Job offer scams

Typically these "job opportunities" would mean helping in money laundering. They are also known as 'money transfer' scams, and can be divided into two variants, sometimes referred to as 'fake check' scams and 'mule job' scams.

## Mechanism

In the usual form of both variants, the scammer claims to represent a foreign company that needs help 'processing payments' and is recruiting 'finance managers', 'payment processors' or 'remote account managers' to handle money for them. The proposed deal is that you will receive money - in the form of instruments such as checks or drafts, or by direct transfer to your bank account - and forward it to them, usually by an untraceable and unrevokable means such as Western Union. In return for this service, you are invited to keep 10% of the sums transferred.

In a 'fake check' scam, the scammer provides a check or draft to be paid in, which is typically either forged or stolen. Funds may be credited to the victim's account initially, but will be withdrawn later when the forgery or theft is discovered. In this case, the scammer is stealing directly from the victim: the victim remains out of pocket for whatever they sent to the scammer, which may be several thousand dollars.

In a 'mule job' scam, the scammer uses the mark as a conduit for transferring money from another bank account, often one that has been acquired through a successful phishing operation. The scammer transfers money from the stolen account to the bank account of the mark, who forwards them to the scammer. Using transfer services such as Western Union essentially breaks the trail that connects the scammer to the original phished account and makes the money unrecoverable.

A recent variant of the mule job scam is the "mule as business owner" scam. In an elaborate money laundering scheme, criminals recruit a money mule to operate a franchise of an imaginary web-based retail business. The mule registers an actual company in his own name, obtains a tax ID, and sets up a bank account that the criminals can access. The scammers create merchant accounts to process online orders and provide a website bearing the name of the new company, often including html code that prevents search engines from indexing the site -- the exact opposite of what a web retailer would want to do. They then make multiple fraudulent charges on stolen credit card numbers for goods supposedly purchased through that site, which is deposited in the mule's corporate account and wired out by the criminals.

This type of fraud may be quite elaborate, with the mule remaining clueless of the illegal nature of his "business" for months. The criminals may set up phone numbers for the sham business that forward to their own phone numbers in Eastern Europe, and they may even process refunds to the few people who complain about the small unauthorized charges. By convincing victims that the charge was made to a legitimate business by some unknown criminal with a stolen credit card number, they can continue to make $9.90 charges against a much larger number of cardholders before the credit card company realizes the business itself is fraudulent. The goods being "sold" may be intangible items like e-books or website templates, so the mule need not become suspicious about how the goods being sold are getting shipped, and credit card fraud teams don't have any physical shipping address to investigate. The money mule receives an actual cut of the transferred funds, money which will be long spent by the time the credit card companies come calling looking for their money back. And the longer the fraud continues, the harder it is for the mule to extricate himself from the financial fraud or to plead ignorance. More information about these schemes is here.

In all cases, the victim is likely to lose money and may even face charges for money laundering or presenting a forged financial instrument. Simple math shows that the money mule receiving a 10% cut will end up owing victims ten times more than he himself actually received from the scheme.

## Characteristic Features

The 'pitches' used by scammers usually follow a consistent form. In addition to a description of the fictitious company and an explanation of the 'duties' of the payment processor, the message often lists some requirements for candidates, which usually include:

```
* Two free hours daily not including weekends
* Internet access for sending and receiving e-mails
* A bank account for receiving funds
* Experience with Word and Excel

```

The 'Word and Excel' requirement is window-dressing, intended to make the request seem more legitimate.

## Bait Sites

Messages often provide links to websites intended to give the impression of a legitimate and successful company. In some cases, these are constructed for the purpose by the scammer, using either generic website templates or copy and images taken from other sites. In other cases, the scammer may point directly to a genuine site belonging to a real company, usually choosing a site that is entirely in a language unlikely to be intelligible to the recipient (i.e. Russian). Alternatively, the scammer may adopt the identity of a real company and simply 'clone' the site to a similar-sounding domain. The scammer masquerading as Aegis Capital Group and Lux Capital uses this technique.

Bait sites are typically hosted on spam-friendly providers (for instance in China), although some scammers have been observed using Yahoo! domains. Another common trick is to use botnet hosting, with web and nameservers distributed across a network of zombie PCs.

