Job Scams Are Getting Worse | Four of the Most Dangerous

You could be speaking to somebody who legitimately has a LinkedIn profile. Somebody's copied that profile. You go to Google that person like, oh, they're real. And they're talking to you in video, but they're not really them.

Welcome to the Security Cocktail Hour. I'm Joe Patti. I'm Adam Roth. Today, it's our holiday special. Happy holidays. What'd you get me? What did I get you? I got you stress. Okay. How about I give you some of that?

You've been giving me that for the last 10, 15 years of my life.

Well, today the gifts are for our listeners and we're doing something a little different than we've done in the past. We've typically done holiday scams, but we've covered that quite a bit. We're going to do something very much along the line of scams and probably of help to a lot of people. It's an unfortunate state of affairs that a lot of people are out of work or looking for work, and there are a lot of job scams out there. We're going to tell people about these scams and about about how to pick them out, see when they're being scammed, and help out in avoiding them. All right. So first, we're going to talk about an AI enhanced interview fraud. We'll call it that for now. I don't think there's an official title for it. If you've been looking for a job in the past two years or so, you know that AI is all over the place. generating the job requests there. You got to go through an AI before you even talk to a person, get anyone to look at your resume. You've seen that, right, Adam?

Yeah, it's a little bit annoying. It's like, why don't you do the 10-minute online interview? Some of them are legitimate, but still, I don't know how legitimate they are, even if they're from reputable companies. I don't know if I would put my time into an AI enhanced interview, but some of them are not good at all.

Yeah, well, I personally don't like the idea of talking to an AI and they supposedly grade you and do all sorts of stuff. Who knows how well it's working? Who knows if anyone's even looking at it? But you got to watch out for scams with this too. There are a couple things to be on the lookout for, and it's so sad that this is happening. And a lot of this is for IT people because, well, you'll see why, but a lot of it apparently targets IT people. The first thing is that you're not talking to someone who's real. You're not talking to who you think you're talking to. You're talking to some scammer. You know, impersonation online isn't terribly difficult. People set up fake websites. They know the real names of the recruiters, both in company and outside the companies. You know, LinkedIn is a great tool for all that stuff. It's all there for someone to just take, right?

Well, you know, it's funny you bringing that up as well, right? You know, I was shown something recently where where two people were out drinking and then Donald Trump showed up and it looks so legitimate. And then I see online on LinkedIn, especially, you know, there's these people that are showing how bad AI can be if you're not careful. And they have a side-by-side comparison of them. And then some beautiful woman, they're a guy, some beautiful women, they're speaking in their voice. The woman speaking in her voice, it's enticing. And then you're like, you think you're speaking to a woman, but really you're speaking to a guy and it's not the real video. And it can be vice versa. You don't know who you're speaking to. You could be speaking to somebody who legitimately has a LinkedIn profile. Somebody's copied that profile. You go to Google that person like, oh, they're real. And they're talking to you in video, but they're not really them.

Yeah, well, we've been talking about the deep fakes for a long time, along with the general AI security stuff, but apparently now I have the ability to do these deep fakes, voice and video in real time, which is just amazing to me.

Yeah, that's what I was talking about.

Yeah, yeah, that's it, in real time. And supposedly, even if they're not perfect, it's like if it's a little glitchy or a little funny, well, you know, they just say like, oh, yeah, well, you know, your connection's not great. You know, the internet's not perfect, that kind of thing.

I mean, I would tell everybody who's listening to this, usually that scam ends up like We want to hire you, but we're going to send you a computer and a desktop. You have to give us, you know, $800 as a deposit in order to get the computers and equipment that we need you to work with. We need you to put a credit hold, or you need to give us your information for the profiles so we can do a background check. And what they're really doing is opening up cards and accounts under you.

Yeah, well, you're right. Well, that's the first problem is that, you know, it's scary because to apply for a job very often, you got to give over a lot of information. And, you know, some places it seems like what they, what they want just keeps getting longer and longer and be careful. I mean, if someone says just for an interview or just to consider you, they want too much personal info, you know, particularly if it's anything someone can use to open, you know, a credit card account or anything. be very wary. And it's tough because legitimate companies are asking for too much too, which is just annoying, but it becomes really dangerous with the fake ones.

