(FORTUNE Magazine) – IT SEEMED A TERRIFIC opportunity. Laid off from a senior marketing job, Tom (not his real name), an MBA with 22 years' experience, spent several months look- ing for a new position. Then he got a phone call from someone who said he was the human resources director of a large, well-known insurance company. The HR guy said he was impressed with the résumé Tom had posted on a popular Internet job site and was eager to meet as soon as possible, since Tom was the ideal candidate for a new marketing job the company was creating.

Just one tiny detail: "He told me that since they were anxious to fill the position quickly, they wanted to save some time by starting a routine background check right away," Tom says. "He e-mailed me a very detailed form to complete and return." Tom complied, filling in the blanks for Social Security number, date of birth, mother's maiden name, even a bank account number. After a few days of vainly trying to get back in touch with the HR director, Tom began to feel uneasy. Then he tried to use one of his credit cards and discovered that not only was the account maxed out, but several new accounts had been opened in his name and squeezed dry. His identity had been stolen, and it has taken him almost a year to straighten out the mess--all the while kicking himself for having fallen for the scam.

That happens every day. "It's such a foreign idea to most of us that looking for a job can put you at risk like this," says Pam Dixon, head of the World Privacy Forum in San Diego. "It's not that people are stupid, but the con artists are very slick and very believable. If they send you an e-mail, for instance, it will have the real logo of a real company on it. We call it corporate namejacking." Job hunters, especially if they are among the 1.3 million Americans who have been out of work for longer than six months, are often the perfect pigeons. Notes Dixon: "Someone who is desperate for a job usually doesn't hesitate to give an 'employer' whatever he asks for." Moreover, scammers can swipe your identity without even getting in touch with you first. Harvesting information from résumés on Internet job sites and then matching it up with phony Social Security numbers cheaply available elsewhere on the web is a fast-growing international scheme. The World Privacy Forum employs seven full-time staffers whose only job is responding to panicky callers, many of them online job hunters, whose identities have gone AWOL.

How can you protect yourself? Here are some simple steps to take as you job-hunt.

•Post a "cybersafe" résumé. "Twenty years ago no one would have posted his full résumé on telephone poles or handed it out to casual passers-by on the street," says Susan Joyce, president of a web portal site for job seekers called Job-Hunt.org. "Yet so many job hunters do the electronic equivalent today." All reputable job sites give you the option of posting an identity-suppressed résumé--see Job-Hunt.org for a sample--so take them up on it. While you're at it, set up a throwaway, anonymous e-mail address just for your job search. At the very least, it will stem a tidal wave of spam that might otherwise inundate your regular e-mailbox.

•Never, ever put your Social Security number, home address, or date of birth on your résumé. Period.

•Know the keywords that con artists use. Don't even think of responding to any job listing that asks for a scan of your driver's license, or that includes transferring money as a part of the job description. Nine times out of ten, those "jobs" are frauds.

•Before posting anything, read each site's privacy policy and its statement regarding deleting your résumé after you've found a job. Will your résumé be shared with other job sites? Can you delete your résumé whenever you want to, and do you understand the instructions for doing so? If the site gives no specific information about how your data will be used, shared, and stored, or if your résumé can't be deleted at your discretion, take it elsewhere.

•Keep track of everything you post online. "Printing out copies of job applications you filled out and of résumés you posted will make it easier to go back and delete the information later," says Dixon. "And if you run into a problem with a site, it helps to be able to prove exactly what you posted on it."

•If a would-be employer requests personal data, call the company (using a phone number you get from directory assistance or from the company's annual report, not from the person who has contacted you) and verify that the manager who says she wants to hire you is really who she claims to be.

•If you suspect an online job fraud, or if, God forbid, you've already been scammed, contact the Federal Trade Commission at 877-FTC-HELP, or file a complaint online at www.ftc.gov. Victims of identity theft can get step-by-step pointers on what to do now from the Privacy Rights Clearinghouse (www.privacyrights.org/identity.htm) and the Identity Theft Resource Center (www.idtheftcenter.org).

Above all, says Dixon, "Bear in mind that in the information economy, your résumé has a 'street value.' "

Send questions to askannie@fortunemail.com. Annie offers advice weekly at www.askannie.com.