Handshake

Is Handshake safe?

Handshake is reasonably safe for a student job search, but it starts from a less private position than most job sites. Many universities create your account for you and fill it with directory data, and the profile is public to employers until you change it. That matters because Handshake's audience, students looking for a first internship, is exactly the group fake recruiters target. In 2020 a party posing as a company used the platform to download thousands of public resumes in one go.

We score Handshake 53/100, level with ZipRecruiter (53), behind Indeed (57) and ahead of LinkedIn (48). It does better than most job sites at checking employers, and worse on login security.

What your university shares with Handshake

Handshake sells its service to universities, and the school is often the one that brings you in. According to Handshake's privacy policy, updated in July 2026, a partner school chooses what to send, which may include your name, mailing address, email, major and GPA. Where the US Family Educational Rights and Privacy Act (FERPA) applies, Handshake says it processes this data in compliance with the law. When you first log in, you "claim" the pre-filled account and can add a resume, transcripts and job interests.

Two defaults deserve attention. Student profiles are public when the account is created, visible to employers and other users. And when you post an employer review without your name, Handshake still shares your identity with the schools you are linked to.

Apple's privacy label for the app is short: identifiers, usage data, diagnostics and contact details linked to you, with no tracking section. The policy is broader. It says Handshake sends hashed email addresses or identifiers to LinkedIn and Meta to measure its ad campaigns, may share data for cross-context behavioural advertising depending on your choices, and separately acquires data from other businesses to supply to AI labs after removing direct identifiers. You can opt out of ad sharing in Handshake's Privacy Center. We score privacy on the policy, because it discloses more than the label.

Fake recruiters and employer checks

Handshake's own scam guide describes the usual pattern. A "recruiter" contacts you about a job you never applied for, often under a real company's name, sets up a quick fake interview, and then asks for your personal details or sends you to a fraudulent application form. The warning signs are requests to continue by email, link, WhatsApp or text, and pay that is far too high for the work.

Handshake has more controls here than an open job board. New employer profiles must pass validation through Persona, an identity verification company, with the creator's government ID and the company's business registration number, and Handshake says it keeps monitoring accounts after that. Career centers can also refuse to approve an employer for their school. None of this stops someone who has a real company behind them, or who contacts students outside Handshake.

The 2020 incidents show the weak point. In February that year, the University of Delaware warned that an unknown party posing as a company had downloaded the public resumes of 4,003 students and 4,026 alumni, according to the student newspaper The Review. Nothing was hacked: the resumes were public, and an account that looked like an employer collected them. A month earlier, St. Joseph's University in Philadelphia told about 1,800 students and alumni that an account impersonating Centene Corporation had viewed their profiles, its student paper The Hawk reported.

School accounts are open from age 16, and younger students can join with a parent's consent form. The App Store rates the app 4+.

Login security and Handshake AI

Handshake offers no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary setting for students. It may ask for a one-time code sent by email when a login looks risky, and accounts not created by a school need a verified phone number at sign-up. Its trust portal lists a SOC 2 Type II report, ISO 27001 certification and penetration tests, and it takes vulnerability reports at a security address, but we found no public bug bounty.

Handshake now also runs Handshake AI, which pays people 18 and over to train and evaluate AI models. That side collects far more: a government ID, a selfie and a liveness check, possible background checks, recordings of AI interviews and, on some projects, periodic screenshots and keyboard activity levels.

How to use Handshake safely

1. Set your profile to private unless you want employers to contact you.
2. Remove your home address and phone number from any resume you upload.
3. Reply to recruiters only inside Handshake, and check the job on the company's own careers page.
4. Never pay for training, equipment or a background check to get a job.
5. Use a strong, unique password, and protect the email account you log in with using two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary.
6. To leave fully, ask your career center to delete your record as well as Handshake.

How we scored it

Regulatory record (87) is Handshake's highest factor: we found no fine or order, but no large regulator has examined it closely. Security (52) reflects the 2020 resume scraping, no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login for students and no public bug bounty, against solid audits. Privacy (45) is the lowest, because profiles are public by default, schools pre-load academic data and the policy allows ad sharing. Scams and harmful content (50) credits employer verification but counts fake recruiters aimed at young users.