Select Page

We would love to hear your feedback

THE DAILY SCAM NEWSLETTER  |  MAY 22, 2024

Co-Founder/Content: Doug Fodeman  |  Co-Founder/Creative: David Deutsch  |  V04N15

Most Clever Scam We’ve Ever Seen!

It was just two weeks ago that our Top Story celebrated scammer stupidity as we reported the dumbest, most absurd scammer efforts we’ve seen in a long time. Sadly, last week we were presented with something that was quite the opposite. It turned out to be a job offer, accompanied by the most realistic and well-done fake business website that we’ve seen in a long time. However, we believe this business website, and job offer, are absolutely a scam! Not only that, but we strongly suspect that this is a scam that we’ve published many articles about since 2018! In the last six years, we’ve uncovered 93 other fake business websites used to support this scam. We’ve also traced breadcrumbs related to this fraud to Russian-speaking cybercriminals being most likely responsible for it. We really want your opinion on this website and job offer! We’ve found only a little evidence of fraud or reasons to be suspicious, but want your opinion too! Please let us know if you agree with us….Is RTFulfillmentUSA.com a fraud?

Essentially, these scammers contact American and Canadian job-seekers and offer them a work-from-home job described as a “package reshipper,” “package inspector,” “quality control inspector,” and other similar descriptors. New hires are told that they will be well paid but won’t receive their first pay check until their “probationary period” ends, usually one month after their employment begins. Of course, the overwhelming majority of people don’t get paid and are simply ghosted after the month ends! We’ve talked to a bunch of victims of this fraud. This scheme turns them into mules moving stolen merchandise, or merchandise purchased with stolen credit cards. This scam, along with a long list of fake websites, are described in our article titled Package Shipping Scams. (However, the details about this scam, why it is a fraud AND why we believe Russian-speaking scammers are behind it, can be found in our article titled Package Reshipping Scams Are Like Whac-a-mole!)  

To their credit, the Russian-speaking cybercriminals behind this fraud are some of the most clever scammers we’ve ever investigated. And we’re certain they have read all of our articles exposing their scams and learned from the mistakes we’ve pointed out! Their scams are now much harder to reveal. However, it is our opinion that this latest shipping company website, and supporting services are part of this scam! Here’s what we know….

A person contacted us recently about a job offer he received that sounded too good to be true. The job was a work-from-home job as a “shipping agent” and it came from the email address hr@rtfulfillmentusa.com. The email included this information….

We have completed the initial pre-screening and we are ready to give you a chance to start a career of a Shipping Agent. This offer comes with a one-month probationary period which will include on-the-job training. This will allow us to judge whether you are capable of performing your work duties remotely. You will have a supervisor to evaluate your job performance. After the one-month probationary period, you will receive a written notice regarding the outcome of your training. During this period, you will be paid $25 for every package you process and dispatch using prepaid shipping labels. These payments are typically made twice per month but can become more frequent if you request. If you can demonstrate high job performance and proper motivation over the next month, you will become a senior shipping agent with a salary of $3,500 per month.

Let’s start with a few reasons why we think this scam is so well crafted….

These scammers have learned that the age of a domain is critically important to exposing online fraud. That’s why they registered their domain, rtfulfillmentusa.com, back in December, 2022 (17 months ago) through a proxy service in China. (Some of their former scam domains were registered in Ukraine, Russia and other countries in/around Russia.) Also, to make their fake business appear legitimate, in December, 2023 these scammers used EIN Presswire to publish at least two press releases about their bogus business on these real news websites: KTXL Fox40 Local News (located in California) and WFLA News Channel 8 (located in Florida).  Keep in mind that anyone can pay EINPresswire.com to publish a press release on their behalf. Also, each of the two press releases we found include a statement like this This content is not written by or endorsed by “WFLA”, its advertisers, or Nexstar Media Inc.” This means that these press releases are meaningless when it comes to the authenticity of the claims in them! We think it is also interesting to note that their domain, rtfulfillmentusa.com, was registered a year before they purchased these two press releases.

It’s also important to note that the written English used on the RTFulfillmentUSA.com website was flawless! We couldn’t find any grammar, spelling, capitalization or other errors that routinely make us suspect that a website is a fraud. Also, if you read our past articles about these scams, you’ll see that these scammers have learned how to avoid many of the stupid things that scammers put on their fake websites that are easy to identify as fraud. For example, they don’t identify their “Team” (owners and key employees), they don’t say they’ve been in business for 10 years though their domain is less than a year old. Finally, they don’t say they have tens of thousands of happy clients, like they did in the past, and yet NO ONE has posted a review of their services anywhere across the Internet! 

