WORK AT HOME SCAM • WORK AT HOME SCAMS
Mystery Shopper money laundering scam
Job Seekers Beware!
Important Notice: Beware of the Mystery Shopper money laundering scam. Those money orders and/or Traveler's Checks are counterfeit! Do not attempt to cash them or deposit them.
Check Processing, Payment Processing, Payment Processing Work at home Scam:
Unwittingly stealing and laundering money for a "commission"
The scam is composed of the following parties:
The scam is composed of the following elements:
Where are the scammers? Regardless of where the scammers state they are located in their emails, they are in fraud rings all over Western Europe, Central Europe (Former Soviet Union countries), and West Africa. They are in Canada and the US. The scammers are not always foreigners - persons native to the target country are involved in the scam rings, too!
These scams will soon be coming from fraud rings in South Korea, Malaysia, Beijing.
The scammers use cell phones for voice communication. Since cell phone services allow for roaming, although a scammer may state that he is in London or Florida or Texas, he can actually be calling from anywhere.
The scammers use misdirection, spoofing, and open proxy blinds to send their emails. Unless one is adept at reading and interpreting full email headers (the entire path an email follows from the scammer's computer to the victim's computer) such as a trained fraud examiner or enforcement investigator, it is impossible to determine that the email was sent from any location other than that stated by the scammer.
What they tell the truth about: The scammers are telling you the truth only when they state that they want you to receive checks, money orders, money by bank wire or online transfer directly into your bank account or credit card account. If paper instruments are used, they want you to deposit them into a business account or personal account. Then they want you to send all the money to them except for your 5% to 20% "commission.
What they lie about: Everything else.
What they are really doing: They are using you as an unwitting intermediary to further either theft or laundering of money on an international scale. If you or someone you know is involved in this scam, please read Know Your Miranda Rights or Warning and How to Use Them right now.
Who are the scammers' targets? They are most successful with single mothers, students, people who are disabled or handicapped, retirees, people on fixed incomes, people having trouble making ends meet, cottage industry owners and others who already have a work-at-home business, people who have a limited understanding of the banking system or good business accounting practices. There are literally hundreds and hundreds of victims across the US and no country is immune.
How do people find out about the job offers? Unsolicited emails, Private Messages, IM's, Chat rooms, phony employment web sites, phony fund raising opportunities, job posting bulletin boards, help wanted bulleting boards, employment web sites like Monster.com, classified ads both on and offline in newspapers and magazines, posted on bulletin boards at grocery stores and Laundromats, everywhere and anywhere an employment opportunity message can be shared.
Where does the money come from? Funds wired into your account are stolen from innocent account holders through Identity Theft; electronic checks are ordered from an innocent account holder's checking or credit card account through ID Theft. Funds also arrive from victim buyers who are instructed to wire their funds into your account.
Domestic and International Money orders are counterfeited in large quantities on foreign fraudster printing presses. Checks are counterfeited in large quantities on foreign fraudster printing presses. Unauthorized QChex are ordered by unverified QChex account holders. US Treasury checks are forged. Counterfeit cashier's checks, personal checks, and corporate checks are used in this scam.
The money can come from someone who is buying a product through a Classifieds ad or auction site such as eBay. In that situation, the victim buyer is told to send his money to the victim payment processor (either by check, money order, MoneyGram, or bank to bank wire), who in turn is told to wire off all funds received except his or her 5% to 20% commission. The victim payment processor and the victim buyer are run either by the same scammer or by different members of the fraud ring.
Where does the money go? On the average, a Payment Processing Scam victim is sent anywhere from 1 to 6 checks before the fact that the funds aren't legitimate is revealed by law enforcement or his/her bank. For each check, the Payment Processing victim is generally given a different overseas name and address for the Western Union wire. Sometimes the different names and addresses are given as being hubs or centers for processing client orders.
In fact, the job seeker victim is sending the funds through transfer systems that allows scammer ring members to pick up the funds almost anywhere.
Just because the funds are sent to a particular name at a particular location does not mean that the funds were picked up at that specific location, nor does it means that that the person picking up the funds is using his or her real name. Scammers use false identification all the time to pick up funds. Some transfer systems allow for pick up at any number of offices within the system since the funds may only be registered within a funds central, a hub if you will, servicing many different offices in the general area. NOTE: Funds wire through any electronic wiring system other than bank-to-bank are untraceable beyond the pick up location.
When the job seeker victim sends the funds he's received via bank-to-bank transfer, that does not mean that the scammer is anywhere near that bank. Bank accounts can be opened using a combination of online banking and surface mail. Once the account is opened, through online banking the scammer, located anywhere in the world, can order the electronic transfer of the balance to any other bank in the world.
If the scam is being solely run by Romanian scammers, a portion of the money goes to the scam ring leader (often an ex-KGB officer) and back into the scam business, and the balance is spent on pleasure, clothes, high-priced cars, night-clubbing, etc.
If the scam is being run by Nigerian scammers or a Romanian/Nigerian combo, a portion goes to the scam ring leader, a portion goes back into the scam business, some goes for pleasure, and the balance may be spent on establishing and maintaining drug routes, supporting terrorist activities, and supporting kidnapping rings.
