You’re Hired! (Job Scams)
Below you’ll find a variety of job scams. All involve email communication but some also involve fake company websites/domains or mimics of real companies. If you get suspicious emails or texts to interview for suspicious jobs, send them to us!
UPDATED 6/17/20: A woman contacted us to say she received this invitation to apply for a job that was obviously a scam. We agreed!
From: Booker Lelia <email@example.com>
Sent: Wednesday, June 17, 2020 2:23:18 PM
To: [EMAIL REDACTED]
Subject: [RECIPIENT’S NAME REDACTED]
We are logistic company and we will be glad to see you in our state. If you live in the US and ready for full-time, stable remote work, we’ll be happy to see you on our lists of workers.
– Remote job from your place
– Full week job
– The head company is located in the U.S.A.
– 3500 dollars monthly salary
– Have a experience not required
– Have capability for remote work on your own
– Have a valid postal address in the USA
– A citizen of the USA
– Capability to lift parcels up to 20 lbs
– Receive the list of current packages through a special soft.
– Check the presence of the contents in parcels, make photos of the contents and upload them
– Process different parcels to your house through postal services
– Pack parcels again if necessary
– Forward the parcels to the final destination, print logos and deliver to the nearest delivery service.
If you are interested in having this job do not hesitate and respond on this email with your phone number and our HR-manager will reach you as soon as possible.
In December, 2019 we were contacted by a woman who was hired by Sinopec-USA.com. (<–SCAM DOMAIN!) This is NOT the same as Sinopec.com or SinopecUSA.com, both of which are legitimate related companies. The woman tells her story very well but it is clear to TDS that she was helping a group of scammers conduct their scams, as well as being victimized:
Effective May, 2019, I was hired by a person who claimed to be Wang Dehau, CFO of Sinopec-USA. My job description was accounts payable/payroll… jobs I have had experience doing. I completed and signed several documents, including the employment contract, which had Sinopec’s logo and letterhead. I was to be paid $3500.00 per month. Once those documents were approved, I was to start work on May 6, 2019. However, on May 2nd, Mr. Dehau required me to personally purchase the supplies and equipment that my job required. These included blank business check paper (in order to print checks), 2 types of security envelopes, special MICR printer ink, and a printer. These were paid for out of my personal funds (which I had to borrow much of). I was to be reimbursed within a few days, plus interest according to the contract.
I was told that Sinopec would furnish the laptop computer I would need for my work. Mr. Dehau stated I would receive one at the end of May, when new computers for their new office location in Monterey Park, California would be delivered. He would send me one of those. In the meantime, I needed to borrow and use a family member’s desktop computer to use. For whatever reason, Mr. Dehau was not able to get me the laptop. He advised me to purchase one. With his approval, I did. At this point, I found a several questionable issues…
RED FLAG #1 – When I accepted the job offer, I was told the office location was in Monterey, California, near where I lived. But then, I noticed the zip code was for Monterey Park, California, more that 500 miles away. Since my work was to be done remotely, it was agreed that this would not affect my job duties. Still, the address has not been corrected on the Sinopec-USA documents and e-mails. The area code of the phone numbers provided was 831, the area code related to Monterey, California, and not Monterey Park, California.
RED FLAG #2 – Even though I requested an employee manual and a description of my job duties, I was not given any. All contact was to be made by and to Mr. Wang Dehau, by e-mail and text messages. There was no voice contact. I was told Mr. Dehau would walk me through each step of the procedures for the job. Nothing was in writing.
