Hacker News Reader

Alternatively to the GPG route, maybe just post the domains which approved recruiters would ever be messaging candidates from. This would go a long way in countering scammers that don't have access to a compromised recruiter account, for example.

Honestly I don't think there's anything you can do.

In the same way you should call banks back when they call you and need a PIN or something, you need to similarly contact companies directly when they ask for an SSN or something.

As a general rule, companies can't protect individuals from being scammed in the name of the company (except for basic things like HTTPS, etc.). It's up to individuals.

Sign all emails with GPG. Display public keys of each recruiter on website.

.. after sending each recruiter to a week-long GPG training class.

Most recruiters who call me have a pretty poor command of the language and very few even speak clearly on the phone because they've left the same message 1000 times already. Expecting them to sign emails is expecting far too much.