Job Scam Targets the Wrong Man!

In September and again in October, we shared two heartbreaking stories with our readers about two women who collectively lost more than $11,000 through a job scam likely orchestrated by the same cybercriminal gang operating out of Thailand and Cambodia. (Given the crazy, sophisticated and identical nature of their scams, we are confident that this was the same cybercriminal gang responsible for their fraud.) For many months in 2024, we have shown readers lots of examples of text conversations, coming from scammers disguised as job recruitment agencies. Though representing different agencies about different jobs, they used the same “Tell” and scams as they ask the recipient if they were interested to interview for an online job. On October 14, my partner David received one of these texts and jumped at the opportunity! With the valuable information that the two women already shared with us, we were very prepared to understand this fraud disguised as an online job! But more importantly, David was eager to play with the scammers, waste their time and collect more evidence about their fraud game. They had no idea who they were dealing with but rest assured, these scammers chose the wrong man to target! Read on….

David’s journey began when he received the following random text from “Cynthia” on October 14. She claimed to be from “Walgreens Staffing & Recruiting.” It’s important to point out the fact that these offers are always too good to be true. Cynthia says that David can earn $100-$300 for 30-60 minutes of work daily. Also, David is told that the job interview (and training) will happen via text using WhatsApp. This is always the case for this gang’s job fraud!

Not long after, David received a message from a woman named Amanda via WhatsApp. Below are several exerpts from their early conversation. A few important things to note….

1. Amanda claims to work for Ojas Innovative Technologies (A software company in India) but where is the proof of this? She’s not using a company owned email account or chat service. She’s certainly not using a company registered Zoom account!
2. The compensation that Amanda claims to offer for this job is different from what Cynthia stated. Also, Amanda’s numbers are also FAR too good to be true! No one is going to pay $100-$500 per day for 1-2 hours of work for this online job! Especially when you see what it actually entails.
3. The fact that Amanda says commissions are earned and go into a crypto wallet should make EVERYONE scream fraud! Why wouldn’t someone’s earnings go into their own bank account via electronic transfer?!
4. If you carefully read Amanda’s details about the job at the top of the right hand column, you should conclude that it’s complete BS! Especially when she says “we only need to upload real data 4G/5GWiFi to help the app complete the optimization task and earn commissions.” What the hell does that even mean?
5. Finally, in the lower right hand side of these communications, Amanda offers yet a third unbelievable compensation package for this job!

After a bit more conversation, David agrees to take the job offer and he and Amanda make arrangements to schedule his training session. Keep in mind that unlike real jobs, no contract was signed, no personal details were taken from David. He wasn’t asked to fill out a W-2 form or provide any personal information or identification, not even his address. Nothing! As they continue their conversation over the next day, Amanda tries to make casual conversation and win David’s trust. She tells David that she lives in New York and just dropped her daughter off at Preschool. In another conversation she asks David if he has any plans for the day, adding “I will exercise in the morning and design a drawing at home in the afternoon.”  Also noteworthy, every so often Amanda’s use of English is a bit awkward or uncommon. When they finally manage to schedule a mutual time for training, David asks if it will be via Zoom, Google Meet, phone, in person or WhatsApp.  Amanda replies with “On WhatsApp, I will train you in the way of text and pictures. This will keep it in our records for your future reference.”  David is also told that the training is “about 1-2 hours” and that he will receive “$50-$200 after the training is completed.”  Seriously? That’s quite a spread of what the payment might be! (Maybe it’s based on the number of emojis David sends her?)

David’s real-life schedule turned out to interfere with his scambaiting. Because he had to put off his training for a few days, he was passed from Amanda to another “handler” named Erin. In late October, David finally was able to schedule his training with Erin. Oddly, when she first greeted him, she told him that “Jerry had recommended him.” There was no one named Jerry in all of David’s communications the previous two weeks. Also, without any explanation or acknowledgement, the company that Erin worked for, and that David was interviewing for, had changed from Ojas Innovative Technologies to Link Graph! NOTE: The real Link Graph company offers search engine optimization services, digital marketing and more. This real company also uses the domain LinkGraph.com which was registered in California in November, 2005, 19 years ago. By contrast, Erin tells David that his employee work account will be through the website at LinkGraphAE[.]com. This domain was registered and set up on October 15, through a Registrar in Singapore. This is less than two weeks before David’s training session and is a huge red flag! This is NOT the real Link Graph company!

