogue Chrome extension promising "Automated LinkedIn Lead Generation / Email Finder" that silently exfiltrates the live li_at session authentication cookie every time they open linkedin.com.

Danger

The "Malicious Job Listing / Trojanized Coding Test" Liability Trap. State-sponsored threat actors (documented by CISA, FBI, and Mandiant) and financial scammers specifically hijack the real LinkedIn accounts of Verified Technical Recruiters, Engineering Managers, and HR Directors at legitimate tech and finance companies. Using your real recruiter account and Recruiter InMail credits, they message software engineers and crypto developers, invite them to a fake interview, and ask them to clone and run a malicious GitHub repository (npm install / Python / Node.js test project) or download a fake video-conferencing update that drains the candidate's crypto wallets and corporate credentials. Always notify any candidates who received InMails during the compromise window immediately.

Decision tree: Hacked personal LinkedIn profile vs. hijacked LinkedIn Company Page vs. fake recruiter clone

Follow this branching workflow to recover control based on which asset was compromised.

flowchart TD
    A["LinkedIn Security Emergency"] --> B{"Which LinkedIn asset is compromised?"}
    B -->|"Personal Executive / Recruiter Profile Hacked (Locked out, email/2FA changed)"| C["DO NOT register a new LinkedIn account with your old email -> Open LinkedIn 'Report a Compromised Account' / Persona ID Verification flow"]
    C --> D["Scan smartphone NFC / camera with Government Passport or Driver's License via Persona -> LinkedIn Trust & Safety strips hacker's email/2FA & sends reset link in 24-72h"]
    B -->|"Official LinkedIn Company Page Hijacked (Rogue posts or hacked Admin)"| E{"Does ANY surviving colleague still have 'Super Admin' access on the Company Page?"}
    E -->|"YES: At least 1 clean Super Admin remains"| F["Surviving Super Admin immediately opens Company Page -> Settings -> Manage Admins -> Removes hacked employee & all unknown Admins -> Deletes scam posts & Job Listings"]
    E -->|"NO: Hacker kicked out all legitimate Super Admins"| G["Freeze corporate credit card attached to Campaign Manager -> Submit 'LinkedIn Page Admin Recovery / Dispute Request' from a verified @companydomain.com email"]
    B -->|"Fake 'Ghost' Recruiter Profiles Claiming to Work at Your Company (Not hacked, but impersonating)"| H["Have Company Page Super Admin open 'Page -> People / Employees' tab -> Report unauthorized profiles claiming employment + file Trademark Infringement takedown"]
    D --> I["Audit Chrome extensions for rogue LinkedIn scrapers (stealing 'li_at' cookie) -> Rotate SSO/Email passwords -> Post public candidate warning"]
    F --> I
    G --> I
    H --> I

Part 1: Step-by-step recovery when you are locked out of a hacked personal LinkedIn account

When an attacker compromises a personal LinkedIn profile, they follow a 90-second playbook: they log in (via a stolen li_at cookie or phishing proxy), add their own disposable email address, verify it, promote their email to Primary, delete your original work and personal email addresses, and register their own Authenticator App (2SV) on your account.

When you try to click "Forgot Password," LinkedIn either says "We couldn't find an account with that email" or asks for a 6-digit 2SV authenticator code that is on the hacker's phone. Here is the exact official bypass to take your account back:

Method 1: Triggering the "Verify Your Identity with Persona" 2SV / Email Override Flow (Fastest)