A few scammers do without bait sites altogether and simply use free webmail accounts to service the scam. Yahoo!, Gmail and the Egyptian webmail provider Gawab.com are popular choices.

## Eluding detection

An interesting scheme is being used to deflect attention from some scam websites being investigated by a volunteer at Castlecops.com regarding the following domains:

* cannydesign.com
* vividtemplates.net
* vtdiz.com
* techtemplate.net
* tsdiz.com
* sucretemplates.com
* sudiz.com
* greerdesign.net
* gsdiz.com
* ibtemplates.com
* ibdiz.com
* infobitedesign.com
* dizib.com
* cctemplates.net
* ccdiz.com

The scammers apparently are rather attached to these domain names. Instead of allowing them to be shut down and registering others, the criminals have replaced the site content with blank pages that say "Internal error 500!" And they have attempted to prevent anyone from finding the Castlecops page describing the fraud by registering new users on multiple internet forums, using the domain names as user names, then making posts to the forums with their domain names in the signature. And they aren't spammy posts; while poorly written, they're on-topic and designed go undetected by forum owners.

Here a screen shot of a post made to a forum by a new user named "vtdiz.com" whose signature includes the domain names "vtdiz.com" and "vividtemplates.net." It and similar posts to other forums filled most of the spots on the first page of Google results for the term "vividtemplates.net:"

## Sample spams

Spams for fake jobs and other money mule schemes are often wordy. They usually include an email address on a free service like yahoo, google, or hotmail/live.com. Please remember: A company can register a domain name for under ten dollars a year, and can get at least minimal web hosting with 100 email addresses for well under $100 a year. Any company that can't afford its own website and email address can't afford to pay you, either.

```
Haikou Huabang Chemical Co., Ltd
No.26 Guomao Ave,
Haikou,China.
www.huabangchem.com

Dear Prospective Employee,

Huabang Chemical is in need of individuals who can help us receive
payments from our customers in Canada, America and Europe as we do
not run an account in these regions.

Salary: $5,000/month!(Minimum)
Position: Payment Officer
Experience: None - We will guide you through!
Requirements: Positive Attitude, Honesty and Integrity.
Schedule: 5+ hours/week.

You choose your hours!  Note that your bank account details are not needed and
there are no hidden cost for your services.

For more information, contact

Engr. Tomas Kee,
Regional Representative,
E-mail : huabangchemicals@live.co.uk
+44-701-113-9546

Your interest in our proposal will be highly appreciated.
Thanks.

```

Notice that although they claim to be writing on behalf of a real company and mention a real website (www.huabangchem.com), they only provide a disposable email address. It's highly unlikely someone at huabangchem would not use a company email address for official business like hiring. Examining this email further would have told you it was sent from a compromised computer on the campus of a U.S. university (so much for not "running an account" in that region), and that the same phone number has also been used for a lottery scam in January 2008 and a 419 scam in March 2008. Scammers can use voice-over-internet accounts to appear to have phones in countries they have never set foot in, so the fact that it has a UK country code only tells you that that phone number is assigned to a phone company in UK, not that the call will be answered there. The email claims bank account details are not needed; however, since spammers lie, that may mean nothing. Or it may indicate this particular scam will involve the victim depositing a fake check or creating a new bank account for the scammer to access.

```
Your resume and or contact details were automatically screened by the US free
classifieds and you were selected for possible consideration of employment with the
following Corporation. Please click here [links to morgantrustfund.net/index.html]
in order to get in touch with the employer.

Morgan Investment offers a motivating and exciting work environment. Work is
organized around clear performance goals and expectations, and every employee,
regardless of background, tenure or position, is given the opportunity to be a key
contributor. This is an outstanding opportunity to join a stable, yet dynamic,
entrepreneurial and growing company. Morgan Investment offers a challenging and
rewarding work environment, competitive wages and full benefits (medical, dental,
vision, flexible spending account, accidental death insurance and 401K).

The Company:
Morgan Investment Co. is an international private equity company which has been
successfully in operation since its inception in 1996. Morgan Investment builds
portfolios around a set of fundamental investment tenets that make up the foundation
of the programs we deliver to our clients. We believe institutions and wealthy
families should benefit from access to the same investment approach and investment
talent utilized by the largest university endowment programs.

Job Description:
The position available with Morgan Investment is an administrative assistant
position. Assistants and representatives are given the opportunity to work from
home. It is believed that if a person is given the opportunity to work in a
comfortable environment, the employee is more likely to perform at their maximum
potential. Studies have shown that business overhead expenses are reduced
drastically when allowing employees to work from home. The position pays a
guaranteed $2,500 USD per month + 5% commission on each closing assignment. We
provide a team environment, and a focused, hard working atmosphere essential for
success in the financial world.

Requirements:
# Attention to detail, and the ability to multi-task and self-manage

Benefits include medical, dental, vision, flexible spending account, accidental
death insurance and 401K after a 1 month probationary period. Senior assistants will
be given the chance to apply for a management position at one of our worldwide
locations.

Morgan Investment presents a significant opportunity for growth; this is your chance
to get in on the ground floor.

Please visit our site for consideration of this position. Browse the site to become
more familiar with the company and the position available. If you feel you will be a
good candidate for this position ensure to view the careers section and submit an
application for employment.

APPLY NOW! [links to morgantrustfund.net/index.html]