If you read the details in Erin’s texts above, you have once again seen promises of an incredibly high salary offered for this remote job! David is told that working for 5 consecutive days and completing 3 task sets daily will earn him a salary of $800. This is exactly what the two women were told in September and October when they reported their fake job to us. Also, we hope you noticed that Erin says “our daily work involves completing 3 sets of tasks, with each set containing 40 tasks.” This, too, was part of the job fraud that targeted the two women who reported to us. But look at the actual job that David was instructed to do. He recorded a portion of it at the end of October. If you watch the short video below, you’ll see that his “work” is a job that could easily be automated if it were real. In fact, any 8-year old third grader could complete these 40 tasks in just 3 minutes!

During David’s training sessions with Erin, he learned that he was to give high ratings/reviews for various Apps. As David described it “I’m not really doing anything! Within the LinkGraphAE.com account, I select an App and get a preset window that contains an automated review and star rating.  I then hit Submit. That’s it! I don’t even write the review. But I’m asked to do this for a set of 40 apps to complete 1 set of tasks. They want 3 sets of tasks per day. This makes no sense at all. I’m not even sure how they make money from this, or if it’s a circle of nothing.”

“A lot of these App symbols are large applications I recognized, including some VPN apps, and others. One was Doodle Jump, a gaming app (Wikipedia: Created in 2009 and valued at more than a million dollars) Why would a million-dollar company come to this group and say ‘can you help us get more users’ when the app is already doing so well?”

In their interface, David hits a button that says “Start Optimization” and then the first app review pops open and he clicks SUBMIT.  That’s it! Nothing else! And he has to complete a set of 40 of these per day at a minimum. Early on, David was told that his work was “optimizing the app” but later he was told that he was submitting reviews of the app. Of course, these two descriptions of his work did not align with each other, or with the actual work that David was doing. After he hits “Submit” another app would popup and then he clicks submit again, over and over. David described this “work” as ludicrous!

Between David’s training sessions with Erin and when he was invited to set up his own employee account, something strange happened. These scammers dropped the domain LinkGraphAE[.]com and set up their scam operation at the newly registered domain LinkGraphNE[.]com. It was registered the day that David completed his training with Erin, just before he set up his employee account! (It shouldn’t surprise readers that the real LinkGraph.com company has already posted about this fraud on their LinkedIn Account early in November. Apparently, there have been multiple domains registered and used in this job scam, including LinkGraphOfficial[.]com and LinkGraphting[.]com) Below is a screenshot taken inside David’s account at LinkGraphNE[.]com as he first set it up. He is immediately awarded $25 into his Wallet. NOTICE the descriptions of the VIP Member status at the bottom of the account window. The VIP Member status is where one of the prior victims says she lost many thousands of dollars because in order to become a VIP Member, you have to transfer lots of personal money into your Job Wallet!

It’s important to note that a critically important part of this job fraud is to create the illusion that you, the worker, have two financial accounts within your workspace. The Wallet account holds money that is payment for your services. HOWEVER, as David will soon learn, different reviews & services require a minimum threshold for you to have in your account. If you don’t have the minimum threshold needed for a certain set of more costly tasks, you will be asked to add some of your OWN MONEY into the Wallet. The other account is the Commissions account. Each time David submits a review, his Commissions account shows an increased dollar value. Initially, these accounts change by pennies per click. But, as we’ve learned from other victims, VIP Members will work with much more costly reviews that potentially earn much higher commissions. Erin started David off with $25 in his Wallet but later he was expected to transfer personal money from his own personal account into the Wallet account, using the Cash App. 

After setting up his account at LinkGraphNE[.]com, David quickly and easily completed his three sets of 40 tasks. Afterall, how hard is it to click and submit! So far, David hadn’t lost a penny and the promise of making lots of money for little or no effort was within reach. But that suddenly changed when David discovered that he needed to transfer nearly $41 from his personal account into his Wallet to raise the amount from $59.16 up to $100 to start his next set of 3 tasks. Keep in mind that David was not told that he could simply move some of his commission earnings into his Wallet account! Obviously, this wouldn’t serve the narrative that these scammers use in order to trick people into transferring real money into their accounts. He also had a commission of $34.15 at this point. This is exactly what the prior two victims of this fraud described to us. One of them was even able to move her early Commission earnings from her “work” account into her personal CashApp account as her first paycheck. Of course, her small earnings were nothing compared to what she lost to this fraud, but it gave her a false sense of confidence that this remote job was legitimate!