So full transparency, I see what we're going to talk about a little bit is about malware delivery. And that's always interesting, right? Hey, we need you to take this competency test, download the test, run it, and then take the test and we'll get the results right away. Meanwhile, What they're doing is they're creating a shell into your computer and they're downloading all your pertinent information, your cookies, your financial information, your passwords, cash to memory, and they're going to start going to town on it. And it's kind of ironic when my son wanted to take his test, he didn't want to go into DMV. They make you download this app so that they can control your mouse and your keyboard and your camera.

Wait, that's New York DMV makes you download control software onto your computer?

What? But this is no different from any of these other... If you want to take one of those online certification tests, but you don't want to go to the testing center, They have access to your camera, they have access to your keyboard, your mouse, and they'll want to be able to see you sitting in front of the computer at all times. It's not like regular Zoom software. It's a little bit more control. I think it's a rootkit. My son claims they're not rootkits anymore, but they used to be rootkits. They can get access to your whole entire computer to see that you're not committing fraud. When you're done, you uninstall it, but I don't know, there's remnants in there.

You know, I'm trying to remember, because within the past year, I actually got a certification, believe it or not. And I remember there was something special I had to do. And the guy was like kind of a pain in the ass. He's like, he wants to see my desk and he's clearing all this out.

He's like, yeah, and he goes, what is that there?

I'm like, dude, that's my backup drive. I'm not throwing that out. If I remember right, it was some kind of something in the browser, I think it was like a secure browser. kind of software. So I don't think I had to install anything, but be careful about installing stuff because that's why IT people get hit because sometimes these guys will say, oh, we need to do a coding exercise and you need to use our development environment or our testing sandbox or something. Yeah, that's going to be malware.

Yeah, I'm just saying if you're not downloading it for a reputable place, like the DMV, they're not really going to do anything to you per se. And I'm not saying it's absolutely like a rootkit, but at the end of the day, They have access to your cameras. They have access to your microphone. They have access to everything. So make sure you uninstall that. But the point I'm making is somebody might call you say, hey, you have a new iPhone. It's on its way. Oh, no, no, no, no. It's not an iPhone. I never ordered it. Call this number to cancel it. You go to call or cancel it. They go, hey, do a do a Zoom with us to make sure we know who you are and you install software from them. And it might be browser based, but you got to be careful.

Yeah, we'll always be really wary about any time they ask you to install software. I wouldn't want to do it. Frankly, even if it's a legitimate company, I don't want some company's software on my laptop. people need work, and they're willing to do stuff, and they're willing to say, hey, you can see my camera and all that. Unfortunately, they get pressed to do some things that maybe they don't want to do under optimal circumstances, and that's unfortunate. But like Adam said, Adam, you're totally right. It's like, you know, it should be reputable software. Go and look it up, see if it's real, Google it, see if there are any problems. Check it with AI if you want to be more modern. And like video conferencing, no one should be using bespoke video conferencing software, Zoom, Teams, whatever, and get it off the legitimate site. There's no need for anything else.

And I've seen this also on LinkedIn, and I don't want to just keep them beating it into the ground, but there's plenty of people who've actually posted on LinkedIn saying, I thought this was a legitimate company, and they end up taking money from me or they end up installing something, just be careful and they start calling people out of who've done this. So you can be on LinkedIn, you can have somebody reaching out to you with 500 plus connections and they still might not be legitimate. So if you don't know who they are, and they don't have a phone number, and they don't have a regular location, and they're not in Glassdoor or LinkedIn, then be weary. But still, just because they're in there doesn't mean don't drop either fences either, because they might be representing a company that they don't really belong to.

Yeah, and you know, you got to be careful. I mean, some of the general rules that come up, they apply here like always. You don't want to install software. Anyone who asks you for money, and we'll see it again in more of the scams, but anyone who says, oh, you got to pay a fee to get an application in and do something, that's a scam. Don't do it. Don't waste your time. Just some really basic things like that. If you can, check someone out. I mean, there are a lot of recruiters that are independent, that are one-person shops. They're small. But at the same time, those people are known. They have references. You probably know someone in their network. Just ask, do you really know this person? Are they for real? Got to do what you can these days, unfortunately, because you may be really hurting for a job. I understand it. to get your identity stolen because you put some malware on your machine and now they've cleaned out your savings too, that hurts even more.