If your email still works (or you clicked the "Revert this email change" link inside the automatic warning email LinkedIn sent to your inbox when the hacker changed your email), but the hacker turned on Two-Step Verification (2SV) to block you: 1. On a desktop computer browser (the identity-override link frequently hides on mobile browsers), go to linkedin.com/login. 2. Enter your email and password (or click Forgot password? and enter the code sent to your email). 3. When LinkedIn stops you at the screen asking for the 6-digit Authenticator App code (which the hacker controls), look directly underneath the code box and click: "Verify using another method" or "Can't access your authenticator app? Verify your identity". 4. LinkedIn will launch an embedded Persona Identity Verification QR code / camera flow: - Scan the QR code with your smartphone camera. - Photograph the front and back of your Government-Issued Photo ID (Passport, Driver's License, or National ID Card; if your passport has an NFC chip, Persona can scan the cryptographic chip via your phone's NFC reader for faster verification) and complete the live 3-angle selfie liveness check. 5. What happens next: As soon as Persona confirms that the legal Full Name on your government ID matches the historical Full Name on the LinkedIn profile, LinkedIn's automated recovery system automatically disables the hacker's Two-Step Verification (2SV) and emails you a direct login link within 15 minutes to 48 hours.

Method 2: When the hacker already deleted your email address from the account (No-Access Form)

What if the "Revert email change" link in your inbox expired (or the hacker also compromised your email inbox and deleted the alert), so typing your email into LinkedIn says "Account not found"? 1. Open the official LinkedIn No-Login Compromised Account Recovery Form: linkedin.com/help/linkedin/ask/TS-RHA (or linkedin.com/help/linkedin/ask/TS-F-APPEAL). 2. Fill out the fields with surgical precision so the automated triage router sends your ticket straight to the Account Recovery / ATO Queue: - Email address where we can reach you: Enter a clean, secure email address (ideally your verified corporate @yourcompany.com email address that matches the current employer listed on your LinkedIn work history). - URL of your LinkedIn Profile: Paste the exact public vanity URL of your profile (for example, https://www.linkedin.com/in/firstname-lastname-12345/). (If the hacker changed your profile name or vanity URL, find your original URL in old browser history, email signatures, or Google cache). - Email address previously associated with your account: Enter the exact email address that was Primary on your LinkedIn account before the attack. - Details of the issue: > "My LinkedIn account ([Profile URL]) was hijacked via unauthorized access on [Date] at [Time]. The attacker removed my primary email address ([Old Email]), added an unauthorized email address, and enabled unauthorized 2SV. My corporate email matches my current verified employer on the profile, and I am ready to complete Persona Government ID verification immediately." 3. LinkedIn Trust & Safety will reply to your contact email with a unique one-time Persona ID verification link. Once you submit your government ID through that link, they strip the hacker's email and restore your original email address.

Part 2: Recovering a hijacked LinkedIn Company Page and purging rogue Super Admins

Understanding how LinkedIn's Page Admin Architecture works is critical during an incident: - A LinkedIn Company Page (linkedin.com/company/your-brand) does not have a standalone login. Instead, personal LinkedIn profiles are assigned one of several Admin roles: Super Admin, Content Admin, Curator, Analyst, or Sponsored Content Poster (plus Paid Media Admin in Campaign Manager). - Only a Super Admin has the power to add/remove other Admins, edit page details, or deactivate the page, and any Super Admin can remove ANY other Super Admin with a single click (there is no single immutable "Page Creator / Root Owner" role in standard LinkedIn Pages unless managed via enterprise Business Manager).

Compare the two Company Page compromise scenarios and execute the exact recovery procedure:

Company Page Hijack Scenario Immediate Technical Recovery Steps How to Prevent Re-Compromise
Scenario A: One Executive or Marketing Admin's Personal LinkedIn Was Hacked, AND You Still Have at Least One Other Clean Super Admin 1. Have the surviving clean Super Admin log into LinkedIn immediately.
2. Open the Company Page -> Settings (Gear Icon) -> Manage admins.
3. Under Page admins, locate the hacked employee's profile AND check the entire list for any unfamiliar profiles the hacker added in the last 24 hours.
4. Click the Trash Can (Remove) icon next to every compromised or unrecognized Admin.
5. Switch to the Paid media admins tab and remove any rogue Campaign Manager ad posters.		 Never rely on a single Super Admin. Always maintain 3 separate Super Admins across different departments (each secured with a hardware passkey / 2SV)
Scenario B: Total Company Page Lockout (The Hacker Compromised a Super Admin AND Removed All Other Legitimate Company Admins) 1. Freeze all corporate credit cards / bank accounts linked to LinkedIn Campaign Manager and Recruiter.
2. Have an authorized company officer (logged into a clean LinkedIn profile that has a verified @yourcompanydomain.com work email confirmed on their profile) open the official LinkedIn Page Admin Dispute / Recovery Support Ticket (linkedin.com/help/linkedin/ask/cp-admin).
3. Attach: (a) Articles of Incorporation / Business Registration Certificate, (b) Domain DNS Ownership Proof or Company Letterhead signed by a C-level Officer, and © the Profile URL of the clean employee to be granted Super Admin access.		 Enroll your Company Page and Ad Accounts inside LinkedIn Business Manager (business.linkedin.com) so your organization owns the assets at the corporate tenant level rather than individual profiles