David, on the other, knew better. He was not going to move any personal money over to these scammers. He reached out to Erin on WhatsApp at the start of November.  She oddly replied with “Good morning, Darling” to David.

David told Erin he’s not comfortable putting in his own money. He also said that it is weird that she wanted him to open a crypto account. Erin replied saying that he only needed to add $41 at that time. (We know from prior victims that this requested $$ amount grows significantly in just a few days!) But David pushed back and said “why can’t you simply take out the $80 commission that is sitting in my commission account and move it over to my wallet?” (David’s commissions had increased after his first work day was completed.)  He continued to push back, saying “this is a job. I want to make money, not spend money!”  That ended their conversation that week and Erin disappeared for a few days. David thought his response had shut down her effort to scam him. But a couple of days later Erin reached out again and told David that she respected his choice.  This was followed later that morning with a warm greeting from Erin “Hello Darling, what are your plans for the day?” Understandably, David said this was a very weird message coming from someone who is supposed to be in a Human Resources role as his trainer. Keep in mind that David had first been contacted in early October and he had multiple conversations and training sessions with Erin after hearing about the job from Amanda. Every single one of these conversations was via text, using WhatsApp. NONE of these conversations were by phone or video chat. Like every single one of these job scams we have reported, the initial contact from a fake job recruiter is via a text to the victim’s phone. However, the next connection to the supposed Supervisor/Trainer at the new job is via texting through WhatsApp. Always!  This is a HUGE red flag revealing that your new job is a scam!

All together, David says that Erin invested about 4 hours of her time to train him and encourage him to move his personal money over to his work account Wallet. This was a lot of investment in one person! David didn’t budge and made it clear that he was not going to move his money into the work Wallet. On Monday, November 4, Erin sent a text to David saying “Hi David, today is the first working day of the week. Is your work busy?” But David had another idea. He wanted to see if he could actually arrange and record either a video chat or phone call conversation with Erin and get her off WhatsApp.  He reached out to her and said “Hi Erin, I have some concerns about moving forward. Can we video chat? I would love to talk to you more about this because I don’t want to miss this opportunity.”  Multiple times, Erin scheduled that phone call with David and each time she simply didn’t call. Each time, David would reach out via WhatsApp to ask what happened. After three false promises to call, Erin simply disappeared. The fact that David was not able to have a video chat or phone call with his supposed Supervisor/Trainer at his new job is another HUGE red flag that this job is a fraud!

FOOTNOTE: Coincidentally, as I started writing this story about David’s experience, I received a text from “Emilia at Goodwin Recruiting” using two different phone numbers.  It was the same job scam! I pushed hard to have a phone conversation with Emilia instead of a text conversation, but as you can see below, she refused. WHILE we were texting back and forth, I even called both of her phone numbers and got this exact same voice message….

If you have friends or family who have very recently started a new job, or are interested in additional part-time online work, please share this story with them!

Scambaiter Rob can be brutally relentless in his effort to go after scammers! And he keeps the email addresses of every scammer who ever contacts him and adds them to his “hit list.”  That means he emails them the same dumb questions FIVE TIMES A DAY!  FOR MONTHS! Obviously, his goal is to annoy the hell out of them and waste their time. Below are two examples of just some of the replies he gets every week. (Exluding the ones with expletives that we would rather not publish.) Based on these replies, we would say he is very successful!

Below are just a few of the many emails from a scammer over a 10 day period and who uses the name “Eric Valentine”…

Sun, Oct 6, 5:48 PM, Eric Valentine writes: I got it (your name, email) from Joe Biden the present of USA since you insist to know how I got your number and email address

On Wed, Oct 9, 4:43 PM, Eric Valentine writes: You are so stupid man for asking me such questions all the time. I’m going to block your email tomorrow morning [NOTE: But he obviously didn’t!]

