Job offer scams: the two ways they take your money

Two roads, and a third that looks like a game

The FTC’s Job Scams page, dated March 2023, begins by saying that scammers advertise jobs the same way honest employers do: online, in newspapers and sometimes on TV and radio. The ads promise a job but want money and personal information. That one sentence covers two different traps, and the pages we read describe them in different words.

On the first road you pay to get the place. The FTC lists kits, “training” and certifications that turn out to be useless. On the second you are handed money that is not yours to move. The FTC describes a cheque you deposit and part of it you send on, and parcels you repack and send to another address. The FBI New Haven notice of October 2022 defines a money mule as someone who transfers or moves illegally acquired money on behalf of someone else, and says some mules know they are supporting criminal enterprises while others are unaware that they are helping criminals profit.

The FTC Data Spotlight of December 2024 adds a third version: paid tasks in an app. The pages we read do not say which of the first two roads is more common, and they give no separate loss figure for moving money. The sections below take the roads one at a time, then the question of how an offer reaches you and what to do once it has worked.

The ones that ask you to pay

The consumer.gov page, from August 2024, gives three signs of a job scam. You are asked to pay first. You are promised big earnings, and it says that a claim of “lots of money fast working just a few hours a day” is probably a scam. And you are told how to pay: by gift card, cryptocurrency, a payment app or a wire service such as Western Union or MoneyGram. It adds that paying these ways is like using cash, which makes the money hard to get back.

The FTC’s March 2023 page lists the forms the first road takes. In a work-from-home job that promises thousands of dollars a month for little time and effort, you may end up paying for kits, “training” or certifications, or find your card charged without permission, or receive a fake cheque. On mystery shopping it writes that while some jobs are honest, “many are scams”, and that honest companies will not ask you to pay for certifications, directories or job guarantees.

Placement firms get a more careful line. The FTC says many staffing agencies, temporary agencies and headhunters may give honest help, while others promote outdated or fake openings and charge fees. Honest firms do not typically charge candidates, because the hiring company pays them to find people, and the FTC says to walk away from one that asks for a fee, especially in advance. For federal and postal jobs, information is free and so is applying; the FTC points to USAJobs.gov and usps.com/employment and says to ignore ads that promise such jobs. Its 2021 alert adds that ads for “previously undisclosed” federal jobs should not be believed, because the information is public.

The FTC also describes reselling. A call out of the blue or an ad offers money from buying brand-name goods below retail and reselling them. After you pay, the package never arrives or is usually junk.

The ones that ask you to move money

The FTC describes the cheque version this way: you deposit the “employer”’s cheque, you are asked to send part of it back for an “overpayment”, the cheque bounces, and the bank wants the full amount back while the scammers keep the real money you sent. It says the same shape appears in ads for nannies, caregivers and virtual assistants, sometimes in emails that seem to come from someone in your community or your university, and quotes the line “A legitimate employer will never ask you to do that.”

The University of Michigan’s Safe Computing page shows the steps from the student side. The email asks you to print the cheque, cut it to size, write “for mobile deposit only” on the back with your account number, deposit it in your bank’s app and send a screenshot. The bank credits some or all of it, and then the cheque proves to be fake and the account is overdrawn. The page gives one example email dated 4 July 2024, offering a weekly payment for remote assistants and sent from a non-university address.

Reshipping is the parcel version. The FTC says the positions may be advertised as quality control managers or virtual personal assistants. Once “hired” you receive packages, throw away the packing and receipts, repack the goods and ship them to an address you are given, sometimes abroad. The goods are often valuable and bought with stolen cards. The FTC writes that “Reshipping goods is never a real job”, and says the first paycheck does not arrive, the phone is disconnected and the website is deactivated. Personal information given for “payroll” can become an identity theft problem.

The FBI’s Houston office, on 11 December 2020, wrote that criminals recruit money mules to launder the proceeds of online scams and other crimes, and that targets include older adults, students, job seekers and people on dating sites. There is often a commission. Mules add layers of distance and make the money hard to trace. The notice says acting as a mule is “illegal and punishable, even if you aren’t aware” of it, and lists the risks as damaged credit, stolen personal information and personal responsibility for money victims lose. Its advice is not to accept offers that ask you to use your own bank account to transfer someone else’s money, to be wary of anyone who asks you to form a company to open a new bank account, and never to give financial details to people you do not know. The New Haven office warned in October 2022 that college students were being offered fictitious administrative positions.

The Edmonton Police Service describes steps four to six of a seven-step pattern this way: a probationary period in which you agree to message the scammer about your day and your own bank accounts are used for transactions until you are no longer in training; money arriving by e-transfer, a fake company cheque or a draft, which you deposit at once and send to the “client”; and the sending itself, in Bitcoin, Ethereum, iTunes cards, Interac e-Transfer, Flexepin vouchers or a deposit to a third-party account. The seventh step is the bank noticing, which the page says usually takes one or two suspicious transactions, after which accounts or phones are locked down. It counts 148 reports of employment scams in 2022.

