Episode Transcript
[00:00:00] Speaker A: Welcome back to behind the Scams. I'm Nick and across the microphone is sue, my favorite co host, my lovely wife, and the only person who can fact check me before the edit.
[00:00:10] Speaker B: Which saves everyone time and keeps you from turning a ten minute introduction into a three part federal investigation.
[00:00:17] Speaker A: For the record, the introduction had probable cause. Today's story begins at 8:47 on a Tuesday morning. Maya has been out of work for three months. She has sent dozens of applications into online portals and heard almost nothing. Nothing back then. A recruiter contacts her on LinkedIn. The profile looks established years at a recognizable technology company, hundreds of connections, recent hiring posts, even recommendations from people who appear to work in the same industry.
The message is personal. It mentions her experience, names a role that fits, and offers a salary that is attractive without sounding absurd.
[00:00:55] Speaker B: So far, this is the part every job seeker wants to receive.
[00:00:58] Speaker A: Exactly. By that afternoon, Maya is in a virtual interview. The video is clear. The background carries the company logo. The voice responds in real time. There are little irregularities. A fraction of delay when the head turns, a mouth that slips out of sync, Eyes that do not quite follow the camera. Maya notices the recruiter, laughs and blames the connection. That explanation is ordinary enough to work
[00:01:24] Speaker B: and once somebody explains a glitch for us, our brains are very good at filing it under problem solved.
[00:01:30] Speaker A: 25 minutes later, an HR representative joins. The questions sound normal. Availability, work authorization, home office needs. Then comes the offer, fast, flattering and urgent. To begin onboarding, Maya is asked for a passport or driver's license, her Social Security number, a completed WE4 and bank information for direct deposit.
The next morning comes one more instruction. Buy a laptop and security package from an approved vendor and the company will reimburse her in the first paycheck. Two days later, Maya calls the number on the real employer's website. There is no recruiter by that name, no opening and no offer. The person she met on camera may never have existed. This is not a sloppy phishing email. It is an engineered hiring experience designed to survive skepticism long enough to obtain documents, money, or both.
[00:02:22] Speaker B: Before we take apart the machinery, how large is the problem?
[00:02:26] Speaker A: The Federal Trade Commission says job scam reports tripled from 2020 to 2024, while reported losses rose from 90 million to 501 million.
In the first six months of 2024 alone, reported losses topped $220 million. Those figures cover a broad category. Faked hiring task scams, bogus checks and other employment fraud. Not only deepfake interviews, but they show the size of the hunting ground.
[00:02:56] Speaker B: Is this mainly A US Problem? Or is it happening worldwide?
[00:03:00] Speaker A: It is a global problem. Because the United States publishes unusually detailed loss data, it can appear to be the center of the crisis. But fake recruiter and job scams cross borders easily. There is no reliable worldwide ranking for this specific type of fraud, so I would not claim there is a definitive top three.
Broader international scam research offers different measures rather than one consistent ranking. Victims in the United States have reported high average losses, while surveys have found frequent scam exposure in countries including Brazil and South Korea. Australia has also established a national effort to disrupt job scams. The larger point is that criminals can operate in one country, impersonate a company in another, and target a job seeker in a third.
[00:03:45] Speaker B: The deepfake is the special effect. The fraud is the production.
[00:03:50] Speaker A: Right on the money, Sue. And sometimes the production does not require a perfect deepfake at all. A stolen photograph, a convincing voice, a camera that is conveniently having trouble, and a believable hiring script may be enough. We should be careful not to give the technology more credit than it deserves, or to assume that every awkward video call is criminal. Verification, not visual guesswork, is the safer standard. One investigator's habit is useful.
Separate what you saw from what you actually verified. Maya saw a recruiter profile, a company logo, and two people on a video call. She had not yet verified the recruiter through the employer, the vacancy through the official careers page, or the domain through an independent source.