```

Wow, this sounds convincing! What money mule has a 401(K) and dental and vision benefits? The website looks very convincing, too. But the list of press releases is just a little too colloquial in tone:

```
news

05/26/2008
Latest recruitment drive under way

01/07/2008
Company wins award

11/09/2007
New corporate office building in NY

```

And sure enough, if you check http://who.is for the registration records for morgantrustfund.net, you find that despite supposedly having press releases as far back as November 2007, the domain name was not registered until 6/20/08. This "company" appears to be three days old as of the date this spam was received. Likewise, another domain morgantrustfund.com was also registered the same day.

The website vaguely describes the job:

```
The processing assistant manages transactions from clients on behalf of Morgan
Investment to ensure the investing client with privacy and security. You will be
required to ensure the investing client with simple and quick means to expediently
invest their funds in a timely manner. Human resources has recently put out the
message for new assistance in the North American region of the world (USA).

```

So you won't really be laundering money. You'll be "investing" it. The FAQ further states:

```
Who will the transactions be made out to and does this require a license?

The transactions will be made out directly to you by our finance department. You are
not required to have a license for this position, you are an independent contractor
and you are responsible for claiming gross annual income on your annual tax filings.
At the end of each fiscal year you will receive a total of your processed
transactions in order to file an individual income tax form and provide your income
to the United States government. We will be glad to assist you on this matter. You
will only need to pay taxes on your monthly salary and commissions.

Why is a bank account required?

A personal checking account is required in order to receive your salary deposits,
this also guarantees all the investor funds to be FDIC insured.

```

No business would ever allow their clients' funds to go into your personal checking account. They would make very certain their own name was on everything so there is no question who owns the money.

And so much for those health benefits and 401(K). An independent contractor is not eligible for employee benefits.

#### Another example email:

```
Good time of the day <Recipient Name>

Altair Investment Management reviewed your resume and would like to

offer you a home-based position with our company as Customer Service

Representative.

We stongly believe that your knowledge, skills and experience will be an

asset to our business.

We offer a fixed salary of 3,500.00 dollars per month plus additional

bonuses and benefits.

Duties:

   - Completes and submits reports to Accounting Department

   - Set up and support productive business relationships with consumers

   - Provide service to both potential and existing clients

   - Making an environment of great customer service through ensuring

client transactions are processed accurately and efficiently

   - Processes transactions and currency orders

   - Ensures that all transfers are processed in accordance to policy and

procedure as well as in a timely manner

If you are looking for ways of obtaining more information about this

job, if you are available and searching for a new professional lunch,

then contact our HR Dept

Yours truly,

Drahcir Shiltz

```

Notice the job title, usually reserved for lower paid positions, the unusually high dollar amount, and the offer of a fixed salary. All of this without an interview having taken place, sight unseen, as a 'blind' email. Also note the unusual name: combined with the high dollar amount, fixed salary, and job offer.

## More information

```
* http://www.bobbear.net/
* http://www.phishbucket.org/

```