RED FLAG #3 – Soon after I was hired, Mr. Dehau texted me asking how I wanted to receive my pay. He asked if I wanted a check, direct deposit, or cash. I thought the suggestion of pay by cash was odd. I said I wanted it direct deposited to my bank account. He asked for and I gave him my bank account information. When it was time for me to receive my 1st month’s pay, I didn’t receive it. Mr. Dehau explained that there was an issue in the direct deposit. It was then that I was informed the pay would come from China. He asked for my bank’s Swift code and international wire transfer information, which I gave him. For some reason, that didn’t work, either. I explained to him I was in dire need of my pay and had not yet been reimbursed for money I paid for the supplies and the printer. He seemed to want to help me. He had me set up a Bitcoin account and attempted to send me some funds that way. Unfortunately, the only Bitcoin machine within 75 miles was not working. Another reason for the delay of pay, Mr. Dehau was in New York. He said he got permission to open a U.S. bank account that he would use to pay me from. This took some time. But I never received my pay from any such bank.Somehow, it was suggested that money could be transferred to my bank account using Zelle. This was set-up on both ends. Since Zelle has a daily transfer limit of $2000.00, multiple transactions from different payers would need to be made to pay me in full each month. This is how I was paid. Different individuals, whom I did not know, would pay me by Zelle. Mr. Dehau would text me to verify I had received those funds. None of my pay states that it was from Mr. Dehau or Sinopec. I had asked Mr. Dehau to provide me an itemized list of my pay on Sinopec letterhead so I could have proof of income from my job. He agreed, but never sent that.In addition to this Mr. Dehau wanted me to make payments by wire transfer on his behalf from my personal bank account. I told him I was not comfortable with using my personal account and would be willing to through a company account. At that point the subject was never brought up again.
RED FLAG #4 – The phone number that Mr. Dehau texted me from was changed 3 times. The last time, the caller-ID had someone else’s name. He has changed the e-mail address he uses twice.
In fact, other than the initial employment paperwork, I have received nothing that has the Sinopec name or logo on it. My job consisted of receiving an e-mailed list of payee names and addresses, with PDF copies of checks that I needed to print on blank check forms, amounts ranged from $2000 to $5,000,000. The checks were bank (cashier or official) checks from different banks made payable to the payees on the e-mailed list. I printed the checks and prepared them for shipping by FedEx. I was required to hand-write each FedEx shipping label with the shipper name, address and phone number, of which, at various times, were different, but was not mine, nor Sinopec’s. The FedEx shipper account number remained the same. I am still perplexed on why, if they had PDF copies of the checks, why such an easy task could not be performed where they originated. And—why the shipping labels could not be printed through the FedEx website, which FedEx preferred. FedEx is reluctant to give out the blank hand-written forms. Mr. Dehau instructed me to go to different FedEx shipping offices to pick up the forms, knowing that each location would limit the amount they would provide me. I eventually ordered those forms online, because it became difficult to get them locally.Another extremely odd situation was that Mr. Dehau required me to drop off the shipping envelopes at different FedEx shipping locations and drop-boxes, even if some were 20 miles away. He did not want me going to the same location multiple times. He didn’t want to show a pattern of the drop-offs. After dropping off the envelopes, I was to itemize the checks issued, along with the FedEx tracking numbers, on a spreadsheet and e-mail that to Mr. Dehau.
At the beginning, I usually received text messages from Mr. Dehau daily to let me know if there was work for me to do that day. The work was pretty consistent the first month. The job was described as part-time work, but I was to be paid salary. Later on, Mr. Dehau would contact me if there was work, but it would be with very short notice, a couple of hours, at most. I had to wait for his e-mail before I could proceed. Because of this, it was important for me to be available, even when it turned out he didn’t need me that day. Often, he would have work on Saturdays. There were times, due to the short notice, that I was pressed for time to get the envelopes dropped off before the final pick-up at the FedEx location. The first two months of my employment, the issue of receiving my pay and expense reimbursement became difficult. This seemed to be ironed out by the third and fourth month, where I received my pay by Zelle on the first of August and September. My pay for September was due to be paid on October 1, 2019. By October 3rd, I had not received it. When I inquired on when I would get my pay, Mr. Dehau told me it would be paid on October 7th. I told him he put me in a dire situation, and I needed it right away. He had arranged to send me $1500.00 by Zelle and said I would get the rest on October 7th. I was willing to wait till then for the balance. I never received that. I never received pay for October, even though I was available and willing to work. I never received pay for November, even though I was available and willing to work.
There would be weeks that I would not hear from him. I requested he contact me many, many times. I sent him text messages and e-mails and tried calling and left voice messages on the phone number he uses for texting me. After a couple of weeks, he would contact me, often having an excuse for not being able to receive my messages (he lost his phone, he was traveling, he was ill). He would promise to pay me and that he was “working on it”. Sometimes, he would give me a date on when to expect payment, which never transpired.