Part 3: Stopping fake job scams, rogue Recruiter InMails, and "Fake Employee" impersonation profiles

Even when your own Company Page is not hacked, cybercriminals exploit LinkedIn's open employment ecosystem in two ways that devastate your brand and harm job applicants:

1. Cleaning up after a compromised LinkedIn Recruiter seat or fake job posting

If an attacker gained access to your Company Page or an employee's LinkedIn Recruiter (Recruiter Corporate / Recruiter Lite) license: 1. Close and Delete Any Fraudulent Job Posts Immediately: - Go to linkedin.com/my-items/posted-jobs/ (or open Recruiter -> Jobs / Company Page -> Jobs), open every unauthorized job listing, click Manage job -> Close job, and contact every applicant who applied to that listing with an immediate security warning: > "SECURITY NOTICE: This job listing was posted without authorization during a third-party account compromise. [Company Name] will NEVER ask you to download software/code repositories prior to an official HR call, will NEVER conduct text-only interviews on Telegram/WhatsApp, and will NEVER ask for payment or bank details for equipment. Please delete any files downloaded from this listing." 2. Revoke the Compromised Seat Inside LinkedIn Recruiter Admin Center: - An existing Recruiter License Administrator should immediately open LinkedIn Recruiter -> Admin Settings -> Manage Users, find the compromised recruiter's seat, and click Park License / Revoke Access so the attacker is instantly kicked out of the Recruiter console even if they still hold the user's personal LinkedIn profile. 3. Export the Recruiter Activity & InMail Audit Log: - Check which candidates the attacker messaged via InMail or exported to .csv during the breach window so your Data Protection Officer (DPO) can evaluate any candidate PII exposure (see accidentally emailed confidential payroll or HIPAA file).

2. How to remove "Fake Employees / Fake Recruiters" who list your company on their profile without permission

Because LinkedIn allows any new account to type "Technical Recruiter at [Your Company Name]" into their Experience section without domain verification by default, scam rings create dozens of fake recruiter profiles tied to your Company Page logo to scam job hunters on Telegram and WhatsApp.

Here is how a Company Page Super Admin can strip your company logo and employment claim off fake profiles: 1. Use the Company Page "People / Associated Members" Removal Tool: - Open your Company Page as a Super Admin -> click the People tab on the public view -> look through the list of profiles claiming to work at your organization. - Click the Three Dots (...) on the fake profile -> click Report / Block -> Report this profile -> They are pretending to be someone else or representing a company they don't work for (Fake profile / Not an employee). 2. Submit a Formal Trademark / Brand Impersonation Takedown (Fastest Bulk Removal): - If scammers have created multiple fake recruiter accounts using your company's registered trademarked name and logo to run employment scams, submit a LinkedIn Trademark Infringement / Scams Notice at linkedin.com/help/linkedin/answer/a1336378 from your legal/corporate email address listing all offending profile URLs. LinkedIn's Legal Takedown Team typically purges verified fake-recruiter rings within 12 to 24 hours.

If the compromised employee had Two-Step Verification (2SV) turned ON and never typed their password into a phishing email, how did the hacker get inside their LinkedIn account?

