Your LinkedIn sent recruiter messages you did not write, but you can still log in? End every session, check connected apps and warn contacts, in order.
If your LinkedIn is sending fake recruiter messages but you are still logged in, someone else is likely signed in too. Submit LinkedIn's unauthorised access form, change your password, turn on two-step verification, and use Where you're signed in to sign out of all other sessions. Then check connected apps and warn your contacts.
SummaryA contact replies to a message you did not send. It came from your account, posing as a recruiter for a big brand, asking about their job search, salary and location, and pointing them to an outside chat or form. You can still log in. Your email and password look the same. But the messages keep going out.
This guide is for that situation: the account is still yours, but someone else is using it too. If you are locked out or your email was changed, follow our guide on a LinkedIn hack with the email changed instead. Here we cover the order of steps from LinkedIn's compromised account page and its Where you're signed in page. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 4 November 2026.
If your LinkedIn is sending fake recruiter messages but you are still logged in, someone else is likely signed in too. Submit LinkedIn's unauthorised access form, change your password, turn on two-step verification, and use Where you're signed in to sign out of all other sessions. Then check connected apps and warn your contacts.
LinkedIn's compromised account page says accounts are typically compromised when a bad actor has access to your login credentials or a device that you are logged into. It lists ways this can happen, including signing in on a public or shared device without signing out, an outdated email or phone on the account, and a reused password obtained through a phishing attack unrelated to LinkedIn.
A session is a live sign in. LinkedIn's Where you're signed in page says a session is created when you sign in and stays stored as active until you sign out. That is why a new password on its own may not feel like enough: the steps that matter here are ending the other sessions and securing every route back in.
Do these in order, from a device you trust. The first five steps come from LinkedIn's compromised account page. The order and the last steps are our checklist.
LinkedIn's Where you're signed in page gives this path on desktop: click the Me icon, select Settings and Privacy, then under Sign in and security, open Where you're signed in. It says you can sign out of one session, or click Sign out of all these sessions and enter your password to end every active session except your current one.
The same page says each session shows the location, IP address and device type, and that you should change your password if you do not recognise a login or device. Take a screenshot of the list before you end the sessions, as a record for your report.
LinkedIn's compromised account page suggests that once you are back in control, you review your recent connections, review the posts and activity made while the account was compromised, and check your connections, activity and messages to delete any actions you did not take.
| Area | What to look for | What to do |
|---|---|---|
| Messages | Recruiter style messages you did not write | Note who received them, then delete them |
| Connections | New connections you did not add | Remove them |
| Posts and activity | Posts, likes or follows you did not make | Delete or undo them |
| Profile | Changed headline, job title or contact info | Restore your own details |
| Email and phone | Addresses or numbers that are not yours | Remove them |
Your contacts trust messages from you. Post a short note on your profile, and message the people who received the fake recruiter message. Say the message was not from you, that there is no job, and that they should not click any link or share personal details. Keep it short and do not repeat the scam link.
LinkedIn's scams page says job scams typically involve people pretending to be recruiters or employers offering high paying jobs for little work. It lists warning signs such as requests for payment or account credentials, early requests for banking details or ID photos, urgent requests to move off the platform, and emails from generic addresses instead of a company domain. Share those signs with your contacts. If someone was scammed, the same page says to report it to local law enforcement.
Malaysian job seekers and HR staff are targets for fake recruiter messages, and a hijacked recruiter or HR profile can damage the owner's name locally, because people know the company behind it. If your account sent fake offers in your employer's name, tell your HR or IT team early, so they can warn candidates and confirm the real hiring channels. Anyone who lost money can make a police report, and you can point them to our guide on reporting a fake LinkedIn recruiter.
LinkedIn decides how it handles your unauthorised access report and whether it takes action on the messages sent from your account. Its Professional Community Policies say not to scam, defraud or deceive others, so the fake messages break its rules even though you did not send them. Reporting quickly puts your side on record.
Getting help is safer when messages keep going out after you have ended sessions, when the email or phone on the account changes again, or when the account carries your company's name and candidates were contacted. A rushed fix can leave a route open, and fake helpers target people right after a takeover.
If you are unsure about any step, or the profile matters to your work, having an experienced team check it is the safer choice. AwareXone does this work. See our account security page.
A case review helps when you need a clear order of steps for a shared session takeover, or when the intruder keeps coming back. We are a Malaysia-based team, independent of LinkedIn, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.
More free guides on the same kind of problem.