My most recent communication with Mr. Dehau, after weeks of not hearing from him, he explained he had been hospitalized and wasn’t able to use a computer. He acknowledged that I was due payment of $10,000 for back pay and reimbursement for fees, charges, and interest costs that I incurred due to not being able to pay my debts during the months of non-payment. He went on to say that Corporate wanted to rescind my contract since they felt I was being overpaid for the amount of work that was given to me. He acknowledged that due to no fault of mine, since I was always willing to work and even requested to do more, he wanted to keep me on. But he wanted to draw up a new contract that included more work. I advised him that I desperately needed my pay, first. The new contract would include the following duty: he would send me $10,000 to $25,000 to be deposited into and dispersed from my own personal checking account. Of that he wanted me to keep $1500.00 for myself as partial payment for money owed to me by the company, and buy bitcoin with the rest, then deposit it into an investment account belonging to Sinopec. He would have several of these transactions over the next couple of weeks, which would enable me to collect $10,000 in $1500 increments.I told him I would not sign a new contract until I got my pay. I even suggested that he could pay me $2000 each of 5 consecutive days.
Though I desperately need and am owed my pay, the new duties he outlined leave me very suspicious. I don’t know why I would be needed to perform these transactions and if it would even be legal. His snide response was “Good luck with that”. At this point, it is reasonable to expect no pay. His attitude was scornful and unprofessional. My last contact with Mr. Dehau was a text message I sent him 12/8/2019: I wrote: “Mr. Dehau, Please don’t put me in a position where I have to contact Mr. Zhen Guo Wang and other executives of Sinopec to verify your validity and authority. Please don’t put me in a position where I have to contact Federal Law enforcement to investigate the legality of your personal and business functions in the United States. I have worked in payroll processing and accounts payable, never using the processes you had me utilizing. In all my experience working for several companies, I have never encountered the unprofessionalism, lack of business ethics, and the unusual methods of communication, salary payment, and accounting processes. This has led to me being suspicious of your integrity. If I don’t hear from you and receive my back pay, you will leave me no choice but to proceed.”
Mr. Dehau’s 2 text responses on 12/12/19:“Proceed” and“Your threat will cost you more than you bargained for and I will make sure it does”
Phone numbers and E-mail addresses used by Mr. Dehau:
firstname.lastname@example.org (Note: Yandex.com is a tech company in Russia that offers free email service)
(UPDATED 8/25/19) A TDS reader contacted us about an invitation he received to apply for a job with an “executive recruiting service” called Recruitmento[.]com. Though Google shows a couple of links to this service, a WHOIS look up of their domain tells us that it was registered just two months earlier (August 26, 2019) in Pakistan and is being hosted on a server in Amsterdam, Holland. Also, Google could not load their website on October 25 but the reader who contacted us received an email from someone at Recruitmento. All of this sounds very suspicious to us!
(UPDATED 8/21/19) We got this email from a TDS reader who received an offer to apply for a position as a “Customer Service Manager” with a company called eCrypto Pay Inc. The contact came from Marinda Terrasea Peters via her email at “workmail.com.” How many red flags can you spot in this email? We count at least 4…
RED FLAGS about the job at eCrypto Pay Inc.:
- The email came from the domain “workmail.com.” This domain is a generic email service offered to businesses through Amazon. It should have come directly from the company’s OWN DOMAIN! We searched for eCrypto Pay Inc. using Google and find a domain called ecryptopay.com. Why didn’t the email come from the company’s domain?
- We searched LinkedIn and Google for “Marinda Terrasea Peters” and found no one by that name. Also “Marinda T Peters” returns zero results from Google. (There was a school counselor in Oregon who had the first and last names, but not the middle name “Terrasea.”)
- The job claims to offer work-at-home 15 hours per week for $2,750/month. That works out to be nearly $46/hour for a Customer Service Manager. SERIOUSLY?!
- Even if this were legitimate, the website/business ecryptopay.com has less than stellar ratings on ScamAdvisor.com based on remarks like…
- The owner of the website is using a service to hide their identity
- According to Alexa this site has a low Alexa rank of 1349363
- The speed of this website appears to be slower than average
- This website has not had any feedback on other sites
- This website’s setup involves 2 countries
(UPDATED 8/7/19) A TDS reader sent this email to us that he received shortly after reading this article! Notice the the sender’s email address and address to contact are different and neither represents a verifiable company! They are free generic email services.
