38 ms·
Tell HN: Upwork has an impersonation problem
The past few days I started getting interview invites from companies and people I had never heard of. I initially shrugged it off as aggressive spam, but after declining one of the invites, one of the emailers followed up to confirm that I was the same person that they were talking to on Upwork.
I had never setup an Upwork profile before so I said no, after which they responded with a link to a profile of someone that was completely impersonating me. They had scraped my LinkedIn page for information and were interviewing under the guise of being someone they were not (they were even using my picture). I talked to Upwork support, and after about 36 hours they deleted the impersonator. However, I just did another search and there is already someone else impersonating me again (this time they changed the face on the picture).
I only discovered this because the first impersonator was too lazy to change my resume they downloaded from my website and kept my real email on it, so some companies had used that email to contact me instead of their Upwork registered email.
I would recommend everyone search for their name on Upwork (I had to wrap mine in quotes to find the matches) and make sure they aren't being impersonated.
In the meantime, Upwork really needs a better validation mechanism. As engineers we really have no recourse, and there is absolutely nothing we can do to prevent this from happening.
- jayzalowitz 4y agoFor a while: https://medium.com/hackernoon/someone-stole-my-identity-on-upwork-and-all-i-got-was-this-lousy-blog-post-d63aab2b4c90 https://medium.com/hackernoon/someone-stole-my-identity-on-u...
- tmikaeld 4y agoOh god, I can't even read that page because of the amount of eye-watering green.
- btown 4y agoAt least it's not eye-watering green and a Medium paywall!
- nvr219 4y agoOption+cmd+R for reader mode! Need to find some way to automatically do reader mode whenever opening a Medium or Substack page.
- yellowapple 4y agoBrings back fond memories of MySpace and the garish themes therein.
- GnarfGnarf 4y ago<F9> in Firefox.
- cestith 4y agoA small company I worked for years ago had a similar problem on one of the gig work sites. Someone listed a dozen or so web sites they had designed, programmed, and provided to clients complete with links. The problem was eight to ten of them were from our portfolio. We got their portfolio updated to not include our work and an assurance the account would be closed if the perpetrator did the same heinous thing again. So, yes, your accomplishments in multiple different forms can be claimed by someone else. It can pay to be aware of this, but there's a cost to staying on top of it. Make sure to balance the two.
- bdcravens 4y agoI'm not sure what triggers it, but they do identity validation at some point (probably tied to receiving funds) - I recently had to do this. They ask for an ID scan, and then do a video call with a staff member. Once you're in the validation needed phase, you cannot take on more projects or withdraw funds.
- ge96 4y agoI think I remember this process, was so weird. You don't see anyone on the other side. Just a black screen. Side note, I cringe at that thought, I did some mturk work long time ago, had to scan people's photos on a random social network site. Tinder has this "verify" thing you stick your tongue out to the left, some worker somewhere sees it face #5753 and hits okay.
- shortstuffsushi 4y agoYeah, I was thinking about this process as well (did it about 10 years ago now when it was still E-lance, I think... wow). I guess it wouldn't be that hard to fake your way through the process, maybe the level of effort is worth it for the amount they're ripping off?
- aarbor989 4y agoAccording to Upwork support when I spoke to them > Please know that as soon as the freelancer applies or is offered a contract, we would run an identity verification process which would have them submit a Government-issued ID and have a quick video chat or send us a selfie to prove their identity. However, this is way too late in the process for my liking...and who knows how strict they actually are?
- mtlynch 4y agoI ran into this a few years ago and wrote about my experience: https://mtlynch.io/upwork-scammer/ https://mtlynch.io/upwork-scammer/ tl; dr - I caught an Upwork freelancer blatantly copying other freelancers profiles. I reported it to Upwork, who said they'd handle it but couldn't tell me the details I reached out to the freelancer's other clients to tell them the freelancer was a fraud, and they said Upwork had never notified them.
- hash872 4y agoHow did you find the freelancer's other clients? Upwork keeps that pretty locked down so that they can serve as the middleman. (Maybe you have a hack?)
- tmikaeld 4y agoAt that time, I believe you could see previous work by default, now you have to choose to share it.
- mtlynch 4y agoThe freelancer had Work Diary enabled, which took screenshots of their screen as they worked and shared them with me as their client. From the screenshots, I could identify other projects they worked on and other Upwork accounts they were using.
- aarbor989 4y agoyea, Upwork said they can't disclose to me what action(s) they took "due to account privacy" You mean...the account privacy of someone pretending to be me?
