WORK AT HOME SCAM • WORK AT HOME SCAMS

Job Seekers Beware!

Check Processing, Payment Processing Work at Home Scam

Unwittingly stealing and laundering money for a "commission"

 • The parties involved in this scam • Elements of the scam • Where the scammers are located •

• What the scammers tell the truth about • What the scammers lie about • What's really going on •

• Who the scammers target • How people find the job offers • Where the money comes from •

• Where the money goes • How this scam got started • How the scam works •

• Recognizing the fraud: Analyzing a Payment Processor job offer•

• Sample fraudulent employment letters • What to watch out for •

Warning!  U.S. Treasury Checks are now being used in these Counterfeit Check schemes: Sept. 8, 2005

The scam is composed of the following parties:

1. Scam ring members are as follows:

   (a) The scammers who "run" the job seeker victims via email and cell phone.

   (b) The scammers who send the counterfeit checks or money orders to the job seeker victims.

   (c) The scammers who wire funds into the job seeker victim's bank account or credit card account.

   (d) Hackers.

   (e) Identity Theft Black Market Database owners.

2. The job seeker hired as a Payment Processor: victim.

3. Bank account holders: victims as follows:

   (a) Checking or savings account holders.

   (b) Credit card account holders.

   (c) Buyers of items sold on auction sites or through Classified ads (on or offline).

4. The drawee banks: victims.

5. The job seeker's bank: victim.

6. Western Union (occasionally the job seeker victim is instructed to wire the funds bank-to-bank, particularly if the funds are to be sent to Asia).

The scam is composed of the following elements:

1. Persuading a job seeker to respond to an employment ad hiring Payment Processors for a foreign company at 10% to 20% commission for each payment processed.

2. Stealing the personal information of the job seeker and gaining access to his or her computer through malware embedded in the email correspondence, or embedded in the HTML of a fake corporate web site.

3. Selling that information into Identity Theft Black Market Databases.

4. Making the job seeker believe he or she has been hired by a legitimate foreign company as a Payment Processor.  The job seeker is now a job seeker victim.

5. Sending funds from account holder victims to the job seeker victim in the form of counterfeit paper instruments or wire transfer of funds stolen from an account holder's (Identity Theft victim) checking or credit card account.  When funds are wired directly into the job seeker victim's bank account or credit card account, or when the job seeker victim is sent an electronic check, the account holder victims are also Identity Theft victims.

6. Instructing the job seeker victim to wire all but 10% to 20% to various so-called company officers or company authorized personnel, and to do this by Western Union, Moneygram, or bank-to-bank transfer.

7. Getting the victim to do this as often as possible before the scam is discovered either by the victim, the victim's bank, or law enforcement.  WARNING: if any of the above list is familiar to you either personally or as it relates to someone you know, STOP now and read this: Know Your Miranda Rights and How to Use Them.

Where are the scammers?  Regardless of where the scammers state they are located in their emails, they are in fraud rings all over Western Europe, Central Europe (Former Soviet Union countries), and West Africa.  They are in Canada and the US.  The scammers are not always foreigners - persons native to the target country are involved in the scam rings, too!

These scams will soon be coming from fraud rings in South Korea, Malaysia, Beijing.

The scammers use cell phones for voice communication.  Since cell phone services allow for roaming, although a scammer may state that he is in London or Florida or Texas, he can actually be calling from anywhere.

The scammers use misdirection, spoofing, and open proxy blinds to send their emails.  Unless one is adept at reading and interpreting full email headers (the entire path an email follows from the scammer's computer to the victim's computer), it is impossible to determine that the email was sent from any location other than that stated by the scammer.

What they tell the truth about: The scammers are telling you the truth only when they state that they want to send you checks, money orders, money by bank wire or online transfer directly into your bank account or credit card account.  If paper instruments are used, they want you to deposit them into a business account or personal account.  Then they want you to send all the money to them except for your 10% to 20% "commission."

What they lie about: Everything else.

What they are really doing: They are using you as an intermediary to further either theft or laundering of money on an international scale.

Who are the scammers' targets?  They are most successful with single mothers, students, people who are disabled or handicapped, retirees, people on fixed incomes, people having trouble making ends meet, cottage industry owners and others who already have a work-at-home business, people who have a limited understanding of the banking system or good business accounting practices.  There are literally hundreds and hundreds of victims across the US and no country is immune.

How do people find out about the job offers?  unsolicited emails, Private Messages, IM's, Chat rooms, phony employment web sites, phony fund raising opportunities, job posting bulletin boards, help wanted bulleting boards, employment web sites like Monster.com, classified ads both on and offline in newspapers and magazines, posted on bulletin boards at grocery stores and Laundromats, everywhere and anywhere an employment opportunity message can be shared.

Where does the money come from? Funds wired into your account are stolen from innocent account holders through Identity Theft; electronic checks are ordered from an innocent account holder's checking or credit card account through ID Theft.