Yeah. I mean, like we were talking about holiday scams in particular, but like you said, a lot of people are looking for jobs. They go on LinkedIn, they see an opportunity, they upload their resume and they're already kind of compromised, right? They, um, they gave their phone number, their email address. While it's not stuff that, you know, you can't really get online, but you actually just giving it to, An illegitimate recruiter is going to do something with it and probably represent you somewhere else. So anyway, the point I make, what we're making is you can never know a hundred percent, including ourselves. Either one of us can get scammed. We're not above that either, but we're a little bit more, I guess, what's the word? Paranoid. Paranoid. So, so with paranoia comes a little bit more defense, but we're just as capable as getting scammed as you are. we try not to.

With great paranoia comes great responsibility.

You want to talk about the packaging processing scams now?

The packaging processing things. I mean, that one kills me. So what, you want to describe that one?

I mean, I've seen a lot of it. I mean, I think we're talking about the same thing. Somebody ends up reaching out to you and they tell you that, you know, Either one, we're going to send a package to you. And is this what we're talking about?

And it's a, it's a job offer. We got to say someone offers you a job.

Yeah. I mean, I, I, I've seen some of that. I mean, I, every once in a while I'll send you in a, in our chat, you know, the things that I get from people like, Oh, it's a job offer. I'm like, who the hell are these people? They don't even represent this. And it's funny. I know HR people. I go back to people like, is this really your company? No, we don't have anybody representing us. Yeah.

Well, you got to watch out. Yeah. Whenever someone out of the blue offers you a job, you know, these days that's kind of, that's kind of dodgy. Um, but when they offer you a job for like really good money for really easy work, I mean, come on, you gotta be really wary of that. And apparently reshipping or packaging processing. I had not heard of this. You know, I don't want to be rude, but I'm kind of surprised people fall for this. where you get this job, whether they solicit you or you answer a posting or something. And of course, because you're getting a job, you're going to give them a lot of personal information that they'll use later. And these guys, they will apparently send you items, like they'll have it shipped to you and they'll say, well, we want you to do quality control, make it so or, you know, whatever. We need or we can't have things shipped to us directly for whatever reason and we want you to reship it to us and very often it's, you know, involves international stuff. I mean, if that just doesn't scream fraud and laundering stolen goods, I don't know what does.

I know there's a guy on the website, I forgot his name, he's a former NASA engineer, and he actually did this whole scam thing, but what he did was he set these people up and put in glitter bombs. Oh, the glitter bomb guy? Yeah, yeah, he's good. I saw that. He actually targeted those type of people, and then he put a GPS in there, and he tracked the people. he actually did some really good, I guess I want to say, legal or detective work where he was able to detect some of these really big scam artists, some of them in India, some of them in the UK, some of them in, I think, North Africa, but he actually targeted some of them. And some of the people really did live in New York City and New Jersey where they were involved in this scam. So it was an international scam, but They send you packages. You're supposed to reship it. You're supposed to get the packages and drop it off at a beer courier. And it's always shady.

Yeah. And well, the Glitter Bomb guy, I actually didn't see him doing the scam stuff. I saw him doing the Glitter Bomb where he's getting porch pirates. And that was just funny besides being cool. But yeah, this package scam is. Yeah, you're doing this stuff for them. And the scary thing is you got to be careful, because like if you go to the cops with it, or the company or whatever, they could accuse you of being involved in it and say, yeah, you're just ratting out your accomplice before you get caught. So that's really bad too. And you know, the nasty part of the scam is that makes people, you know, scared to report it.

Yeah. I mean, I stick to, I know people want to work, but stick to organizations that you can really find out that a legitimate, like what Joe and I have done is if they have a legitimate website supposedly, you look at when they created that website. If the website was created in the last year or two, be weary. Check on the New York State or New York City or whatever municipality you live in to see when they were incorporated, where the LLC is, where they really are situated. See if they have a federal tax ID number. You know, it's not always easy work to do, but any legitimate organization is going to have attribution. But it doesn't mean that you can't be a startup either. But if you're a startup, you should have some legitimate information. You should have some seed money in there. There should be some people investing money in that company. There should be some public media about it. It should be something.