How did this scam get started? In February of 2003, second generation Nigerian scammers hit the Internet with the Nigerian Counterfeit Check scam, aka Overpayment Fraud. The basis of the fraud is to give the appearance of being the buyer for an item being sold in an online auction site or through on or offline Classified ads, or a prospective new tenant placing a deposit on an apartment, or a bed and breakfast guest making reservations, or any number of other scenarios. The fake buyer tells the seller that he is sending a check for the amount of the item plus shipping expenses. Many other excuses are used for the overpayment. The scope of the fraud is described here: Nigerian Counterfeit Check Fraud.
A little less than a year later, fake job offers for Payment Processors began emanating from the Former Soviet Union countries (FSU) in a direct spin-off of the Nigerian Counterfeit Checks scam.
Romanian scam rings, made up of teenagers and young adults led by former KGB officers, latched on to the scam and made it their own. Currently, Romanian fraud rings and fraud rings located in other Former Soviet Union countries have joined forces with Nigerians scam rings and are working together from Romania, West Africa, South Africa, the UK (mostly England and Ireland), The Netherlands, the US, Canada, Latvia, Lithuania, the Ukraine, and Australia.
The Romanians have brought their Identity Theft and hacking expertise contacts to the table, while the Nigerians have scam ring operatives in place in countries all over the world. The combination is dismaying in its economic impact on US society.
How does the scam work? The scammer places a want ad on the Internet or in newspapers and magazines. The ad describes that a foreign company needs a US representative to process payments for their US clients. See "How do people find the job offers?" above for other methods used by the scammers to distribute the phony job offers.
A job seeker responds to the job offer, however he or she becomes aware of it, through the email address provided by the scammer.
The so-called employer (scamployer) provides any number of excuses for not being able to process payments in the company's country. The reason this scam is so successful is that the scamployer claims to be in located in a country that Americans naturally associate either with repression, or recovering from the breakup of the USSR, or not as sophisticated as the US, or generally in a state of governmental and banking disarray.
The victim is asked to respond to the employment notice by submitting a resume to an email address. The requested information often includes full name, address, sex, telephone-cell-fax, bank account number, copy of Driver's License and/or Passport, and occasionally a Social Security Number.
NOTE: During the string of correspondence between the scamployer and the job seeker victim, malware in the form of spyware and Trojans horses is inserted into the scamployer emails. The malware reports back to the Hacker who then has free access to the job seeker victim's computer, including usernames, passwords, and all personal emails. Personal information from these emails may be applied at a later date for extortion and threat letters to the job seeker victim to make the victim feel he or she is in imminent danger.
In turn, the scamployer emails back an employment contract that ranges from the simple to the very sophisticated. Some contracts are almost non-existent in their brevity, while others are lengthy and have been flat out stolen from other contracts easily viewed or available on the Internet. Since the scammers are not using any real names or addresses and are basing their actions on intent to defraud, the contract is worthless.
The entire employment process is designed to take advantage of the job seeker's ignorance of banking, laws governing fiduciary responsibility, and proper accounting procedures.
The scamployer* now emails a notice to the job seeker victim that funds will be arriving within 3 to 7 days. Included in the email are instructions to deposit the paper instrument and wire funds as soon as the check or money order has cleared** or a soon as the job seeker's bank account is credited with the amount of the check or money order***.
If the scamployer has funds wired directly to the job seeker victim's account, the email instructions will urge the victim to immediately send the funds by Western Union or bank-to-bank transfer upon receipt. Another pressure tactic is to urge the job seeker victim to cash the paper instruments at a check cashing store, grocery store, or to cash money orders at a Post Office. This is sometimes accompanied by a warning that the commission will be less if the wiring of the funds is delayed.
* scamployer: This may be one person pretending to be many, such as presenting himself in different emails as the employer and two or more other company employees such as officers working in fake order centers, a banker, and an attorney. It may be three or more people all pretending to be the same one. Many job seeker victims are run by the same ring at the same time using pre-designed scripts. The scripts allow different ring members to pick up the thread with any one of the victims at any given time as necessary.
** cleared: A check is not actually cleared until the account holder says it is. The common usage for the word "cleared" is that the account contains enough money to cover the check when it is presented at the drawee bank. The account holder has up to one year to report a check as unauthorized, i.e. stolen, forged, or counterfeit.
*** bank account is credited with the amount of the check or money order: In most instances, the money credited into a depositor's account is from his own bank in good faith. It is not money that has arrived from the drawee bank. Therefore, the money in the deposit account is actually a no-interest loan. It's important to keep in mind that by law a depositor is wholly responsible for whatever he deposits into his account, and that includes funds wired into his account and funds deposited into the account by a 3rd, authorized party.
It is the depositor's responsibility to ensure the funds are legal and unencumbered, not the bank's responsibility. A hold on deposited funds is for the purpose of determining whether or not the check will be financially honored upon presentation to the drawee bank, not to determine whether the check is counterfeit, stolen, or forged.
What elements to watch for - Red Flags:
Never, ever, EVER cash a check for a stranger.
Never, ever, EVER accept any funds on behalf of someone else. Period.
Never, ever, EVER accept funds from one party and send them off to another. That is money laundering.
By accepting funds on behalf of another party you are taking full, legal, and responsible possession of those funds. Are you sure this is the kind of business you want to engage in with a complete stranger thousands of miles away?
Questions? Write to Help (at) FraudAid.com