A search for this business, RT Fulfillment, on LinkedIn turns up a few employees, such as Annie Sifontes, Assistant Manager of RT Fulfillment. However, Annie’s profile has no images, no posts and 1 follower as of 5/17/2024. We also found “RT Fulfillment” associated frequently with two other names on LinkedIn. The first was a man named David who had 356 followers on 5/17/2024. Though his profile included “RT Fulfillment” there was no information about his role at this company and no dates associated with his employment.  We also found a few other names on LinkedIn that supposedly had connections to RT Fulfillment but when we visited their profiles, RT Fulfillment was not found on their profiles at all. Hmmmmm….. 

Despite their very clever business website at RTFulfillmentUSA.com, here are a few red flags why we still believe their business is a fraud…

  1. RT Fulfillment says that their office is located at 3071 NW 107 Ave, Doral, FL 33172. And yet, a search for this address shows a few businesses in a small office building but NONE of them are RT Fulfillment, or any shipping business.

2. There are two reviews posted by supposed clients of RT Fulfillment and they are both a fraud. Our Google search skills are excellent and yet we cannot find anyone by the name of “Jacob Nowak” associated with HomeCarePL, or “Luca Moretti” associated with “GoldenToys.” (This is the case even if we put include spaces to separate “Home Care PL” and “Golden Toys.”  These businesses and names do not exist. Moreover, when we conducted a reverse image search for the photos used for these two men, we turned up lots of names associated with each of these photos across the Internet. Yet NONE of the many names associated with these 2 photos are the names listed on the RTFulfillmentUSA.com website.

3. Near the bottom of the RTFulfillmentUSA.com website, we’re told that “our service was reviewed in the media” and they list six well known news services.  And yet, none of these six media names were linked back to the article this business claims to have been reviewed in. We then used the “site” command in Google to ask Google to search each of these news websites for the business name “RT Fulfillment.”  Guess what we found?  Nothing! Nada! Zip! Not a single article about this business.

4. Though the domain RTFulfillmentUSA.com was registered in December, 2022 – about a year before they started using it – these scammers behind this fraud said on their website that they’ve been in business for decades!  Really? And what business website did they use prior to December, 2022?

5. On their About Us webpage, the COO of RT Fulfillment is listed as “Maria Novak.” Maria Novak is quoted as saying “In order to survive in the competitive and ever-changing eCommerce space, retailers must think outside the box for ways to cut costs while still maintaining customer excellence. Using third-party logistics and fulfillment is a great way for smaller vendors to compete with mega-markets like Amazon, without sacrificing the values that helped them get started.”  When we searched for this exact quote on Google, we found another Shipping company called “AllPowerLogistics.com.” The Co-Founder of allpowerlogistics.com is listed as Melanie Truesdell. Melanie Truesdell gave the exact same quote as Maria Novak from rtfulfillmentusa.comWhat are the odds of that happening?

6. Finally, and perhaps most important, is their job offer.  The MO (method of operation) described in the email from hr@RTFulfillmentUSA.com is IDENTICAL to the scams that were reported to us by many victims of this shipping scam! Ask yourself…Does it seem reasonable to you that some company is going to pay you $25 to receive a box of merchandise (e.g. jewelry, smartphone, gold bar, etc.), open the outer shipping box, and then look for damage to the inner box. Then, once “inspected” you are instructed to remove ALL LABELS from the outer box, print a new shipping label from the private online account given to you, and then attach the new label and re-ship the box to the next destination! Does that sound right? Hell, no!  EVERY SINGLE warehouse, shipping company, manufacturer, etc. monitors their own package shipping at the source! They monitor and inspect their own outgoing packages. Yes, sometimes issues are overlooked or damage happens in transit, but that will also be true if YOU open and reship a package using the next carrier, as instructed.  This job is a fraud to get YOU to move stolen merchandise! And most victim statements have taught us that you will NOT be paid when your “probationary period” is over!