Wed, Oct 9, 4:45 PM, Eric Valentine  writes: May thunder strike you over there for repeating the same question all the time [NOTE: What a lovely curse!]

Thu, Oct 10, 1:02 PM, Eric Valentine  writes: I’m going to block your email address Today [If only…]

Fri, Oct 11, 7:24 PM, Eric Valentine  writes: You are so stupid for making me to repeat myself everyday by day. Haven’t I told you the reason why I’m here and also explain whom I am to you but still yet you keep on asking a question all the time it is obvious that you can’t understand it simple English I live in continue and if you continue to ask me the same question again I’m going to block your email. I believe I have told you this yesterday several times but you won’t listen..

Fri, Oct 11, 7:25 PM, Eric Valentine  writes: I have explained myself here several times but still yet you won’t understand. Now the payment fee is 250 USD so kindly get back to me with your payment method

Sat, Oct 12, 1:06 AM, Eric Valentine  write: You’re so stupid and disgrace to human race [NOTE: Isn’t this the same as the “kettle calling the pot black?”]

Mon, Oct 14, 1:36 AM, Eric Valentine  writes: Now I’m begging to understand that you’re so stupid for saying such thing to me after all my explanation to you so far

Wed, Oct 16, 7:14 PM, Eric Valentine  writes: No I didn’t ask you to trust everybody buy you have to know when someone is telling you lies or truth, because I can not just bring out my time doing nothing  just to scam people by telling lies to people no I can’t do such thing my good friend, you just have to understand exactly what am trying to say here, So stop all your suspect and pretending and focus alert if truly is that you are ready to receive your rightful funds this time around as soon as we proceed

….Ahhhh, the joy of a good laugh!

Sometimes, Rob’s repeated annoyances actually have a pay off! Check out this response from another scammer with whom Rob has been communicating for months. He uses an email address named “SunnyLovesWhiteLadies”…

Below is a sampling of articles that we think will interest our readers….

Stranger saves a couple from a $9000 fraud payment in the nick of time! (Watch the news report on YouTube.)

Google Voice Scams: https://www.welivesecurity.com/en/scams/google-voice-scams-what-how-avoid/

Scam calls down but scam texts are up: https://pirg.org/resources/ringing-in-our-fears-2024/

Even family can not help a scam victim sometimes:

https://www.nytimes.com/2024/10/31/business/scam-con-artist-family-savings.html?unlocked_article_code=1.WU4.Sq1h.9M2qaeO0jK-T&smid=url-share

https://www.malwarebytes.com/blog/news/2024/10/android-malware-fakecall-intercepts-your-calls-to-the-bank

https://www.malwarebytes.com/blog/news/2024/11/1000-web-shops-infected-by-phish-n-ships-criminals-who-create-fake-product-listings-for-in-demand-products

How scammers can get past two-factor authentication (2FA):

https://www.malwarebytes.com/blog/scams/2024/11/crooks-bank-on-microsofts-search-engine-to-phish-customers

Remember to check out our monthly podcast! https://www.securewon.com/resources/podcasts/

Spear Phish Targets Business Office & Microsoft Purchase

Spear phishing is a form of phishing fraud in which the scammers target a specific person or institution using personal data they gather. Here’s a perfect example. Phishermen looked up the name of an employee at a school in late October, as well as the name of the person working in the school’s accounting office. They then created a new email address in Gmail pretending to be the school employee. The final step is to contact the accounting office worker to request a change in her payment information! However, what they don’t know about this school is that they’ve received lots of this type of fraud and have policies in place making it impossible to perpetrate! For example, employees must come to the business office and sign a form IN PERSON to make any changes to their banking information.

One of our longtime readers sent us this phishing scam that came from gmx.com.  GMX.com is a free email service located in Germany and it is pretty easy to see that it isn’t Microsft.com or Office.com! The attached pdf file contained no information at all linking it the recipient. Not a name, address or even an email address! Just a “thanks for your order. Call us if you didn’t order this.”  Yeah, right.