- mgkimsal 4y ago20 years ago, someone stole my credit card information and bought some stuff as me. I'm in Michigan, and they sent a bed and mattress to Florida. I called the store first, asking about the charge. Verified some part of the card number, name the order was under, etc... I asked what address it was sent to. "We can't tell you that. Our privacy policy prevents that". Me: "So... you're charging what is my credit card, you've verified my identity, you acknowledge this order was placed in my name, and you're happy to take my money, but you won't tell me where 'my' order was sent?" Sears(!): "Yes, that's correct". Called the bank... got a 'fraudulent charge' form faxed(!) to me, which I filled out and sent back same day.
- dijonman2 4y agoI deleted my LinkedIn, it’s a source of information that the general public doesn’t need to see. I don’t want to broadcast my employment history to the world. I think the value of LinkedIn is diminishing and will continue to decline.
- dewey 4y ago> I think the value of LinkedIn is diminishing and will continue to decline. I don't see how that would be the case, it's the de-facto rolodex for your work-circle and I don't think I know any alternative that is getting popular.
- blown_gasket 4y agoI think it's value is you are able to be found be those looking to employ you. If you don't want to be offered employment, I don't see a point in having a LinkedIn - a resume does just fine when you are looking. But this goes towards the GPs post, it is public information. I also deleted my LinkedIn awhile ago. In my opinion a company or person should only be given my CV when I offer it to them. In terms of a work-circle rolodex, this is odd to me. If I want to keep in contact with the person in the future I will have their personal contact info and keep in touch, otherwise not.
- TameAntelope 4y agoConsider that not all of us mind sharing their CVs to the world. The potential for harm is quite low, and there are meaningful upsides.
- 50 4y agoSee https://read.cv/ https://read.cv/ for a viable alternative.
- mypastself 4y agoIt’s a trade-off for me. There is value in being visible to recruiters, but I’m not too comfortable with so much of my personal information being available for easy perusal.
- f17 4y agoI got burned by something like this. I hired an editor (not on Upwork) who had worked for a number of very famous authors (people you've heard of, people who've sold millions of copies). They did a fantastic sample edit, and the quality of the work dropped off precipitously by about the 20% point of the manuscript. The best-case scenario is that they just didn't care, because I'm a nobody and because of the novel's length--over 250K words, so self-publishing is the only option. However, there's a lot of forensic evidence suggesting that they farmed the edit out to more than one person (which would explain the inconsistent apparent level of skill and care). So I started looking into this, and apparently this is a common practice. Being traditionally published won't necessarily help you; the big houses contract out most of their editing work, and the same thing can happen. Software might have the opposite problem from fiction editing, though. With editing, the issue is that the money (at all stages) is so poor--the average novel only sells a couple thousand copies--that I imagine a lot of people feel they have to do this sort of thing to survive. In software, these problems tend to involve there being far too much money at stake.
- rout39574 4y agoThe term of art for this process from the MBA side is "Extracting the value from the brand". The editor developed the reputation for good work, which had some value. Now they're cashing in by selling the brand attached to poor work. The reputation is decaying at some rate, but slower than the editor is extracting money. Notice, for example, you're not helping it decay, your story can't be tied to the bad actor. You have good reasons for this, but it's why the scam works. The key correlate to understand from "Extracting value from the brand" is that when the process is complete, there is no value left in the brand. It's explicitly setting up a con, defecting from the iterated prisoner's dilemma. Lying with more words. My favorite examples of this pattern are from other areas of endeavor: Kitchen Aid mixers, which used to be an industrial quality offshoot of Hobart and now is trash; and Singer, which used to be a superb sewing machine, and now is trash. But you can see the pattern in many places.
- nathanaldensr 4y agoI have a KitchenAid stand mixer and it's just fine. All the attachments work as expected and the motor runs smoothly after hundreds of uses.
- impersonated 4y agoI'm looking for advice on a similar issue. Somebody is impersonating me on dating sites and blackmailing women. They convince their victims to send nude photos, and then they threaten to send the photos to their families. The scammer (or scammers) use photos of me that used to be publicly available on social media. They also use my real name, presumably so that the victims see a legitimate LinkedIn profile when they google "me". Years ago, I got called to a meeting with my work's Human Resources department. The victim had looked me up and emailed my company. HR told me that "I" had to stop doing this. When I realized what had happened, I knew that I couldn't do anything to make it stop. Thankfully HR didn't take any action, but the whole time I worked there I had low-level background anxiety that another victim would contact them. Last month, a different victim messaged me on LinkedIn because she was suspicious of "my" profile on OKCupid. She sent me screenshots of the profile and messages. The scammer used obviously non-native english, so at least there's some credible evidence that it's not actually me. I've only become aware of the two incidents above, but I'm sure there are many other victims. I emailed OKCupid to ask them to block the impersonator, but I don't know if they can even stop him from re-registering, and there are other dating sites. I no longer have recent photos publicly available, and I've locked down all social media, but I don't want to delete my LinkedIn. What else can I do? Has anyone else had something like this happen to them?