[00:04:34] Speaker B: So the evidence board has two columns, looked official, and was independently confirmed. The unsettling part is not only the technology, it's that every step feels familiar.
[00:04:46] Speaker A: Right? The criminals are copying the rituals of legitimate hiring. First they build a believable recruiter. They clone the name, photograph, bio, work history and network of a real person. They copy a real job description, including the qualifications and salary range. Because accurate details make a fake approach easier to trust.
They may add posts, comments and connections so the account looks lived in rather than newly manufactured.
[00:05:12] Speaker B: A profile is a display case. It can show you things, but it can't prove who's standing behind it.
[00:05:18] Speaker A: That distinction matters. A familiar photograph and a respectable work history may have been stolen from somebody who has no idea the scam is happening. Next comes the company infrastructure. A scammer can register a lookalike domain that differs from the real one by a letter, punctuation mark, and added word or a different ending. Then they copy logos, email signatures offer letters, onboarding pages, calendar invitations, and the language from a genuine careers page.
[00:05:49] Speaker B: Which means it had the logo is no longer a meaningful test.
[00:05:53] Speaker A: Not by itself, branding can be copied in minutes. The question is whether the communication connects back to a channel you found independently, not the phone number, link or email address the recruiter supplied.
When investigators look at a spoofed company, we do not begin with the logo. We begin with the seams when the domain was registered, where replies are routed, whether the phone number appears in unrelated complaints, whether the same wording shows up in other fake offers, and where the payment instructions lead. Fraudsters may change names and photographs, but they often reuse infrastructure because rebuilding everything costs time. The interview may use face replacement, synthetic video, cloned audio, or pre recorded answers. The operator keeps the questions predictable and the responses controlled. If the image stutters or the audio slips, they blame bandwidth, lighting or the platform.
[00:06:49] Speaker B: Because none of us has ever been on a video call, that worked perfectly.
[00:06:53] Speaker A: Great point. The scam hides inside problems we already accept as normal. And if several apparent employees appear, a recruiter, a manager, an HR specialist that creates social proof, each fake person seems to validate the others. During an interview, I would pay attention to control.
Who chose the platform? Who controls the pace? Can the interviewer handle an unscripted question, or do they steer everything back to prepared answers? A pause is not proof of a deepfake, but repeated avoidance can tell you the conversation is being managed rather than conducted.
Then the pace changes. The offer arrives before the target has time to verify it. Requests for sensitive information are framed as ordinary payroll tax, work authorization, or background check procedures. The start date is close. The budget supposedly closes today. Another candidate is waiting.
[00:07:49] Speaker B: Urgent is where common sense gets held hostage.
[00:07:52] Speaker A: And urgency is especially effective when the victim is relieved, excited, or under financial pressure. That's not gullibility. It's a normal human response to an opportunity that appears to solve an immediate problem.
[00:08:06] Speaker B: So the visual performance gets the victim through the front door. What are the criminals actually after?
[00:08:12] Speaker A: Usually one of two things, and often an identity package they can reuse and a payment they can take immediately. The first trap is identity theft. A resume already contains a useful map. Full name, location, phone number, email address, employment history and education.
The fake onboarding process fills in the missing date of birth, Social Security number, passport or license image, signature, tax form, and bank details. Together, those items can support attempts to open accounts, redirect benefits or tax refunds, impersonate the victim, or pass other identity checks.
[00:08:51] Speaker B: And because the paperwork looks like paperwork people expect after being hired, the request can feel less suspicious than a stranger simply asking for a Social Security number.
[00:09:01] Speaker A: That's the camouflage. The form may be real. The recipient is not in 2021. The FBI's El Paso field office publicly described a pattern that's remarkably close to our composite. Criminals created domains that resembled legitimate websites, posted fake openings on popular job boards, conducted false interviews through teleconference applications, and impersonated recruiters, human resources staff, and department managers. Then they requested the same information a real employer might request, which is what
[00:09:34] Speaker B: makes the paperwork dangerous. It arrives in the right costume.