(UPDATED 7/21/19) We have been seeing an increasingly sophisticated number of job scams. Some have been around for years while others are new and involve more sophisticated effort by the criminals who create these scams.
Several employees at Craigslist all received this same email about a job offer. It is a completely new idea for a job scam AND a bit gross to look at. The sender, who never identified himself, sent the following emails and photos to explain that he needed to hire someone since he “will be traveling out of town to go and have rest at my cousin’s Place in china cause I just finished a surgery….” He wants to hire you as a “payment representative” to “make out payment to my construction workers…” This is complete BS! Don’t fall for this malarky. (And we apologize if these photos gross you out.)
Another TDS reader sent us this VERY suspicious email offer of a job that came from Mr. Lin Li, representing the company “Bright Food Group co Ltd.” Though there appears to be one or more company called Bright Food Group in the world, this job offer is a scam because of several serious red flags….
- The “Job Offer” email came from an email address named “Agostino Bernabei” on an email server in Italy, though the email is signed by “Mr.Lin Li”
- The REPLY-TO address built into the email is a generic Gmail address: brightfoodgroupcolimited “@” gmail.com. This is a very common scammer trick to send an email from one address and engineer a reply to a different address, especially a generic Gmail account. And neither of these email addresses is for a domain owned by Bright Food Group.
Here is a job scam that was sent to one of our readers on July 9, 2019. Several important things to notice about this email are:
- It comes from a generic Gmail address, not a company, and the candidate is asked to contact someone back through a generic Yahoo email address. Not a verifiable company.
- The English in the email is very awkward and full of errors. Not very professional and suggests that this is a foreigner sending it.
- The payment for a “home based position” is absurdly high!
From: <abhishek.aj207 “@” gmail.com>
Date: Tue, Jul 9, 2019, 9:40 AM
Subject: JobPositionAlert R;078260662144119531 abhishek.aj207
To: <EMAIL REDACTED>
Our Company is returning back concerning request on a CareersBuilder.
We have noticed that you match our Company key criteria for position of Purchasing Agent.
PAYMENT RATE: $94,800.00 to $104,800.00 / yearly
JOB TYPE: Home based position
Key dutiesinclude the management of vendors base and goods purchased from outside sources. You will make agreements which will help to deliver value to company’s stakeholders service, quality and added value which do maximize the supplier’s capabilities.
Major Responsibilities and Duties include:
Secures quotes from qualified suppliers of necessary resources to obtain most favorable cost terms and services to meet production plan
– Prepare plans and temporize long term contracts
– Monitor supply chain initiatives including controlling supplier selection
– Initiating, evaluating and tracking vendors price, quality, and delivery and logistic
– Overlook logistics to be sure of goods timely shipment with proper documentation
Skills and Competencies:
– Be detail oriented, methodical and well organized
– Be able to work in a group
– Be able to build morale and group commitments to goals and objectives
– Be able to work flexible hours
– Working knowledge of Microsoft Office and office equipment
– Valid DL and Driver experience is needed.
If you have an interest and qualified, please send us your resume to deering.galvan “@” yahoo.com
!Only candidates with a Resume are going to be studied!
Here is a scam that targeted a woman we will call “Mary” who contacted us about a suspicious job offer she received after posting her resume on CareerBuilder.com. The job was for a position as “Superior of Procurement” for a company called GetYourGoods[.]info. Mary received the following response from hr “@” getyourgoods[.]info a few days after sending them an initial email:
We couldn’t help but notice the subject line in the email that Mary received from the HR Department at GetYourGoods[.]info. This is not information she had seen before and it didn’t make much sense to her. A search of “laluprasadsah” only turns up links about men from India such as a comedian, and a man with a twitter account containing just one tweet. The HR Department had sent Mary the attached 2 page pdf file about a job as a “Supply Chain Assistant.” It was described as a home based, part time, online office job that paid $30/hour “plus bonuses for every processed package on a monthly schedule.” If you read the two pages about this job description, you’ll see that it uses a lot of language but actually says very little. It also sets the bar for important skills very low. By our reckoning, the job description from this company requires the skills of a typical fifth grader! Here is a sample of the skills required…
- Ability to read and comprehend simple instructions
- Ability to write simple correspondence
- Ability to add and subtract two digit numbers and to multiply and divide with 10’s and 100’s
Our favorite required skill for the job is…
- Ability to apply commonsense understanding to carry out detailed but uninvolved written or oral instructions
We invite our readers to email us with their interpretation of “detailed but uninvolved!”
