Alpha Team Research: Anatomy of a Job Scam

Companies in the manufacturing and construction industries may find themselves inundated with scammers offering jobs at their companies that do not exist. A common way that firms attempt to combat these job scams is by working tirelessly to remove all the associated infrastructure: job posts, accounts, websites, and emails. Though this approach may be effective with the right resources, we suggest instead that companies focus efforts on the areas that may be most harmful to their company and their hiring process. This piece acts as a primer on the job scam process and explains some of the core functionalities of a job scam: how scammers reach targets, the job offer process, and what the fake job offers look like.

Recommendations

Use the ZeroFOX platform to Identify and remove fake job postings, scammers’ accounts, and associated infrastructure, but focus on the areas that may cause the greatest impact to your hiring. Consider focusing on the areas that target your most important applicant pools. Reach out to [email protected] for assistance, if needed
Work within your industry on ways to reduce the easy of job scams and increase visibility around the legitimate hiring process
Monitor for outreach from job candidates regarding scams and fraudulent postings

Details

Scammers initially engage with victims in a variety of manners in the digital space. There are two broad categories of engagement: passive and active. In passive engagement, the scammers are hoping the victims will come to them, whereas in active engagement, they initiate contact with victims to draw them in.

In this section, we are using the example of Gulf Job Careers as a case study; however, a variety of similar groups, accounts, sites, and organizations exist offering jobs around the world.

Channels of Engagement

For construction and manufacturing scams, passive engagement includes a wide variety of Facebook posts, in large part within job-focused groups.

Figure 1. A Facebook group with likely fraudulent job postings across the oil and gas, manufacturing, construction, and other industries.

Instagram and Twitter are also methods to promote job scams, though not yet as commonly used as Facebook. Comparing the Gulf Job Career Facebook group in Figure 1 with its Twitter and Instagram accounts (linked by its custom site, gulfjobcareers[.]com reveals significantly lower engagement on the latter two. The Facebook group has over 300,000 followers, while their Instagram has 12,900 and their Twitter account has only 9,400.

Professionally oriented social media sites are commonly used as well to post fake job listings, such as on LinkedIn, Indeed, and Glassdoor. These postings are particularly concerning because their professional association may lend an air of authenticity not posed by Facebook, Instagram, or Twitter.

Many social media posts also link to posts on custom-built sites. These sites usually contain the same information but with the added lure of improved search capabilities for job seekers. The disadvantage for companies targeted by these scams is that it can be more difficult to remove fraudulent information from a custom-built domain as opposed to social media, since fraudulent job postings clearly violate social media Terms of Service.

Figure 2. Gulfjobcareers[.]com, which is associated with the social media pages by the same name.

As awareness of these scams and others begins to spread, scammers are moving to private and encrypted channels. Gulfjobcareers also maintains a Telegram group, and many job postings are published in WhatsApp groups. Though the initial posts may be public, they can quickly be privatized or moved to encrypted direct message channels.

In addition to passive posts, scammers often also reach out to potential victims through WhatsApp or other private channels, actively soliciting interest and job applications. Interest expressed by victims on public channels frequently results in outreach via Facebook or LinkedIn direct message, text message, or email. Whatever the initial contact, scammers are looking to move the conversation to private channels that cannot be publicly monitored.

The Job Offer Process

Once the conversation is established in private channels, there may be some perfunctory discussion about what the candidate is interested in, their skills, job requirements. The conversation will quickly move to getting the candidate a job offer as fast as possible. Interviews may or may not occur; if they are not completely bypassed, they might be scheduled but then later canceled, they might occur “in writing,” and on occasion, an actual virtual interview may occur.

Interview or not, the candidate is quickly provided a job offer indicating they have been selected. The job offer letter also includes or is accompanied by instructions and paperwork for submitting for visa sponsorship in order to emigrate. The applicant is told to fill out this paperwork and submit it either to a fake visa officer/office, or to a third party that will help “expedite” the application. Along with submitting a wide variety of personal information that could be used to impersonate the victim applicant or steal their identity, the victim is also told they must pay a fee for the visa — theoretically to be reimbursed by the company later — usually ranging US$1,000 - 3,000.

Characteristics of the Jobs Offered

Job postings or initial advertisements typically list multiple job types, rather than listing an opening for one particular job or type of job. Fraudulent job postings target the manufacturing/construction, hospitality/tourism, agriculture, and domestic worker industries above all else, potentially because these areas are readily perceived as suitable for non-native workers or that have a high proportion of immigrant workers. Engineering, project management, and administrative positions are the types of jobs most frequently listed in the construction and manufacturing industries. Some job postings will list broadly available positions not specific to a particular company, including positions ranging from engineering to waiters to drivers.

No matter the type of job, the posting will often advertise an unusual number of benefits at no cost to the job candidate: housing, transportation, a vehicle, some meals included, plane tickets back home once a year, a weekly “allowance,” etc. The postings will also list salaries that are unusually high, not counting the additional benefits; posts for engineering and construction positions in Canada in 2019 and 2020 listed salaries of CAN$5,000 - 16,000 per month in addition to benefits such as meals, plane tickets, and/or a weekly allowance of up to CAN$500.

By offering positions readily available to immigrants and advertising attractive benefits, scammers ensure they entice a wide pool of potential victims. Indeed, when these jobs are posted on social media, at times dozens or hundreds of users will reply expressing interest and asking how they can apply.

Conclusion

Scammers tend to target the vulnerable, as in this case, where job seekers are being taken advantage of. It is likely that these kinds of job scams will increase, given that the global unemployment level has so rapidly increased due to the economic effects of COVID-19. To best protect your candidate pool from scams of this nature, ZeroFOX recommends implementing the recommendations listed above.