Whenever you log into www.linkedin.com on Chrome, Edge, or Brave, LinkedIn's servers set an HTTP cookie named li_at (valid for up to 365 days). Anyone who possesses that single li_at text string can paste it into their own browser's DevTools Storage tab and immediately log into LinkedIn as you, bypassing your password and your 2SV Authenticator App.

There are three primary ways your li_at cookie gets stolen: 1. Rogue Chrome Extensions ("LinkedIn Automation / AI Scrapers"): Hundreds of third-party Chrome extensions marketed to recruiters and sales reps ("Find Anyone's Email on LinkedIn", "Auto-Connect Bot", "AI Comment Generator") explicitly read your li_at cookie from linkedin.com and transmit it to an external server so their cloud bot can scrape LinkedIn under your identity. When that extension vendor gets hacked (or sells its user database), thousands of recruiter accounts are hijacked overnight. 2. AiTM Reverse-Proxy Phishing (Evilginx Fake LinkedIn Alerts): An email saying "You have 1 new InMail from a hiring manager" or "Your LinkedIn Page has been restricted" leads to a lookalike domain that proxies your real 2SV code and captures li_at. 3. Infostealer Malware (Lumma / Vidar) From Fake Resumes: An attacker sends a recruiter a "Resume_John_Doe.zip" archive containing a .lnk or .exe file disguised with a PDF icon.

The 5-Point Corporate LinkedIn Hardening Checklist

Implement these five defenses across every executive, recruiter, and Company Page Admin today:

  • 1. Ban All "LinkedIn Scraper / Automation" Chrome Extensions & Rotate li_at By Clicking Sign Out:
    • Open chrome://extensions (or edge://extensions) and remove every third-party LinkedIn automation, email-finder, or scraping extension. Then click Me -> Sign Out inside LinkedIn and log back in (clicking Sign Out explicitly invalidates the old li_at cookie on LinkedIn's servers, whereas simply closing the browser tab leaves the stolen cookie valid).
  • 2. Require Verified Work Email Badge (Confirmed Work Email) + CLEAR / Persona Government ID Badge on All Executive & Recruiter Profiles:
    • Have every legitimate recruiter and executive complete LinkedIn's free Work Email Verification AND Persona / CLEAR Identity Verification so their profile displays the official Verified Shield Badge. Then state clearly on your company's Careers webpage: "All legitimate [Company] recruiters display a Verified Workplace badge on LinkedIn and will ONLY email you from @ourcompany.com."
  • 3. Enable LinkedIn Single Sign-On (SSO) for Enterprise Recruiter, Sales Navigator, and Campaign Manager Seats:
    • In LinkedIn Admin Center -> Settings -> Global Settings -> Single Sign-On (SSO), bind all paid corporate LinkedIn seats to Okta / Microsoft Entra ID / Google Workspace SAML SSO enforced with phishing-resistant FIDO2 Passkeys / YubiKeys.
  • 4. Audit Company Page Super Admins Monthly (The "Minimum 3, Maximum 4" Rule):
    • Keep 3 to 4 trusted Super Admins on your Company Page (so one person leaving or getting locked out never bricks the page), and immediately demote routine social media copywriters and external marketing agencies to the Content Admin or Sponsored Content Poster role (which allows publishing posts and running ads without permission to kick out Super Admins).
  • 5. Train Recruiters Never to Open .zip, .rar, .iso, .lnk, or Password-Protected "Resume / Portfolio" Links:
    • Recruiters are the #1 target in a company for malware attachments because their job is to open strangers' resumes all day. Configure your corporate email gateway to block .zip / .rar / .lnk / .exe / .scr attachments and instruct recruiters to only view .pdf and .docx resumes inside a cloud web viewer.

Tip

Set a Hard Daily Spending Limit or Prepaid Billing Threshold in LinkedIn Campaign Manager. Even if your company does not actively run LinkedIn Ads, make sure your Company Page's linked Campaign Manager (business.linkedin.com) account does not have an uncapped corporate credit card sitting saved on file. Remove unused credit cards from Campaign Manager Billing Center so an account takeover can never result in a $25,000 weekend ad-spend drain.