After Mary sent us this information, we couldn’t wait to apply and so we clicked the link to getyourgoods[.]info/careers and this is what we found for their application process:
- An “Online Hiring Center” that asks us for limited personal information such as name, address, phone number, and email.
- This was followed by fields for prior work experience.
Followed by a request for three personal references
What followed these fields completely surprised us. It is the most extreme example of interacting with a scam victim… errr, we mean job candidate, without actually speaking to him or her in the Interview process. GetYourGoods[.]info presented us with a series of YouTube Channel interview questions! We were asked to click 20 videos, listen to the question in each and enter our response in the field under the video! The two presenters in these videos both had British accents. We unearthed the source of these videos on YouTube and learned that they were all uploaded to a YouTube Channel called “Job Interview System” in November, 2015. This Channel is unlisted on YouTube, has only 18 subscribers as of October 8, 2018, and no other content.
Here are the questions asked in the first ten videos, plus a link to them on YouTube. HOWEVER, we cannot open these YouTube links from our website since they are embedded commands. If you want to see the videos, please copy the link and paste it in a new browser window:
- How would you describe yourself in 3 words. (https://www.youtube.com/embed/0wcEAK5zJuM)
- If I were to meet your current colleagues, how would they describe you? (https://www.youtube.com/embed/9v8nrsV3b4U)
- We’ve had a lot of people apply for this position. What can you offer that they can’t? (https://www.youtube.com/embed/AiawgXiPTuk)
- Do you know what your key skills are? What’s your biggest strength? (https://www.youtube.com/embed/lff1MK_ESaI)
- Everyone has areas where they need improvement. What’s your biggest weakness? (https://www.youtube.com/embed/q0K0AvPogOY)
- How would you rate your suitability for this role on a scale of 1 to 10? (https://www.youtube.com/embed/z1axAw9pMXE)
- Do you have any competition for your services? What other interviews have you been to? (https://www.youtube.com/watch?v=rsYeUR_7e_s)
- To help us work out a suitable salary for you, can you tell us you’re earning in your current job? (https://www.youtube.com/embed/o1pXYDdvjiM)
- If we were to offer you the job, what would your salary expectations be? (https://www.youtube.com/embed/4nA2nOrRq8I)
- Have you done any research into our company? What did you learn about us? (https://www.youtube.com/embed/0xHVL325enI)
We filled in the response fields with our thoughtful and detailed responses…
Finally, after responding to all twenty interview questions for our personal and thorough “job interview” we were told by the website that our application was complete!
At that point we were redirected to the GetYourGoods[.]info website where we could look for more information about this innovative international company for international shoppers. But who is GetYourGoods[.]info and what do we know about them, besides the fact that they don’t want to see or speak to the people who apply for their jobs?
- GetYourGoods[.]info is a domain that was registered on July 20, 2018 (just a couple of months before it came to our attention) by someone identified as “Ernest Wylie” from Florida. Despite checking multiple WHOIS registries, there is no email address, no physical address listed, or other company information for this registrant. Just a name and state.
- We used Spokeo.com to locate anyone with the name “Ernest Wylie” in the state of Florida and found only one option, though with a different first name, and with Ernest as his middle name. We called and spoke to Mr. Wylie on October 9 and he informed us that he did not register the website, has no knowledge of it, or connection to it at all.
- The address listed on the Contacts page of GetYourGoods[.]info is 222 W 37th Street 15th Floor, New York, NY 10018. We conducted a Google search for that address and could not find any business by that name on any floor of that building. We called “Sea & Air, International,” a business on the 3rd floor of this building. The gentleman we spoke to said that he has never heard of GetYourGoods[.]info but also told us that companies “come and go” at that building like a “revolving door.”
- We used several online tools to conduct a search for any business in New York called GetYourGoods[.]info, GetYourGoodsand Get Your Goods. These tools included the Better Business Bureau, New York Department of State, and New York Biz List. All search results came back negative. No such business could be found.