These Russian-speaking scammers are very clever.  Over the years we’ve noticed several things about the way they operate this scam, including hiring people in Asian countries to act as Managers/Supervisors to the American and Canadian citizens they scam! Yes, people have reported to us that they have actually talked to their “managers” and “supervisors” over the phone. (No video chats yet.) Another trick they use is to task different parts of their scam to different websites.  For example, after RT Fulfillment hires a new “shipping agent,” the person is given an account to log into on the website parcel-panel.com. This is the site that employees will find their new employment documents to be signed and begin their work as “shipping agents.” What is interesting about this account-serving website is that there is a REAL website and service called ParcelPanel.com that offers management services for tracking E-commerce shipments and returns. The real company domain was registered way back in November, 2018. But this mimic, parcel-panel.com, was registered in October, 2023, just a few weeks before those press releases came out for RT Fulfillment.

We hope you agree with us that rtfulfillmentusa.com, parcel-panel.com, and even allpowerlogistics.com are scammer’s websites used to support their fraud! Looks like we’ll be adding 3 more websites to our list of 93 others.  By the way, these Russian-speaking scammers LOVE to include animated videos on their websites, either for the public to view or posted for employee training.  (We’ve watched more than a dozen of them and they all have the same kind of animated presentation and American-sounding AI voice to them.)  You know, now that we think about it, maybe these scammers aren’t so clever afterall.

FOOTNOTE: Our investigation into RT Fulfillment also led us to this PR Release in 2022 about a company called NetworkShip LLC, and using the website networkshipusa.com. This information then led us to a woman’s post about this fraud on the Better Business Bureau website. She was “hired” by NetworkShip LLC and clearly explains how she was victimized by this fraud back in 2023.

Why We Do This Work and Phone Call About Fraudulent Charges

Last week we published an article about a certain type of job scam targeting people in the Modeling/Fashion industry.  Coincidentally, we also heard from someone new who contacted us after finding one of our articles online. Our article about job scams saved this young man of college age from being a victim of this scam. He sent us the nicest email to thank us!  It’s emails like this that help motivate us to do this work, week after week, for more than 13 years now and without financial compensation.  The young man said…

Good morning! Or at least, it’s better now, thanks to you!

I was approached by what I thought was a legitimate job offer for a position I had actually applied for in regards to a part-time job over the summer. Because I was too excited with the prospect of getting a summer part-time job that was entirely virtual, I completely missed the red flags until I was halfway through “training”.

I was approached on WhatsApp under the company name of Brand Vision by two different phone numbers, offering me wild promises of how much money I could make. Little ashamed to admit that college-aged me saw the dollar amount and just ignored every other red flag until the training, but at least I recognized it!

Anyway, just wanted to reach out and say THANK YOU, because if it wasn’t for this article [https://www.thedailyscam.com/job-interviews-in-google-hangouts/], I might not have realised that I was even talking to a scammer. So, again, truly, thank you. You saved my life and my personal details.

Warm regards

Recently, our friend Rob shared a phone call with us that he recorded between himself and his “credit card company,” as well as an agent from Western Union. They called him in late April to ask about fraudulent charges made against his credit card. This included a conversation with an agent from Western Union, who said that one of the fraudulent charges was for the transfer of $5000 in cash to a woman named Claire in the UK. Claire claimed to be Rob’s daughter! Of course, Rob told these lovely agents that he neither made the Amazon purchase of a few hundred dollars, nor did he send $5000 to anyone via Western Union! He doesn’t have a daughter named Claire!  We’ve removed Rob’s personal information from this call including the name of his bank.  We also removed lots of waiting time to bring this 25-minute call down to about 12 minutes. The lovely agents Rob spoke to are Jenny Davis and a woman identified as Gloria. Both of these women have subtle Indian accents, in our humble opinion.

Their scam is very clever but not clever enough for Rob!  He throws them a curveball at the end that they simply don’t know how to respond to!  So what do they do? They just hang up!  Go Rob!!!  Would you have fallen for it? If someone calls you claiming to be from your credit card company and wishes to ask you about fraudulent charges to your card, wouldn’t you likely listen and then respond?  

By the way, in the last few weeks our research has turned up more than a hundred fake online banks created by the same cybercriminal gang most likely located in Nigeria to support their 419 (advance fee) scams.  Our article about fake banks and investment services now has more than 570 bogus banks (and domain names) listed on it!

In the last week a number of interesting articles were forwarded to us or that we found.  Perhaps, most importantly, check out the article about the cybercriminal group based in Africa and called the “Yahoo Boys.” Their sextortion tricks primarily target young men and boys (of high school and junior high age.)  This scam is so terribly frightening for some victims that at least 30 boys have committed suicide as a result!  If you have a young man/boy in your family, please educate them about this fraud!

https://www.wired.com/story/yahoo-boys-scammers-facebook-telegram-tiktok-youtube/

Experts agree, if you are a victim of this fraud, your life is “not over” but you need to be brave enough to tell an adult you trust! And….