Regional emergency numbers and agency protocols

When a LinkedIn account or Company Page takeover results in fraudulent job scams targeting the public, unauthorized B2B financial charges, or candidate PII exposure, report to the appropriate national cybercrime and employment-fraud agencies:

United States and Canada

  • Emergency Police Dispatch (Immediate Physical Threat / Swatting): Call 911.
  • Federal Cybercrime & Employment Scam Reporting:
    • United States: File a report with the FBI Internet Crime Complaint Center (ic3.gov) (specifically citing Business Email/Account Compromise or Fake Job Recruitment Fraud) and the Federal Trade Commission (ReportFraud.ftc.gov). If state-sponsored Contagious Interview malware was distributed to engineers via your hijacked account, notify CISA (cisa.gov/report).
    • Canada: Report to the Canadian Anti-Fraud Centre (CAFC, antifraudcentre-centreantifraude.ca or 1-888-495-8501) and the Canadian Centre for Cyber Security (cyber.gc.ca).

United Kingdom

  • Emergency Police Dispatch: Call 999.
  • Cybercrime, Recruitment Fraud & GDPR Breach Reporting:
    • Report corporate account takeover and recruitment impersonation fraud to Action Fraud (actionfraud.police.uk or 0300 123 2040) and consult the National Cyber Security Centre (NCSC) guidance.
    • JobsAware (jobsaware.co.uk): The UK's official government-backed nonprofit portal (operated with the Metropolitan Police and SAFERjobs) for reporting fake LinkedIn job postings and recruiter impersonation scams.
    • UK ICO (ico.org.uk): If a compromised LinkedIn Recruiter seat exposed UK job applicants' CVs, phone numbers, and notes, assess whether a 72-hour UK GDPR Article 33 report to the Information Commissioner's Office is required.

European Union

  • Pan-European Emergency Number: Call 112.
  • GDPR & EU Digital Services Act (DSA) Escalation:
    • If candidate CVs or personal data inside LinkedIn Recruiter were accessed by an attacker, notify your national Data Protection Supervisory Authority (DPC Ireland is LinkedIn Ireland Unlimited Company's lead EU regulator, alongside your local CNIL / BfDI / AEPD) within 72 hours under GDPR Article 33.
    • Under the EU Digital Services Act (DSA), European businesses and individuals can also escalate unresolved platform impersonation and illegal scam content via LinkedIn's dedicated EU Illegal Content Reporting Flow.

Australia and New Zealand

  • Emergency Dispatch: Call 000 in Australia or 111 in New Zealand.
  • Cybercrime & Scam Reporting:
    • Australia: Report corporate account takeovers via cyber.gov.au (ReportCyber / ACSC) and report fake recruitment scams to the ACCC Scamwatch (scamwatch.gov.au). If Australian citizens' driver's licenses or passports were solicited by a fake recruiter posing as your brand, contact IDCARE (idcare.org or 1800 595 160).
    • New Zealand: Report to CERT NZ (cert.govt.nz) and Netsafe (netsafe.org.nz or 0508 NETSAFE).

India and Asia-Pacific

  • India: Call 1930 (National Cyber Crime Helpline) or file a complaint on cybercrime.gov.in under the Ministry of Home Affairs (I4C) for fake job fraud and corporate social media hijacking, and report enterprise security incidents to CERT-In (cert-in.org.in) within 6 hours.
  • Singapore & Japan: In Singapore, call 999 (Emergency) or the Anti-Scam Helpline (1799) and file a Singapore Police Force e-report (police.gov.sg). In Japan, contact the Prefectural Police Cybercrime Consultation Desk (#9110).

Frequently asked questions

Is it safe to scan my Passport or Driver's License into the "Persona" verification screen on LinkedIn to recover my hacked account?