- lolpython 4y agoSorry to hear about that problem. Maybe you could put a warning about the impersonator on your LinkedIn bio.
- Nextgrid 4y agoYep definitely, put it as the first thing in the bio so it hopefully gets indexed by search engines. Maybe even set up a website that ranks high for your name so you can warn others.
- impersonated 4y agoThank you for the recommendation! I'm having trouble phrasing a warning in a way that's clear to a scam victim, without seeming weird or off-putting to business contacts. It's somewhat upsetting to think about this too much, which may be why I'm struggling. Would you mind suggesting how to word it?
- codegeek 4y agoOne simple way would be require video submission where you have to speak your name and mention that you have joined upwork as a freelancer. But then upwork would have to spend more money on validations. They probably don't care as much. I sometimes hire from upwork. My litmus test is simple. I want to talk to you for 5-10 mins on video. If you cannot show up or have issues doing a video meeting, I won't proceed. It may help getting rid of scammers who are hiding behind a fake profile. I remember one guy telling me that he has speech issues and can only "interact" through messages/email. Even if true, I cannot trust someone on the internet like that.
- aarbor989 4y agoAccording to Upwork support, they do something like this before a contract is actually signed. But in my opinion that's way too late in the process - someone impersonating me could completely ruin my reputation before any contract is handed out
- Nextgrid 4y agoI did one gig on Upwork and at no point I went through a process like that. The client invited me to their Slack, we discussed some more then they accepted the proposal and I did the work. At no point I had to do a video verification step with Upwork itself.
- buildbot 4y agoHow is upwork not liable for this? I imagine there is a cachet that comes with having profile on upwork that the people committing felony identity theft rely upon.
- Nextgrid 4y agoThe law doesn’t apply to big companies in the US.
- smt88 4y agoI've been on the other side of this, hiring fake people. I'm actually going to stop using Upwork after almost 10 years. It's such a cesspool of fraud now that I can't figure out how to find the honest people. As an example, I recently hired someone who showed his face on video and had great communication skills. Next time we did a call, he had no video and sounded totally different. It turned out to be a subcontractor impersonating him.
- mgkimsal 4y ago> It's such a cesspool of fraud now that I can't figure out how to find the honest people. now? I've heard similar horror stories going back years. Perhaps you were lucky in that you got more positive than negative out of it earlier?
- smt88 4y agoIt's very possible I was lucky. I also only worked with people who were willing to appear on video, had long work history, and didn't do more than a single job at a time. Recently I had thought that maybe prices had gone up, and I was just not paying enough for the honest, individual contractors, but even at $120+/hr, we were getting people misrepresenting their skills or trying to trick us with subcontractors.
- mgkimsal 4y agoThe few success stories I've known from upwork have been people who managed to find one sharp person, then went direct with them ASAP, and left upwork behind.
- yomkippur 4y agoSeems like this can be solved with a quick address verification no?
- smt88 4y agoHow? And what would their address tell me?
- blabberwocky 4y agoWhat’s the best course of action for you/the person being impersonated, if the platform doesn’t fix the (systemic) problem? Put up a big notice on LinkedIn declaring that you are not on these platforms?
- aarbor989 4y agoYea that's pretty much what I did...I added a note to my "headline" on LinkedIn saying if you found me on Upwork, it's not actually me
- dannylandau 4y agoI remember trying to hire an iOS developer on Upwork, and got an American developer to bid on the project that seemed too good to be true. Turned out he was, and it was a fake profile. Figured it out only after agreeing on payment and about to start work, before realizing something was off. Contacted Upwork and they took profile down.
- zttg 4y ago
- sam1r 4y agoHis, or *hers*
- justusthane 4y agoThat would be "her"
- sorkin78 4y ago
- ThePowerOfFuet 4y ago> Upwork just banned all Russian accounts(Jews will be next, I think) What the fuck, man?
- lobocinza 4y agoJust to add more information. They stopped sending money to Russia and Belarus but definitely there are Russians in the platform but living or at least having an address somewhere else. Recently I saw a job with preferred location set to Russia. Upwork had to comply with sanctions nonetheless.
