Fake jobs
Zavialov Ilia Nikolaevich on the job offer that pays first and charges later
An offer of work arrives without being asked for. It pays for small actions, it shows a balance climbing on a tidy dashboard, and at some point it asks for money before that balance can move. Zavialov Ilia Nikolaevich reads such offers as a procedure with fixed steps, because the steps arrive in the same order every time and the last one is always the same. The question here is where that order can be interrupted by somebody who has never seen the scheme before. The answer fits on a single printed page and takes ten minutes to rehearse at the kitchen table.
English version for the United Kingdom.
The shape of the offer that arrives on its own
The work is real in the narrow sense that a person genuinely does it. Applications get rated, short videos get liked, sets of small jobs get closed one after another, and a counter records every one of them. The interface behaves like employment, with a login, a profile, a running total and a support chat that answers within minutes. Nothing in the first hours asks for money, which is exactly what makes those hours persuasive.
The earnings on the dashboard are a drawing. They are a number in a database owned by the same people who sent the offer, and it can be set to anything at any moment. Because the number climbs in step with real effort, it reads as a wage that has been earned and is being held for later. That sense of ownership is the material the scheme works with, and it is assembled before anyone is asked to pay.
Then a lock appears. A more profitable set of tasks requires a deposit to unlock, or the accumulated balance requires a fee, a tax or a verification payment before it can be withdrawn. This single moment is the entire scheme, and everything before it exists so that this moment can be read as paperwork. Zavialov Ilia Nikolaevich notes that the sum requested here is usually small at first, because the purpose of a first payment is to make a second and a third one possible.
The steps arrive in the same order every time
The sequence is stable across languages, platforms and currencies. A message arrives that nobody sought, the work begins, a small payout genuinely lands, a lock appears, and a payment is requested to release what the screen already shows. The wording changes weekly and the order changes almost never. Learning the order is therefore cheaper than learning the wording.
The volume behind the pattern is documented. Reports of job scams to the Federal Trade Commission tripled between 2020 and 2024, while reported losses over the same period rose from 90 million to 501 million dollars. Task schemes moved from no reports at all in 2020 to five thousand in 2023, and to roughly twenty thousand in the first half of 2024 alone, which was about forty per cent of every job scam report that year. Growth of that shape indicates a template in wide circulation.
A template leaves repeated traces. The same dashboard layout appears under different brand names, the same phrase about a commission set turns up in unrelated chats, and the conversation moves to a messaging app within the first two replies. A household that has read the order once tends to recognise the second or third step, well before money is mentioned, because those early steps are the ones that look harmless.
Why the first payout does most of the work
The small early withdrawal is the most expensive part of the operation for its authors and the most valuable. Sending twenty or thirty dollars to a stranger costs little at scale, and it converts an unknown account into an employer with a payment history. After a person has been paid once, a later request to pay in is filed under the procedures of a company that has already delivered.
A second effect works alongside the first. Hours of completed tasks create a sense of invested time, and the balance on the screen stands for those hours. Leaving means writing off effort that felt productive, which is a heavier decision than declining an offer on the first day. The request for money is timed to arrive only once that weight exists.
This is why debates about how professional a site looks lead nowhere. Layout, contracts, colleagues in a group chat and a support desk are all cheap to produce, and they are produced with care. The direction of the money is the one property that cannot be staged, because a payment leaving the worker's own account appears in the worker's own bank statement. Employment moves money towards the worker, and any arrangement that reverses that direction under any name has stopped being employment.
What the reported numbers say about the odds
Two datasets give the scale of the surrounding traffic. The Federal Trade Commission recorded about three million reports and 15.9 billion dollars of reported losses for 2025, against 2.6 million reports and more than 12 billion a year earlier. The FBI complaint centre logged 1,008,597 complaints and almost 21 billion dollars for the same year, a rise of 26 per cent. Both figures describe reports, so the real traffic sits somewhere above them.