[00:09:38] Speaker A: The FBI warned that stolen information could be used to take over accounts, open financial accounts, or support other identity fraud, including the creation of fraudulent identification documents.
Its red flags included jobs posted on a job board but missing from the company's own site, interviews conducted through questionable channels, non company email domains, demands to buy startup equipment, upfront background screening fees, and requests for credit card information.
[00:10:06] Speaker B: That list is useful because none of the clues depends on detecting artificial intelligence.
[00:10:12] Speaker A: Right? Deepfake technology can strengthen the illusion, but the underlying defenses remain wonderfully unglamorous. Compare the domain, find the vacancy yourself, call the real company, and do not pay the employer.
[00:10:25] Speaker B: That's four steps. Your checklist is already showing signs of rehabilitation.
[00:10:29] Speaker A: Of four of the 28, we are making extraordinary progress. The FTC documented another branch of the employment scam economy in 2024. So called task scams. The approach often began with an unexpected text or WhatsApp message offering online work.
Victims were told to perform simple activities labeled product boosting or app optimization.
A fake dashboard showed commissions accumulating. Some people even received a small payout
[00:10:57] Speaker B: at first, a little real money used to validate a much larger fake balance.
[00:11:02] Speaker A: That's the hook. Eventually, the platform demanded a deposit, often in cryptocurrency, to unlock more work or withdraw supposed earnings. The money shown on the screen was fictional. The victim's deposit was real. The FTC estimated that task scams accounted for nearly 40% of job scam reports in the first half of 2024. Reported cryptocurrency losses connected to job scams reached about $41 million in that six month period, nearly twice the amount reported for all of 2023.
[00:11:33] Speaker B: Different script from the fake recruiter. Same reversal. You came to earn money and suddenly you're paying money.
[00:11:40] Speaker A: That map just doesn't compute, does it? That reversal is one of the cleanest red flags in this entire category. Employees do not fund the employer's payroll. Applicants do not pay to release wages they supposedly earned. One FBI alert gives the human skill version. Beginning in 2019, victims reported going through false interviews, signing employment contracts, and handing over driver's license images. Social Security numbers Direct deposit details, and sometimes money for background checks or equipment. The average reported loss was nearly $3,000 per victim. And some victims also suffered damage to their credit. Then the employer disappeared.
[00:12:21] Speaker B: So the crime scene was not a dark alley. It was an inbox, a teleconference window, and a stack of onboarding forms.
[00:12:28] Speaker A: Yep, and the sequence matters. The impersonators borrow the authority of a real company, stage the interview, and then convert the victim's relief into signed forms, identity documents, and a payment. That looks like the last routine step before starting work. There's another side of fake hiring that shows how sophisticated the supporting infrastructure can become. In July 2025, the Justice Department announced the sentencing of an Arizona woman who helped overseas information technology workers pose as US Citizens and residents. They obtained remote jobs at more than 300American companies.
According to the department, the scheme used 68 stolen identities, generated more than $17 million in illicit revenue, and resulted in a sentence of 102 months in prison.
[00:13:15] Speaker B: In that case, the company was the victim and the applicant was the impersonator.
[00:13:19] Speaker A: Correct. It's not the same victim pathway as Maya's story, and we should not blur the two. But it demonstrates the industrial scale of remote work impersonation.
The operation included a so called laptop farm. Company issued computers were kept in the United States while workers accessed them remotely, helping create the appearance that the employees were located where they claimed to be.
[00:13:41] Speaker B: So a real laptop, a real payroll record, and a real employee account can all sit inside a false Identity?
[00:13:49] Speaker A: Yes. In June 2025, the Justice Department announced coordinated actions across 16 states.
Authorities searched 29 known or suspected laptop farms and seized about 200 computers, 29 financial accounts, and 21 fraudulent websites. The alleged schemes used stolen or fake identities, proxy computers, fabricated websites, and helpers in multiple countries.