Yeah. Well, even if it's a startup or if it's a small company, which there's nothing wrong with that. I mean, they have to have some kind of connection, anyone legitimate. You know, again, there may be someone in your LinkedIn contacts who can vouch for them, even if, you know, mutual person, even if, you know, you don't know them well, you can try them out, but those can get fake too. But, you know, if it's something that's local too, you can ask, maybe, you know, someone who used to work in the place, uh, you know, any kind of connection you can make to validate it is, is really cool. you know, also just be on the lookout for this stuff. And the other thing is too, apparently, one of the things that they'll do is they'll ask you to like sometimes front the money for the shipping. They're like, oh, well, you know, we'll reimburse you when it comes out. Don't do that. That's scream and scam too. Anytime for a job, you have to put your own money up. That doesn't work.

And it goes without saying, don't buy gift cards. That's another story. I don't care what...

Especially if they're shipping you gift cards and then you have to mail them off to a foreign country. That's a bad sign. Yeah. We're going to take a quick second to ask you for a favor. We hope you're enjoying these honest discussions among security pros. If you are, please help us out with a comment to tell us how we're doing. And also tell your friends and colleagues about the show. Oh yeah, and like, subscribe, follow. Thanks. So what else do we have, Joe?

The Mystery Shopper, I love that one.

Yeah, the Mystery Shopper is interesting where we'll describe the whole scam, but basically you're paid to shop for a company as part of like a test or whatever, a test of customer service or of the business. And we'll go into the whole scam, but I had no idea. Apparently, there is a real thing. It is a real thing. Yeah, where companies will hire professional shoppers to go in and, I guess, test the experience and rate companies and do that kind of thing.

From what I know- I had never heard of it. I've heard of it, and what's funny about it, it truly is a third-party company that's doing it. A major retailer might hire a smaller company to hire people to do it. because they don't want to have these people as employees. It's seasonal. So a company A, well-known company hires company B, company B says, we'll pay you X amount of dollars to do this or per diem. You know, like you go to each location you go to and you fill out a form, we give you X amount of dollars. It might not seem legitimate, but it probably is. If it's, if you can show some attribution, if the company's been around for a while, but you never know, you got to be careful.

Yeah, well, apparently there are some legitimate companies that you can research and see if they're for real, although they've been spoofed too. Apparently people impersonate them, so you got to make sure it really is the company. One of the first big indications, again, gets down to money. If they're going to pay you a ridiculous amount of money or even a decent amount of money, it's not looking very good. Supposedly these mystery shopper things, when we looked it up, they pay like nothing. It's terrible work. So if they're paying you more than, they pay like 10, 15 bucks per thing. And if someone's willing to pay you a couple of hundred, that sounded a little scam-like right there.

Well, the other part to it is like, okay, we're going to deposit the money. Just give us your checking account number and routing number, which a lot of us do. I give it to my utility companies. everything else to pay my bills. I don't want to pay the credit card so I don't pay the credit card fees. So I put my routing number into my utility company and they take the money out. But you know these companies will tell you the same thing. We'll deposit the money directly into your account. Give us your routing number and your checking number because it's legitimate when you're doing the direct deposit for your regular company and you never know they're going to Just start writing checks against you and remove that money. They send it into another account. They delete that account. You can never get the money back.

Yeah, that's the thing. If you give away that number, the routing number and the account number that's at the bottom of your checks, whatever, someone can make up fake checks. They can deposit money for you, but they can also withdraw money in many cases. And once it's gone, they pull it over overseas. And wired money, forget it. Gone. Done. But apparently what they're also doing is, and you see this makes it enticing too, we say, don't put any money up front, don't put any money up front. And then they say, no, but for this scam, they'll send people a check. They'll send you a check for a couple hundred, couple thousand bucks, whatever. And they say, use this money to go and buy, go and buy this stuff, whatever. And of course you go and buy it and you ship it to them, most likely, right? So they do that, but then the check ends up being bad. And you're like, so how is the check bad, but they still rob you? Well, What happens when you deposit a check, apparently, and I had heard of this before, is the check doesn't necessarily clear for a while. And I've seen this too. If you go and cash a check, at least at my bank, when I go and cash a check, which doesn't happen very often, believe me. I can't remember the last time. you go, what they do is they give you the cash, but they actually take it out of your account and give it to you. And then a couple of days later when the check clears, they credit your account. So I think this is something very similar here. It's like you say, oh, I got this check from this company. They deposit it. and you can pull it out and do stuff, but really you're using your own money. And then when that check doesn't clear, you ain't ever getting that back.