The three pages treat the cheque differently. The FTC’s 2021 alert says “Don’t bank on a cleared check”. Edmonton says to wait for the cheque or draft to clear before withdrawing or transferring money, and not to cash one for more than the expected amount. Michigan describes the bank crediting and then reversing. We set the warnings side by side in the table and do not choose between them.

The job that is a game

The FTC’s Data Spotlight, from December 2024, says reported losses to job scams more than tripled from 2020 to 2023 and topped $220 million in the first half of 2024 alone. Driving that, it says, are task scams. The count it gives is about twenty thousand reports in the first half of 2024 against about 5,000 in all of 2023. These are estimates from a hand-coded random sample of 500 reports a year, and the Spotlight notes that the vast majority of frauds are not reported, so the figures likely show only part of the harm.

The Spotlight describes the task as something simple and repetitive, such as liking videos or rating product images, in an app that shows you earning commissions. Tasks come in sets of forty, with promised “levels” and a “double task” that pays more. Small payouts at first build trust. Then you are asked to deposit money to unlock a set or to withdraw what the app says you have earned, and the FTC’s answer is: “That money isn’t real.”

It says the scam typically starts with an unexpected text or WhatsApp message with few details, may use phrases such as “product boosting” or “app optimization”, and may invite you to a group chat where supposed experienced workers share success stories. The Spotlight calls crypto the currency of choice for these scams, and says that for job scams generally people now report losing far more money with cryptocurrency than with any other method of payment: about $41 million in the first half of 2024 against about $21 million in all of 2023. The FTC says to ignore generic, unexpected messages about jobs, writing that real employers will not contact you that way, and never to pay anyone to get paid.

How the offer reaches you, and how to check it

The pages name different doors. consumer.gov says fake ads appear in online ads, on social media and even on job sites, sometimes looking like real companies. The FTC’s 2023 page adds a call out of the blue for the reselling scam. The 2024 Spotlight names the unexpected text. Equifax lists a recruiter who contacts you out of the blue with an offer that sounds too good to be true. Michigan says that legitimate organizations don’t offer employment in unsolicited emails, and describes a pattern of hook, trust, pressure and then a request for money or data: a high wage, remote work and no interview, the name of a real professor, and a line such as “Limited opportunity! Act now!”. It adds that the sending address can be spoofed and the reply address can differ from the sender’s.

Edmonton’s first three steps cover the other end. The fake ad or the fake interest in your résumé comes through LinkedIn, Monster, ZipRecruiter, Facebook, Indeed, Craigslist, Kijiji or CareerBuilder; the contact is friendly and the interview is by email, video or text, on apps such as Telegram or WhatsApp; and the “hiring documents” ask for a photo of your ID, bank accounts with passwords, your social insurance number and your address.

Beyond the cold contact described above, Equifax gives five more signals: a vague or missing company name or a copied description, a fee for equipment, training or checks, a request for a social security number or bank account before any interview, a recruiter who avoids phone and video and pushes you to answer fast, and an email address that does not match the company’s website. Edmonton adds a Gmail, Yahoo or Hotmail address, an ad that is not on the company’s own page, pay that is higher or lower than average, and having never applied on the official career website.

The two lists differ on timing. Equifax says not to send a social security number or bank account before any interview. Edmonton says ID documents are not needed until later in the background check, while noting that some of the information is not unusual because companies need some of it when they hire. On the interview, Equifax treats avoiding phone and video as a signal, and Edmonton treats an interview in a messaging app, or none, as one.

For checking, Equifax says to look at the company’s careers page, the recruiter’s name on LinkedIn and the email address against the company’s domain. Edmonton says to look for whether the company exists and call its official number. The FTC says to search the name with “scam”, “review” or “complaint”, notes that no complaints does not prove a company honest, and says to talk to a person you trust, which also gives you time. The FTC’s March 2023 page points to CareerOneStop and USAJobs.gov for real job listings. The pages we read do not give a percentage of job offers that are fake, and do not describe a check of an offer letter beyond these steps.

If it has already worked

The FTC and consumer.gov say to contact the company or service you paid with and ask to reverse the payment if possible; the FTC’s 2023 page lists a card, mobile payment app, wire transfer, gift card, cash reload card and cryptocurrency as the ways it covers. Then report at ReportFraud.ftc.gov; the 2023 page adds your state attorney general. Equifax adds freezing your credit, telling the company that was impersonated, watching for signs of identity theft and changing passwords.

Michigan says not to respond, to look the sender up in the university directory and make contact yourself, to report to ReportPhish@umich.edu and to file a police report if you paid. If you think you are already a mule, the FBI’s 2020 notice says to stop communicating with the other party, stop transferring money, keep receipts and messages, tell your bank and the transfer service, and report at ic3.gov and to your local FBI office.

Edmonton adds that the people behind the scam call back because it worked, and says to change your phone number if possible, tell your banks and card companies, contact Equifax Canada and TransUnion Canada, and report to the police and the Canadian Anti-Fraud Centre.