In one alleged case, workers gained employment at a blockchain company and stole virtual currency valued at more than $900,000.
There is another investigative principle. Follow the requested action, not the story wrapped around it. A recruiter may describe onboarding equipment, security, payroll, timing, or company policy.
Drip away the explanation and ask, what are they directing me to do? Send identity documents, deposit a check, move money, buy gift cards, use cryptocurrency.
[00:14:49] Speaker B: The story can wear suit. The request is still the request.
[00:14:52] Speaker A: That's right. Scammers want us debating the explanation instead of examining the transaction. The second trap is immediate money. The victim is told to buy an equipment setup kit, pay a background check, fee, purchase software, or send money to an approved vendor. Sometimes a scammer sends a check and instructs the victim to use part of it for equipment. The bank may show the deposit as available before the check is finally judged counterfeit. The victim spends real money, the check is reversed and the loss stays with the victim.
[00:15:25] Speaker B: The account balance can look comforting before the check has actually cleared.
[00:15:29] Speaker A: The banking system correct available is not the same as finally paid. Other versions demand gift cards, a wire transfer, a payment app or cryptocurrency. The story changes the direction of the money does not if the employer sends you money and tells you to forward some of it or tells you to pay before you can work, stop.
[00:15:50] Speaker B: A paycheck should travel toward the employee. If the money's moving the other way before day one, the the job deserves
[00:15:56] Speaker A: a much closer look from an investigator's chair. Payment method tells you something about the criminal's priorities. A fake check creates a delay that hides the loss. Gift cards move value quickly. Cryptocurrency can cross borders without the familiar protections people expect from cards. The more the payment is difficult to reverse, the more suspicious the instruction should become.
[00:16:19] Speaker B: And our accounting department only accepts gift cards. Is not quirky company culture?
[00:16:24] Speaker A: No, that is not a benefits package. That is a confession with a barcode.
[00:16:28] Speaker B: Who is most exposed here?
[00:16:30] Speaker A: Anyone looking for work can be targeted, but scammers benefit from certain conditions. Remote roles, rapid hiring, freelance or contract work, applicants changing careers and people who have been unemployed long enough that a quick offer feels like oxygen. Entry level applicants may not know what a normal hiring process looks like. Senior professionals can be targeted with a highly tailored approach built from a detailed public profile. Listen for for speed and secrecy. We need the form today. Payroll closes in an hour. Do not contact the main office because this is a confidential hiring process. Do not discuss the offer yet. That last one matters.
[00:17:11] Speaker B: If somebody says don't tell your spouse, that is usually the best reason to tell your spouse immediately.
[00:17:16] Speaker A: Or friends, former colleague, career counselor, anyone who is not emotionally inside the offer.
A second set of eyes changes the pace. And pace is what many scams depend on.
[00:17:27] Speaker B: Let's give listeners a practical checklist, not a 27 step fraud seminar with exhibits and a lunch recess.
[00:17:34] Speaker A: I had 32 steps, two appendices and a very reasonable lunch recess. But fine, we'll start with four. Go to the company's website by typing the address yourself. Find the careers page. Search for the exact role location and requisition number. If you cannot find it, call the company's published main number and ask for human resources or recruiting.
[00:17:58] Speaker B: Do not use the number in the recruiter's email signature.
[00:18:01] Speaker A: Correct that only routes you back into the story. Use a number or contact form you found independently.
Next, inspect the email domain character by character. A display name proves nothing. Watch for extra words, swapped letters, unfamiliar endings and addresses from free email services when the employer normally uses a corporate
[00:18:24] Speaker B: domain and verify the person separately.
[00:18:28] Speaker A: Search the recruiter's name and company, but do not stop at the profile that contacted you. Compare work history, connections, activity and contact information.