Domestic and International Money orders are counterfeited in large quantities on foreign fraudster printing presses.  Checks are counterfeited in large quantities on foreign fraudster printing presses.  Unauthorized QChex are ordered by unverified QChex account holders.  US Treasury checks are forged.  Counterfeit cashier's checks, personal checks, and corporate checks are used in this scam.

The money can come from someone who is buying a product through a Classifieds ad or auction site.  In that situation, the victim buyer is told to send his money to the victim payment processor, who in turn is told to wire off all funds received except his or her 10% to 20% commission.

Where does the money go?  On the average, a Payment Processing Scam victim is sent anywhere from 1 to 6 checks before the fact that the funds aren't legitimate is revealed by law enforcement or his/her bank. For each check, the Payment Processing victim is generally given a different overseas name and address for the Western Union wire.  Sometimes the different names and addresses are given as being hubs or centers for processing client orders.

In fact, the job seeker victim is sending the funds through transfer systems that allows scammer ring members to pick up the funds almost anywhere. 

Just because the funds are sent to a particular name at a particular location does not mean that the funds were picked up at that specific location, nor does it means that that the person picking up the funds is using his or her real name.  Scammers use false identification all the time to pick up funds.  Some transfer systems allow for pick up at any number of offices within the system since the funds may only be registered within a funds central, a hub if you will, servicing many different offices in the general area.  NOTE: Funds wire through any electronic wiring system other than bank-to-bank are untraceable beyond the pick up location.

When the job seeker victim sends the funds he's received via bank-to-bank transfer, that does not mean that the scammer is anywhere near that bank.  Bank accounts can be opened using a combination of online banking and surface mail.  Once the account is opened, through online banking the scammer, located anywhere in the world, can order the electronic transfer of the balance to any other bank in the world.

If the scam is being solely run by Romanian scammers, a portion of the money goes to the scam ring leader (often an ex-KGB officer) and back into the scam business, and the balance is spent on pleasure, clothes, high-priced cars, night-clubbing, etc.

If the scam is being run by Nigerian scammers or a Romanian/Nigerian combo, a portion goes to the scam ring leader, a portion goes back into the scam business, some goes for pleasure, and the balance may be spent on establishing and maintaining drug routes, supporting terrorist activities, and supporting kidnapping rings.

How did this scam get started?  In February of 2003, second generation Nigerian scammers hit the Internet with the Nigerian Counterfeit Check scam, aka Overpayment Fraud.  The basis of the fraud is to give the appearance of being the buyer for an item being sold in an online auction site or through on or offline Classified ads, or a prospective new tenant placing a deposit on an apartment, or a bed and breakfast guest making reservations, or any number of other scenarios.  The fake buyer tells the seller that he is sending a check for the amount of the item plus shipping expenses.  Many other excuses are used for the overpayment.  The scope of the fraud is described here: Nigerian Counterfeit Check Fraud.

A little less than a year later, fake job offers for Payment Processors began emanating from the Former Soviet Union countries (FSU) in a direct spin-off of the Nigerian Counterfeit Checks scam.

Romanian scam rings, made up of teenagers and young adults led by former KGB officers, latched on to the scam and made it their own.  Currently, Romanian and Nigerians scam rings have joined forces and are working together from Romania, West Africa, South Africa, the UK (mostly England and Ireland), The Netherlands, the US, Canada, and Australia.

The Romanians have brought their Identity Theft and hacking expertise contacts to the table, while the Nigerians have scam ring operatives in place in countries all over the world.  The combination is dismaying in its economical impact on society.

How does the scam work?  The scammer places a want ad on the Internet or in newspapers and magazines. The ad describes that a foreign company needs a US representative to process payments for their US clients.  See "How do people find the job offers?" above for other methods used by the scammers to distribute the phony job offers.

A job seeker responds to the job offer, however he or she becomes aware of it, through the email address provided by the scammer. 

The so-called employer (scamployer) provides any number of excuses for not being able to process payments in the company's country.  The reason this scam is so successful is that the scamployer claims to be in located in a country that Americans naturally associate either with repression, or recovering from the breakup of the USSR, or not as sophisticated as the US, or generally in a state of governmental and banking disarray.

The victim is asked to respond to the employment notice by submitting a resume to an email address.  The requested information often includes full name, address, sex, telephone-cell-fax, bank account number, copy of Driver's License or Passport, and occasionally a Social Security Number.

NOTE: During the string of correspondence between the scamployer and the job seeker victim, malware in the form of spyware and Trojans horses is inserted into the scamployer emails.  The malware reports back to the Hacker who then has free access to the job seeker victim's computer, including usernames, passwords, and all personal emails.  Personal information from these emails may be applied at a later date for extortion and threat letters to the job seeker victim to make the victim feel he or she is in imminent danger.