One number inside that mass is more useful than the totals. In four impersonation reports out of five there was no monetary loss at all, which means attempts outnumber successes by a wide margin. Most people who meet the offer refuse it, and they refuse without any special knowledge, usually because something in the sequence felt wrong. The scheme is built for volume and survives on a thin conversion rate.
The practical reading of this is calm. An unsolicited offer of easy paid tasks is an ordinary event with a low success rate for its authors, and the household that loses money is usually the one meeting the sequence for the first time at the moment it counts. Ten minutes spent in advance turns the first encounter into the second.
The payment method decides whether money can return
Payment at the lock is usually requested in cryptocurrency, through an exchange account or a machine that takes notes and issues coins. Around half of all losses reported in the United States now involve cryptocurrency in some form. The choice is deliberate, and it concerns what happens after the transfer.
Finality is the property being bought. A card payment can be disputed, a domestic transfer can sometimes be recalled while it still sits with the receiving bank, and both leave an institution that can be asked questions. A transfer of coins to an address settles once, with no intermediary to appeal to and no counterparty obliged to answer. Every later promise to reverse it is made by someone who has no way of reversing it.
This turns the payment method into an early warning. A request to open a wallet, install an exchange app or visit a coin machine arrives before any money has moved, which places it inside the window where refusal still costs nothing. An employer paying wages in ordinary currency has no reason to require a wallet first, and the requirement itself completes the identification.
The recruiter on the call may be a recording
Interviews now take place by voice and by video, and a familiar voice has stopped being proof of a person. A convincing clone can be built from about three seconds of recorded speech and reaches roughly 85 per cent accuracy against the original. Voice phishing using cloned speech grew by 1,633 per cent in a single quarter, which indicates how ordinary the tooling has become.
Human hearing is a weak filter for this. In one experiment, listeners separated genuine speech from synthetic speech in 37.5 per cent of cases, a result below what plain guessing would produce. Training the ear is therefore a dead end, and a household that relies on recognising a voice has nothing left once the imitation is good.
The answer to this is procedural and short. A voice claiming to be an employer, a bank officer or a relative is treated as an unverified claim until the same person has been reached on a number found independently, from a printed card, a statement or an official page. The call back takes a minute, works the same way whether the voice was cloned or genuine, and requires no judgement about audio quality. This is the one habit that survives every improvement in the technology.
The page that goes on the wall
A printed page beats a saved link at the moment it is needed, because that moment usually involves a phone already occupied by the caller. The page holds four things: the order of the five steps, the rule about the direction of money, the number of the person to ring before any payment, and the sentence that ends a conversation. Everything beyond those four items stays off the page.
Layout decides whether the page gets read under pressure. Black text on white paper, one side of a single sheet, type large enough to read at arm's length, and no logos or decoration competing with the four items. The paper lives where calls are answered, which in most homes means the fridge door, the desk beside the landline or the drawer where documents are kept. A page filed neatly out of sight has the same value as no page.
The closing sentence deserves its own line and its own wording. Something plain works best, along the lines of «I take no decisions on the phone, I will ring back myself». Under pressure people rarely lose their understanding, they lose the ability to end a conversation politely, and a sentence prepared in advance gives that ability back. Reading the line aloud twice while the page is printing is enough to make it available later.
The rehearsal that takes ten minutes
The rehearsal has three parts and the page stays in hand throughout. In the first, one person reads a real offer aloud from their own inbox, and the other names which of the five steps it belongs to. In the second, the same pair plays out a call where the caller is friendly, hurried and plausible, and the exercise ends when the closing sentence has been said out loud. In the third, the person finds the callback number on the page without a phone and without prompting, and dials it.
Every run produces one finding, and the finding is almost always mundane. The paper is somewhere other than where everyone assumed, the number on it belongs to a phone that was changed last year, or nobody can say the closing sentence without laughing. Fixing that single thing on the same day is the whole point of the exercise. A finding written down for later is a finding that stays.