If possible, call the company and ask to be connected to that employee. A legitimate recruiter may be briefly surprised by the caution a legitimate recruiter should not punish you for it. Here's a field tested way to think about verification. Never let one channel authenticate itself. If the offer arrives by email, verify it by calling a number you found independently. If LinkedIn supplies the recruiter's identity, confirm that person through the company. If the interviewer sends the onboarding link, confirm the portal through the employer's published process. Predov video image as one signal, not proof of identity.
Watch for audio and mouth movement that repeatedly drift apart, unnatural edges around the face, lighting that changes oddly, or answers that avoid spontaneous detail. But remember ordinary video calls glitch too. Do not accuse someone based on a frozen frame. Verify through another channel.
[00:19:36] Speaker B: What is a good verification question?
[00:19:38] Speaker A: Ask where the role appears on the official career site and request a requisition number.
Ask the recruiter to send the next step from the company's established domain. Ask whether you may call the published switchboard and be transferred back. You can also ask specific, reasonable questions about the team reporting structure and hiring timeline. A fraudster may answer smoothly, but independent confirmation is the real test. Do not provide a Social Security number, copy of id, tax form, or bank details merely because an interview occurred. Confirm that a genuine offer exists and that the onboarding portal belongs to the employer or its known provider. Bewaring a form sent as ordinary attachments or upload links to unfamiliar domain and
[00:20:24] Speaker B: no legitimate opportunity becomes more legitimate because you paid for it.
[00:20:29] Speaker A: Sounds like scammer logic, doesn't it? The bottom line is do not pay for equipment, software, training, background checks or account activation at the direction of an unverified recruiter. Do not deposit a check and then send funds to a vendor. Do not buy gift cards and do not feed cash into a crypto kiosk because payroll says it's the fastest way to secure your workstation. That instruction follows the same pattern as fake bank alerts telling you to move your money to protect it. The language sounds protective, but the action sends your money toward the criminal.
[00:21:03] Speaker B: If payroll sends you to a machine beside a convenience store ice freezer. Payroll has taken a very strange turn.
[00:21:11] Speaker A: Yes, Human resources should not require directions from the snack aisle.
[00:21:16] Speaker B: Give us the short version.
[00:21:17] Speaker A: Pause, leave the message thread, type the company address yourself, find the job independently, call a published number, verify the recruiter, confirm the portal, refuse any request to pay, and if someone is rushing you, slow down deliberately.
[00:21:34] Speaker B: If the offer expires in 10 minutes, take 11.
[00:21:38] Speaker A: A job scam lands differently from an ordinary purchase scam. The victim may have told family members, declined another interview, arranged childcare, or begun planning around a salary.
When the fraud is discovered, the loss is not only financial, it is humiliation, anxiety, interrupted employment, and the fear that personal information may surface again months later.
[00:22:03] Speaker B: Which is why the first response from family should not be, how did you fall for that?
[00:22:08] Speaker A: Right, Start with you were targeted. Let's contain it. Shame. Delays Reporting and delay helps the criminal A bank or payment service may be able to stop, recall, flag or investigate a transaction, depending on the payment method and timing. There is no guarantee. The faster the victim reports, the better the chance of intervention. A gift card payment, cryptocurrency transfer, cash deposit at a kiosk or completed wire can be especially difficult to recover.
[00:22:40] Speaker B: So call immediately is not drama. It is a practical advantage reporting matters
[00:22:46] Speaker A: even when a case crosses jurisdictions or the amount seems small.
Reports help establish patterns, link victims, identify accounts and infrastructure, and support broader investigations.
But victims should understand that reporting does not guarantee immediate recovery or an arrest.
When I worked fraud cases during my 25 years as a Federal Special Agent, the evidence trail mattered. Dates, exact addresses, phone numbers, usernames, payment details, receipts, headers, documents and sequence of contact.
Preserve first, report second.
Do not keep engaging the scammer to conduct your own investigation.
[00:23:29] Speaker B: Now, the urgent part. What should a listener do if they have already sent information or money?
[00:23:35] Speaker A: Stop communicating. Do not send more money to unlock a refund, complete onboarding or cancel the transaction.