Yes, provided you initiated the recovery directly on the official `linkedin.com` domain (or via an official `@linkedin.com` support ticket link). LinkedIn uses **Persona Identities, Inc.** (and **CLEAR** in North America) as its official, SOC 2 Type II and ISO 27001 certified identity-verification partner. When you scan your government ID and take a live selfie via Persona during the LinkedIn account recovery flow, Persona cryptographically verifies that your legal name and face match the account owner and signals LinkedIn Trust & Safety to strip the hacker's email address and 2SV authenticator. Never email a raw JPEG of your passport as an unencrypted email attachment to a random email address; only upload it inside the official encrypted Persona widget.

How did someone add themselves as a "Super Admin" to our LinkedIn Company Page without our CEO getting an alert?

Because LinkedIn Company Pages use flat peer-to-peer Super Admin permissions, **any single employee who holds the Super Admin role** on your Company Page can add a new Super Admin and remove all other existing Super Admins in 10 seconds. In almost every Company Page hijack, the attacker did not hack "LinkedIn's servers"; instead, they compromised the personal LinkedIn account of one current or former marketing manager, external agency contractor, or founder who still had forgotten Super Admin privileges on your Company Page, used that person's session to add a burner account as a new Super Admin, and then kicked your team off the page.

Should I just create a new LinkedIn profile with my work email while I wait for LinkedIn Support to recover my hacked profile?

No, **never create a brand-new LinkedIn account using the same email address** that was previously attached to your hacked profile while recovery is in progress. In LinkedIn's backend database, an email address can only be bound to one Member UID at a time. If the hacker removed your email from your real 10-year-old profile and you immediately use that liberated email to register a new blank account, LinkedIn's recovery engineers cannot automatically roll your original profile back onto that email address until you first close and purge the duplicate blank account, adding days of delay to your recovery.

Why are dozens of scammers suddenly listing themselves as "HR Recruiter" at our company on LinkedIn, and can we block strangers from claiming they work here?

By historical design, LinkedIn allows any user to type any company name into the "Experience" section of their profile without requiring pre-approval from the Company Page Admin. Criminal employment-scam syndicates abuse this by spinning up sockpuppet profiles that list your company as their current employer so your official company logo appears next to their name when they message victims. While you cannot pre-block the Experience field globally, your Company Page Super Admins should regularly audit the **People** tab on your Company Page, flag unauthorized profiles via **Report -> Not an employee**, and require all genuine recruiters to turn on LinkedIn's **Verified Work Email Badge** (which proves cryptographically that they control an `@yourcompany.com` inbox).

If a hacker ran $10,000 of scam ads in our LinkedIn Campaign Manager using our saved corporate credit card, will LinkedIn refund the money?

Yes, if you report the unauthorized account takeover immediately through both LinkedIn Support and your corporate credit card issuer, LinkedIn's Ad Fraud & Billing Team routinely voids or refunds unauthorized ad spend generated during a confirmed hijacking window. Do not simply initiate a blind credit card chargeback before opening a formal **LinkedIn Compromised Account & Unauthorized Ad Spend Ticket**, as an unannounced chargeback can trigger an automated permanent ban of your Company Page's ad account; instead, freeze the card against *new* charges while filing the official ATO billing dispute with LinkedIn.

Sources and official guidance

  • LinkedIn Trust & Safety / Help Center: Reporting and Recovering a Compromised LinkedIn Account (linkedin.com/help/linkedin/ask/TS-RHA), Verify Your Identity with Persona to Recover Access, Managing LinkedIn Page Admins (Super Admin Role Security), and Reporting Fake Profiles and Employment Scams.
  • Federal Bureau of Investigation (FBI IC3) & Cybersecurity and Infrastructure Security Agency (CISA, United States): Public Service Announcements on Recruitment Fraud, Trojanized Developer Coding Assessments (Contagious Interview / DPRK IT Worker Schemes), and Corporate Social Media Account Takeover.
  • Google Mandiant & Threat Intelligence: Analysis of Session-Cookie Theft (li_at Cookie Exfiltration via Malicious Browser Extensions and Infostealers) Targeting Corporate Recruiters and Executives.
  • Federal Trade Commission (FTC, United States) & UK JobsAware / Action Fraud: Employer and Job Seeker Guidance on Impersonation Job Scams and Advance-Fee Equipment Fraud.