Though the GetYourGoods[.]info website is quite extensive, we couldn’t verify anything from it, except the email Mary received from the HR Department several days earlier. Businesses are generally in the business of providing a service and generating income and jobs for employees and company owners. This usually means that the business tries to promote itself, and make itself known through advertising or social media. And yet, we couldn’t find anything about GetYourGoods[.]info EXCEPT their website! No reviews, no list of clients, no references except for a few quotes that scroll on one of their web pages. Here are two we particularly enjoyed….
We noticed the attractive photo on the top page of their website showing a young man in orange and red, against the red van in the background. After conducting a web image search for that picture through Google, we found that image was a stock photo that has been used on several delivery websites in India and the UK including:
https://nextgenlogi.com/ (Use left/right scroll arrows to locate the image)
Pushpak Courier Service listed on the website JustDial.com
The point here is that this graphic seems to be used by many delivery services outside the United States. The images and professional looking website don’t mean this job is legitimate or legal.
So what could be going on with this “company” that might put people at risk? According to several good sources, a common scam that has been around for years concerns criminals who trick everyday people into receiving stolen merchandise, or merchandise purchased with stolen credit card information. These innocent people then re-package the merchandise as a part of their “job” and ship it to the criminals overseas! People can get into serious trouble for this scam. As you can guess, it is called the “Package Shipping” scam. Caveat Emptor! Here are two articles that describe this type of scam well:
Watch Out for the Package Shipping Scam (RealWaystoEarnMoneyOnline.com)
Money Laundering and Reshipping Scams (Monster.com)
By the way, we finally heard back from GetYourGoods and guess what? THEY HIRED US! We’re so excited and can’t wait to go to work for them. Here’s the contract offer they sent us…
Over the years, we’ve heard from many people who have posted their resumes online with sites like CareerBuilder.com and ZipRecruiter.com. Scammers target them with fake jobs that are often sophisticated “Advance Check” scams. In late summer of 2018, one woman contacted us to say that a job scam we had identified in our article “Job Interviews in Google Hangouts” (Look at job posting #26 at the bottom of the page) was also posting fake jobs on a website in Ohio called OhioMeansJobs.com (Powered by Monster.com). [We don’t mean to imply that either OhioMeansJobs.com or Monster.com are complicit in these scams. They are being defrauded as well.]
Take a look at this first scam job that appears to be posted by the very real company called “Star Consultants.” If “Marilyn Jones” of Star Consultants is looking to interview people for the position of Office Manager/Administrative Assistant, then why did she list her email address as coordinator “@” amerirootbergen[.]org instead of @starconsultants.org?
Star Consultants is a long established firm and easily verifiable. However, who is Amerirootbergen[.]org? The domain Amerirootbergen[.]org was registered on August 8, 2018, just 4 days before this job was posted. It was registered through a private proxy service and is being hosted in Amsterdam, Holland, though no website can be found for it. Google knows nothing about it.
Here are three more scam jobs posted on OhioMeansJobs by the same criminals. They all ask that interested candidates contact someone at Amerirootbergen[.]org. And they were all posted on the same day in August, just four days after the scam domain was registered. None of these represent the real companies or organizations listed on the job posting:
No article about job scams would be complete without some mention of the “Mystery Shopper” scam job! We’ve written about it many times, but like a “bad penny,” it always turns up. Most recently, it turned up in our inbox! (Notice the “reply-to” address in this email. It is for “krogre.com” not kroger.com.
The link for “Join Us” pointed to a hacked website in Belgium called VRGroup.be. This Belgium company is an international drink importer! Fortunately, they quickly discovered the misuse of their website and removed the offending pages. At the end of 2018, these scammers tried this trick again. This time the “reply-to” address will send your email to Korger[.]com! Korger[.]com was registered in the Cayman Islands and is hosted on a server in Germany last time we checked.
The fake Kroger Job scammers are still at it. Notice how they have misspelled the word “jobs” in the reply-to portion of the email. The link to apply points to the hacked website called CoachingByRich[.]com…
Also, be very skeptical if you receive random emails like this one that came from a server in France (2-letter country code = “.fr” but you are asked to reply to a different address. And they didn’t even list the country!
Over the years we’ve written about many job scams of many kinds. Here are links to some of these scams. Enjoy!
Do you think you know about a job scam? Let us know! Email us at email@example.com