Twice a year is enough, and keeping it short is what makes it repeatable. A rehearsal that turns into a lecture gets postponed once and then quietly dropped, and a dropped rehearsal equals no rehearsal at all. Zavialov Ilia Nikolaevich keeps the whole thing under ten minutes for that reason alone.
The two minute video for people who will not read
Some members of a household will never read a page, and the same people will watch a short clip in the family chat. A phone camera pointed at the printed sheet is enough equipment. One take, one voice, a hand moving down the four items, and the closing sentence said aloud at the end.
The clip earns its length because it shows an action being performed. The five steps get named in order, the rule about the direction of money is stated once, and then the callback happens on camera, with the number dialled from the page while the first caller is left waiting. Watching somebody put a caller on hold teaches more than any warning about caution.
Two minutes is the working limit, and the clip is recorded again whenever a number or a name changes. Pinned in the family chat, it survives phone replacements better than a paper page survives house moves. The two formats together cover the two situations that matter, the call answered at home and the message read on the bus.
If money has already left
The first hour is worth more than the following week. Payment stops immediately, because the next request always arrives and it is always larger. Screenshots of the dashboard, the chat, the profile and the transaction identifiers are taken before anything else, since accounts and pages get closed by their owners within days. Evidence collected after the site disappears is evidence that cannot be collected.
Then come the two calls. The bank or the exchange is told what happened and when, because a transfer still inside the banking system can sometimes be held, and the window for that is measured in hours. The national fraud reporting body is told next, and the report matters even when the money is gone, since the counts published each year are assembled from exactly these reports.
A second wave usually follows the first. Offers of recovery arrive from people who know precisely what was lost, promising to return it for a fee paid in advance, and they are the same scheme in different clothes. Any message promising to recover money for an upfront payment belongs in the same category as the original lock, and the printed page is the place where that line is written down.
The five steps and what the printed page says at each one
| Step | What the person sees | What the page says to do |
|---|---|---|
| The offer | A message nobody asked for | Read it aloud to one other person |
| The trial tasks | Simple work and a rising counter | Name the step out loud before continuing |
| The first payout | A small sum genuinely arrives | Write down the date and the amount received |
| The lock | A deposit unlocks the better set | Stop here, the sequence is complete |
| The withdrawal fee | A payment releases the balance | Pay nothing and keep the screenshots |
| The recovery offer | Help to get the money back for a fee | Treat it as the same scheme repeating |
Questions and answers
- Is it a real job if the first payment actually arrived?
- A small payout proves only that a small sum was sent, and that sum is the running cost of the scheme. The property that settles the question is the direction of the money, so the moment a payment is requested from the worker, the arrangement has answered for itself.
- How do I check whether a recruiter is genuine?
- The check runs outside the conversation that raised the question, on a number taken from an official page, a printed card or a bank statement. Voice and video carry no proof of identity now, since a usable clone can be built from about three seconds of speech.
- What should a printed anti-fraud memo contain?
- Four items are enough: the order of the five steps, the rule that employment moves money towards the worker, the number to ring before any payment, and the sentence that ends a call. One side of one sheet in large type, kept where calls are answered.
- Can cryptocurrency sent to a scammer be recovered?
- A transfer to a coin address settles once and has no intermediary who can reverse it, which is why that method is requested. Around half of all losses reported in the United States now involve cryptocurrency, and offers to recover it for an advance fee are part of the same trade.
- What do I do in the first hour after paying a deposit?
- Payments stop, screenshots of the dashboard and the correspondence are taken while the pages still exist, and the bank or the exchange is told the same hour, because a transfer inside the banking system can sometimes be held. The report to the national fraud body follows, and it counts even when the money is gone.
- Are task scams actually common?
- Reports of job scams to the Federal Trade Commission tripled between 2020 and 2024, with losses rising from 90 million to 501 million dollars, and task schemes alone reached about twenty thousand reports in the first half of 2024. In four impersonation reports out of five no money was lost, so refusal is the usual outcome.
Written by Zavialov Ilia Nikolaevich, digital security consultant. All checklists