Well, I think what happens is, and I've done this even recently where I've taken a check and I've cashed it against my account for cash. But if you have a really good checking account and you have a really good history, they'll immediately credit you for most checks. So if it's a thousand dollar check, give them the check, it immediately gets deposited in your account. And if they find out like X amount of days later that it's not a legitimate routing number, not a legitimate whatever it is, then that money gets reversed and they pull it out of your account. You can go negative. And what some of these scammers do is say, hey, we'll send you a check for $1,000. Buy what you got to buy to send us back the difference. And then you end up sending the money back and then the check gets reversed and you have no money.

Yeah, exactly. It's not good. And you know, once they get into your bank account, I mean, that's it because you not only can lose your money, but if your account manages to go negative, you can owe the bank money, your credit can get destroyed. And you know what? That's a terrible thing. If you're looking for work, people are doing credit checks now. And, you know, if they hear about that, that could be a problem that could impact you getting a job. And then, of course, this again is another one where you look like an accomplice. And, you know, if you go to the police and you tell them, I hate to say it, but if you go to the cops and say, yeah, this guy paid me to buy a bunch of gift cards and then, you know, scratch them off and, you know, and send him photos and email him photos of the numbers, you know, the cops are going to be pretty suspicious that you're in on it. So you got to be super, super careful. But again, that's part of the scam that you're afraid to report it.

I would also say when you're going shopping for the holidays, I always tell this to everybody, do not use your your debit card. Yes, the debit card thing again. Well, for many reasons. One, even if they're a legitimate place, I've seen this and it's happened to family members. Like you go to buy something for $227. They made a legitimate mistake. They put down $2,270. They put a zero or the decimal in the wrong place. That money gets taken out of your account. Then you have to turn around and ask them to reverse it and they have to close it out. At the end of the day, their point of sale system and the money gets deposited or might get held for a day or two days. You might need to pay your rent. Don't use your debit card if you don't have to use a credit card. It's easier to manage, especially if it's a card company that will be more shopper friendly or more consumer friendly.

Yeah, and we've talked about that before and also about my preference for tap-to-pay on the phone, so I like that a lot too. That's a good thing to have. All right, the last scam is another one. It's really nasty. I mean, this one really bothers me because it's not only a scam, but it really manipulates people and plays on psychology, which I don't like. So this is the Gamify Job Scam, and this one is just Crazy, apparently this has become very popular in the past few years. So, you know, you'll get again, you'll get solicited somehow. And supposedly they say, you know, we need you to do some of these tasks that are really simple. They're really simple. They're really ridiculous. There's not much to do. And you're like, oh, that's easy money, social media content, you know, rating stuff, stuff like that. And you're like, oh, I can sit there and make easy money while I'm watching TV or whatever and not doing much. But there are two things. The first is, apparently they often pay in cryptocurrency. And anything that involves you being paid in cryptocurrency, be very careful right there. Because I've got nothing against cryptocurrency, but... Most companies will pay you if you're an employee with money.

You know, I have yet to... Traditional money.

Traditional money. Put it this way. Again, I don't want to be smirched to crypto stuff, but I have not yet encountered a lot of employers that pay in crypto. Is that fair?