Report your smelly phish to us and Google! https://safebrowsing.google.com/safebrowsing/report_phish/

Amazon Black Friday Deals & Social Security Emails

With Black Friday, Cyber Monday and the Christmas holidays just around the corner, we are seeing cybercriminals ramp up their emails disguised as shopping deals. Check out this email from last week that looks like it came from Amazon about “Black Friday Deals.” The FROM name may be Amazon but the FROM email address is a crap domain called grdew[.]xyz!  If you EVER see DOT-xyz at the end of a fully qualified domain name, LUNGE for the delete key! 99.9% of xyz domains are used by cybercriminals! But what makes this scam an even greater threat is that the links, which point to a Google server in the country of Georgia in Eastern Europe, will redirect you into the jaws of malware at grdew[.]xyz!

During the last few weeks we have seen a significant jump in the number of fraudulent emails disguised as the US Social Security Administration (ssa.gov). (Is it because it is that time of year for people on Medicare to make any changes to their Medicare insurance? We’re not sure.) Below are two recent examples that our readers sent to us.  In this first example, a man is asked to ensure the accuracy of his earnings record on file with Social Security. The text field of the FROM address incorrectly uses SSA[.]com (By the way, SSA[.]com **MAY BE** a malicious mimic! One service on VirusTotal.com finds it suspicious. And it certainly isn’t ssa.gov!)   HOWEVER, if you look at the email address found between the < > symbols, you’ll see that this email came from  14ktjewelry[.]com!  Also, the link in this phishing fraud points to Bing.com as your first destination. We discovered that the Bing link will redirect you to a scam website called Secure-Service-01[.]com. Deeeeeleeeeeete!

The second example of a bogus Social Security email was actually an interesting threat sent to one of our longtime readers! Again, it came from GMX.com, in Germany! The attached pdf file was supposed to read as a legal document informing the recipient that her Social Security Account was going to be suspended due to “money laundering” and “narcotics trafficking.” Wow! Seriously? If this were true, wouldn’t the FBI show up on her doorstep? Cleverly, they told the recipient that they had to email this legal document because attempts to have it delivered to her home address were unsuccessful. They must have an old address. This is TOTAL BS, of course! Thankfully, the recipient wasn’t the least bit fooled by this fictional narrative and forwarded it to us. 

Warning About EML File Attachments

One of our readers sent us this warning about emails she has been getting that contain attached EML fIles. The email claimed to have a voice message attached. HOWEVER, if you mouse over the attached file (without clicking it) you’ll see that it ends with “.eml”.  Simply put, an EML file (Email) is a type of coding used to create emails. But EML files can also contain scripts with instructions for your email program to do something…. like download malware! According to this 2019 post on DirectAdmin Forum…. “In some email clients, such as Microsoft Outlook, Eml files can trigger active scripting that can be used to launch virus activity. Furthermore, other executable file types can be wrapped in eml files in order to bypass other virus checking scans.” So please add this type of file to your list of attachments NEVER to click!

Amazon, Android & Fidelity, Oh My!

Scam texts pretending to be from Amazon have jumped! For example, on November 3, a Reddit Member asked the community if this text he had received was a scam. Not only was it a scam, but the link in the text pointed to a link-shortening service. It was designed to redirect people to a very malicious mimic called amazonbuy[.]co. This website was registered just 2 weeks earlier and had malware lying in wait to infect your device! Yikes!

Another one of our readers received this text pretending to be a security notice from Amazon about her account. But the link in this clickbait clearly doesn’t point back to Amazon.com!

Deeeeeeleeeeeete!

Another reader received this bogus “Android Security Warning” from the phone number 689-307-2098. If Google, which owns the Adroid phone system, had truly sent a warning, it would have come from a 5-6 digit short code and NOT from a phone number! But the link in this fraud also points to a bogus domain that was registered in the Netherlands just hours before the text was sent. ‘Nuf said!

Here’s a text scam that we’ve never seen before! It came from the phone number 269-286-3786 and claimed to be from the financial services of Fidelity.com. However, Fidelity never, ever sends texts from phone numbers.  They use a variety of Short Codes that are published on their website.  The link in this text is obviously a malicious mimic! It is DigitalAuth-Fidelity[.]us and NOT fidelity.com! The phishing domain was also registered just hours before this text was received. You know what to do!

Until next week, surf safely!

Copyright © 2024 The Daily Scam. All rights reserved.
You are receiving this email because you have subscribed to thedailyscam.com

Marblehead, MA 01945

Contact Webmaster