  1. DO NOT PAY THE SCAMMER!
  2. Do not delete your account through which you were targeted! (It contains evidence that may be able to help authorities to trace the scammers.)
  3. Contact Law Enforcement, such as the FBI.  Also, the National Center for Missing and Exploited Children runs an anonymous tip line to report incidents both online (report.cybertip.org) and via telephone (800-843-5678). To reach the center via email use: gethelp@necmec.org.

Other recent articles of interest….

https://www.theguardian.com/money/article/2024/may/08/chinese-network-behind-one-of-worlds-largest-online-scams

https://www.nbcphiladelphia.com/investigators/consumer/i-just-want-to-be-friends-with-you-tracy-davidson-exposes-romance-scam-that-targeted-her/3848201/

https://www.bleepingcomputer.com/news/security/massive-webshop-fraud-ring-steals-credit-cards-from-850-000-people/

https://consumer.ftc.gov/consumer-alerts/2024/05/spot-ad-social-low-low-price-brand-name-product-think-twice

Remember to check out our podcast series that comes out on the 15th of each month!  Visit https://www.securewon.com/resources/podcasts/

Spear-Phishing Examples, Voicemail Phish, and A Beautiful Phish

We often hear from the CFO of a school about the efforts scammers take to trick her and her staff into modifying employee banking information to send salary payments to the scammers instead!  Here are two recent examples.  What’s so funny about this effort is that her school has a very specific policy (as they should have) about changing employee payment information.  The employee must come into the office in person, fill out a form for their requested change, sign it and hand it to the business office staff!

Check out this rotten phish pretending to be from Buckeye Broadband.  The real Buckeye Broadband is a cable TV and telecommunications company in Ohio.  This email came from a weird account name at buckeye-express.com but it is not any official representative or bot of the company.  The link to listen to your voicemail points to a phishing web page created on the free website builder business at Wix.com! Deeeeleeeeete!

There are sooooo many red flags in this last phish, we don’t know where to begin. It was sent to one of our long-time readers in New Zealand. (Yes, folks in New Zealand get targeted too!) However, the funniest thing about this phish is the fact that NO REAL BUSINESS would ever say what these scammers said in this email!  ***ROLLING EYES**** Seriously?   Report your smelly phish to us and Google!

https://safebrowsing.google.com/safebrowsing/report_phish/

Free Donald Trump T-Shirts and Discounted AARP Membership

We cannot raise alarms any louder than we have concerning online fraud pretending to be connected to the upcoming political season in the United States.  Here is a perfect example that dropped into one of our honeypot email accounts. The email offers free T-shirts in support of Donald Trump’s run for relection in 2024. However, if you look closely, this fraud came from a domain called plaidedwhirlbat[.]com via another domain called menclose[.]com. Seriously? Does that make any sense? The former domain was registered in March, 2023 and is hosted on a server in the Netherlands, while the latter was registered in August, 2023 and is hosted on a server in Vietnman. The link in this clickbait will send you to a server in Bulgaria. This sounds to us like an international cybercriminal group is trying to target supporters of Donald Trump.  We’re sure that Biden supporters will be next!

Here’s another reminder that Americans of a certain age are heavily targeted by cybercriminals! This email looks like it is from AARP and offers a big discount on renewing your membership. But look closely at the sender’s domain!  This email came from “suddenquack[.]com!”  You gotta love their creativity!  Links in this clickbait point to ridiculous-sounding website which then forwards you on to another malicious website.  Need we say more? Lunge for the delete key!

When Scammers Turn to Translation Tools to Scam You

It’s important to remember that most cybercriminals are from non-English speaking countries around the world. To help them with their fraud, they sometimes need to rely on translation tools.  Here’s a perfect example that targeted David! He was randomly targeted by a job scam from the phone number 365-747-6245. In their 3rd text, the scammers forgot to remove the fact that their text pointed out that it was created by a translation tool at DeepL!  David was laughing so hard he never bothered to respond after that!

Until next week, surf safely!

Copyright © 2024 The Daily Scam. All rights reserved.
You are receiving this email because you have subscribed to thedailyscam.com

Marblehead, MA 01945

Contact Webmaster