In turn, the scamployer emails back an employment contract that ranges from the simple to the very sophisticated.  Some contracts are almost non-existent in their brevity, while others are lengthy and have been flat out stolen from other contracts easily viewed or available on the Internet.  Since the scammers are not using any real names or addresses and are basing their actions on intent to defraud, the contract is worthless. 

The entire employment process is designed to take advantage of the job seeker's ignorance of banking, laws governing fiduciary responsibility, and proper accounting procedures.

The scamployer* now emails a notice to the job seeker victim that funds will be arriving within 3 to 7 days.  Included in the email are instructions to deposit the paper instrument and wire funds as soon as the check or money order has cleared** or a soon as the job seeker's bank account is credited with the amount of the check or money order***. 

If the scamployer has funds wired directly to the job seeker victim's account, the email instructions will urge the victim to immediately send the funds by Western Union or bank-to-bank transfer upon receipt.  Another pressure tactic is to urge the job seeker victim to cash the paper instruments at a check cashing store,  grocery store, or to cash money orders at a Post Office.  This is sometimes accompanied by a warning that the commission will be less if the wiring of the funds is delayed.

 * scamployer: This may be one person pretending to be many (the employer and two or more other company employees such as officers working in fake order centers).  It may be three or more people all pretending to be the same one.  Many job seeker victims are run by the same ring at the same time using pre-designed scripts.  The scripts allow different ring members to pick up the thread with any one of the victims at any given time as necessary.

**  cleared: A check is not actually cleared until the account holder says it is.  The common usage for the word "cleared" is that the account contains enough money to cover the check when it is presented at the drawee bank.

*** bank account is credited with the amount of the check or money order: In most instances, the money credited into a depositor's account is from his own bank in good faith.  It is not money that has arrived from the drawee bank.  Therefore, the money in the deposit account is actually a no-interest loan.  It's important to keep in mind that by law a depositor is wholly responsible for whatever he deposits into his account, and that includes funds wired into his account and funds deposited into the account by a 3rd, authorized party.

It is the depositor's responsibility to ensure the funds are legal and unencumbered, not the bank's responsibility.  A hold on deposited funds is for the purpose of determining whether or not the check will be financially honored upon presentation to the drawee bank, not to determine whether the check is counterfeit, stolen, or forged.

Recognizing the fraud: Analyzing a Payment Processor job offer

More Payment Processing scam letters:

John Wilson

Raymond Harry

Grand Import and Export Company

Japan Vam & Royal Poval Co., Ltd.

CMIEC

Web Tool Software, Inc. #1

Web Tool Software, Inc. #2

What elements to watch for - Red Flags:

• The Payment Processing Business scam is always either for Work at Home or Part Time Work.

• The job offer arrived through unsolicited email, snail mail, chat room, Instant Message, Private Message, Private Chat Room, phony company web site, posted on job web sites, posted on Help Wanted bulletin boards, posted in Classifieds (on or offline).

• The hiring company is selling product internationally and needs a representative to accept checks in the customer's country.

• The hiring company cannot process the checks it receives in its own country and needs someone outside the country to process the checks on its behalf.  There is always a reason they cannot accept funds and want you to do so for them.  There is no country in the world in which checks from another country cannot be cashed.

• NOTE: This scam is becoming so effective that new variations are being developed daily. Please keep in mind that it is NOT the names or the reason for needing a representative that are important.  It is the INTENT.  If the intent is to get you to accept funds from a person with whom you are NOT dealing directly, and send those funds off to someone else, then it is a scam.  The acceptance and wiring of the funds is called MONEY LAUNDERING.

• The job does not require a knowledge of proper bookkeeping and accounting requirements.

• There is no requirement that you be bonded and insured.

• There is no background check performed to ensure that you are a trustworthy individual.

• There is no requirement that you be properly licensed and registered to accept their funds, account for them, and file the proper tax forms to report the income.

• There is no requirement that you open a bank account in the company's name in a local bank to receive the funds, as is proper and usual.

• Checks are made out to you instead of the company.

• Checks are made out to you without an exchange of product or service that you directly provided.

• Money are orders made out to you without an exchange of product or service that you directly provided.

• Funds that are wired into your account from a party to whom you did not directly provide your banking coordinates.

• A request by the company that you open an account in your name at a specific bank, such as Bank of America or Citibank.

• Any request that you transfer money you have accepted on their behalf by any means that is difficult to trace, i.e. by Western Union, PayPal, MoneyGram, Money Order, bank-to-bank to a bank in a country other than that of the hiring company, or by any other method.

   

Never, ever, EVER cash a check for a stranger.

Never, ever, EVER accept any funds on behalf of someone else.  Period.

Never, ever, EVER accept funds from one party and send them off to another.  That is money laundering.

By accepting funds on behalf of another party you are taking full, legal, and responsible possession of those funds.  Are you sure this is the kind of business you want to engage in with a complete stranger thousands of miles away?

٨Top

Questions?  Write to