Next, preserve the evidence. Take screenshots and save emails in their original form. If possible, keep the job posting profile, link, meeting invitation, chat history, phone numbers, domain names, uploaded forms, payment instructions, receipts, and every name the scammers used.
Then write a timeline while the details are fresh. If money moved, contact the bank, card issuer, payment app, gift card issuer, wire service or cryptocurrency platform. Immediately ask for the fraud department.
Explain that the transaction resulted from impersonation and the fraudulent job offer. Request a stop, recall dispute, freeze or fraud review as appropriate. If a check was deposited, tell the bank you now believe it's counterfeit and do not spend the funds and use
[00:24:36] Speaker B: a phone number from the back of your card, a statement or the institution's official website, not a number provided by the fake recruiter.
[00:24:43] Speaker A: If a Social Security number, date of birth, license, passport, tax form or bank details were exposed, start by freezing your credit with each major credit bureau. Then review your credit reports for unfamiliar accounts or inquiries and consider adding a fraud alert.
Change the password on the email account you used in the application along with any other account where you reused that password.
Finally, turn on multi factor authentication beginning with email and financial accounts.
[00:25:15] Speaker B: Email comes first because it's often the reset key for everything else correct.
[00:25:20] Speaker A: If bank account details were shared, ask the bank whether the account should be monitored, restricted or replaced. If a driver's license or passport image was exposed, contact the issuing authority for current guidance. If tax information was exposed, follow the relevant identity theft reporting process and watch for signs of a fraudulent return.
Report the incident to the platform where the contact began, the real employer being impersonated, and the appropriate government reporting channel.
If money was stolen or identity documents were used, contact local law enforcement as well. Provide copies, not your only originals, and keep report numbers together.
After a loss, victims may be contacted by someone claiming to be an investigator, recovery company, attorney, government official or platform representative.
They promise to recover the money for an advance fee or ask for remote access to to a device that can be another fraud using information from the first.
[00:26:23] Speaker B: The name changes from recruiter to rescuer, but the request is still money or access, right?
[00:26:29] Speaker A: So verify every follow up independently, especially anyone who guarantees recovery. Reporting quickly also reduces the chance that stress will make you omit a key detail in a complaint to the FBI's Internet Crime Complaint Center. IC3 include transaction information, wallet addresses if cryptocurrency was involved, bank or payment account details, phone numbers, email addresses, websites and a clear timeline. IC3 is the FBI's central reporting hub for cyber enabled crime. Although filing a complaint does not guarantee an individual response, one final point for victims, this scam hijacks hope.
Afterward, every recruiter may look suspicious and every interview may feel contaminated. Use a verification routine, not permanent distrust. Ask the same independent questions every time. A routine gives you a way back into the market while protecting the information and money the criminals wanted.
[00:27:31] Speaker B: We will put links to the ftc, FBI, Justice Department and other sources mentioned in this episode. Episode in the show notes.
[00:27:38] Speaker A: That way listeners can review the original alerts, verify the reporting guidance and find the official channels without relying on a link sent by a stranger.
[00:27:47] Speaker B: The technology makes this scam feel new, but the pressure points are trust, urgency, authority, and the hope that a problem has finally been solved.
[00:27:57] Speaker A: That is the key takeaway. You do not have to prove that a face is synthetic. You only have to refuse to let the face serve as the proof.
Find the job on the employer's real site. Confirm the recruiter through a channel you located yourself. Protect sensitive data until the offer and onboarding system check out.
Never pay to receive wages and bring
[00:28:19] Speaker B: somebody else into the conversation before urgency makes the decision for you.
[00:28:23] Speaker A: The goal is not to make people paranoid, it is to make them prepared. Thanks for listening to behind the Scams, part of the SOS Media Network.
SOS is a non profit scam prevention organization. Donations are tax deductible and unlike a scammer's promise, that part is real. Bye for now.