It's fair, but I know there are people out there these days who are saying, I no longer want to get paid in... traditional currency, I want to get paid in crypto and they are getting paid in crypto or I mean, I have several crypto accounts. I want to be careful, but at the same time, you're 100% right. If somebody is asking you to pay you in crypto, they probably want to know what your crypto account information is so that they can try to possibly remove your money from your crypto account. It's really no different from your routing number and your account number. If they're asking for your crypto deposit information, they might be trying to target you to see whether or not you have a crypto account. And the most important thing I think that we need to understand is whatever you're using, whatever you're managing, whatever you're doing, always use MFA or MFA, multi-factor or two-factor authentication. Because if somebody's going to try to target you and you don't have the multi-factor authentication, but you do have a password and username, If they might turn around and go, hey, we went to go deposit money in your crypto account. Do me a favor. You might've got a pop-up on your authentication, even with 2FA or MFA. Can you give me the pin number so we can deposit the number? Don't ever give your pin number. Don't ever give your MFA to anybody. Not even your sister's brother's father's mother's uncle.

Yeah, well, it's always worth saying, use MFA for everything online. And we really should do a show just on protecting your crypto wallet, which is a whole other world. But hopefully now that I've gotten some hateful comments about crypto from those people, we can move on to the actual scam, which is, and this is just crazy to me. They make it like a game where you gotta get to the next level. The more you do, you get to the next level, and the next level, and you keep making money for all of this. But then they throw in this thing and I had to have this explained to me, a lucky order or a merge test or something that sounds lucky. Well, the truth is the lucky thing is very unlucky where they take money out of your account. You're accumulating all the money you're making in this little account with the crypto and then they take it out and say, but you're going to make that back because you're going to get like, you know, double points for this next set of tasks or something like that. And when you get to the next level, we're going to put that in plus some. And then the real scam comes when they say, OK, but you can't have a negative balance. So until you fill it up, you've got to put your own money in there.

I know nothing about that one. I'm reading it now. I know nothing about that scam. But the good news is that every year with the holidays, there's always new and exciting scams to look out for.

Yeah, there are. And you know, they're really not. Yeah, they're exciting. They'll get your get your blood going, but not in a good way. That's the kind of excitement you want to avoid. You know, when it comes to these scam episodes, we know that a lot of our listeners and viewers are, well, are cybersecurity people and IT people who frankly probably know a lot of this stuff or have heard about some of it. But please share it with your family and friends, with people who probably don't know it, because, you know, some of these things that seem really obvious to me and Adam, and maybe to you too, are not so obvious. And the only proof of it is that it's working. and people keep doing it and people keep falling for it. So please, whether it's sharing this or just telling people, please spread the word. Do a public service. That's why we're doing this, right, Adam?

Yeah. And of course, to have our panel at the Security Cocktail Con, we'll talk about the different holiday scans as one of the panels.

Yeah, absolutely. All right, Adam. So that's four scams, and that's as much as I can take. This just gets too upsetting with too many of these things. We want to talk about positive stuff for people, but people need to know about this.

So I think it's more like the 12 days of Christmas, the eight days of Hanukkah, and the four scams of the holidays.

for scams of the holidays. Well, unfortunately, these were only job scams, and there are a lot more and there are a lot more holiday scans. We have our previous episodes, too, that you can take a look. And many of them are classics that just keep going. Yeah.

If there's a scam that we didn't discuss, let us know and put it in the comments. We'd love to add it on to the next episode or publish it in our social media.

Yeah, we'll be free to share too. You know, we said share, we can also. And if you've heard about any variations of these that we haven't covered or any other aspects of it, please let us know because they're changing all the time. These guys are so creative. They literally spend all day trying to figure out new ways to trick people and it's hard to keep up.

So happy holidays, everybody. That's right. Happy holidays.

Stay safe and we'll see you soon. Thanks for listening.

Thank you guys.

The first thing is that you're not talking to someone who's real. You don't think who you're talking to. You're not talking to who you think you're talking to. You're talking to some scanner. God, I can't talk today. You're not talking to who you think you're talking to. You're talking to some scanner. And God, what the is the matter with me?

Tell us about a scam that we didn't discuss. And then we can, you know, probably add on later or put a little blah, blah, blah, blah, blah, blah, blah. I'm sorry. But I know we have a let me speak to the control room. Yeah, use that content. I got it. Okay. Yeah. So I know we have a nice little itinerary of stuff to do. And my control room said to follow the script. So let's go.

Yeah, the extensive security cocktail our control room I know is dictating is managing this whole podcast here.