- disillusioned 4y agoI've had the inversion of this occur, when I've been obviously talking to an impersonator working out of China. They always push for a Zoom call. The video is extremely dark. They lie about their location. It's maddening. Even for direct hire, I had two candidates send in resumes with the same avatar, but with the image mirrored. And it was still a resume with an Asian name! And an Asian-featured person! Why would they even bother at that point?? We had a specific project that required hardware to be shipped to the vendor, and required it to be in the US, and people would just lie, openly, as if when the time comes to ship the hardware to them I'm not going to notice it's going to China or a reshipper.
- a_simm 4y agoJust wanted chime in with second a second anecdote that I was going to post. We needed a Django developer. Put an ad on Upwork at the high end of the recommended salary range. The ad specified US Eligible worker for legal reasons. Of the 10 or so applicants, seven flat out refused to appear on webcam so I decided to talk to the eighth. This person claim to be in Seattle. Having lived there I asked them two relatively simple questions. First, can you see the space needle from where you’re sitting? Answer: Yes. Second, what color is the bubbly music museum next door? Obviously, this is a trick given it’s multicolored. My candidate, who did not lack bravado, guesses white. I get that being born into particular circumstances is luck of the draw. On the other hand there’s a reason that people are willing to pay more to hire US-based workers. I believe this has become a general societal problem. People running so called two-sided marketplaces regularly fail to take responsibility for gaming by one side. I would further argue that Upwork has even more responsibility given the monitoring of and commission they take from an ongoing relationship. The US probably has too many regulations - in my opinion - concerning immigrant workers; however, no temp agency could get away with what Upwork is doing without facing severe repercussions. I’d like to see Upwork punished.
- throwawaysleep 4y ago
- ActionHank 4y agoCurious what you put on LinkedIn. Do you list all 3?
- bberenberg 4y agoCongrats, you're the problem.
- lelanthran 4y ago> Congrats, you're the problem. You're agreeing with him. He is making the judgement that actions such as his is a problem, and then he makes the point that there is no feedback to prevent such actions.
- cwoolfe 4y agoI have experience on Upwork both hiring and being hired. From hiring perspective, the person I interviewed was not the person who actually did the work. Being hired via Upwork, it was a challenge to even land an interview; I'd bid things and be in a pool among 10+ other people internationally with lower rates. I've worked in software in the US for over 10 years. The other aspect is that often those hiring on Upwork don't know what to look for, or have unrealistic expectations. I did find a few mutually successful gigs, but didn't make as much as I could have in industry. I decided that working for a normal company was more advantageous.
- gamerDude 4y agoInteresting enough, years ago I worked on upwork. And now, I get emails from developers in India asking if they can partner with me, use my account to get customers and then split the profits. I have always said no, but this is another way upwork may have an impersonation problem. Using accounts with a great track record, then selling the login information to someone else to pretend to be them. Then when you hire someone, it isn't actually them.
- stevenjgarner 4y agoI am not affiliated with it at all, but I am considering using a service like https://www.idcheck.io/ https://www.idcheck.io/ for my own business. Sure there are a lot of users that find such things invasive, but I have had a lot of our users ask for stronger user verification. It would be a great solution to Musk's bot problem with Twitter. Anyone have experience with such a service?
- digianarchist 4y agoAt 2 euros per identification I can probably tell you why Twitter doesn't use it for their 330 million MAU.
- akcreek 4y agoWe have one (or more) people posting ads impersonating us hiring translators on Upwork and in Facebook groups. The scam seems to be they "hire" the person, give them work, and then never pay them. Having zero cost of goods sold makes it possible to undercut on prices and pay for all your acquisition and still make a buck. Doesn't seem scalable or sustainable, but it has been a real nuisance for us. Translators are contacting us for their payment... Upwork has not been willing to help us at all. They pull the ads quickly so by the time support clicks the link, the ad is down. They act as if it didn't happen if the link doesn't still work. Crazy. There is a lot of fraud out there. Anything you can imagine and then quite a bit you can't if you don't spend your time thinking about how to screw others.
- markdown 4y ago> As engineers we really have no recourse. Upwork takes a commission, so they are benefitting financially from this fraud. You absolutely have recourse.
- ActionHank 4y agoUpwork is relying on the fact that all parties involved likely don't have the funds or care enough to pursue them legally. Given that they can define what options are available as far as recourse.
- RadixDLT 4y agoalways make sure the upwork profile has a blue check mark ( freelancer's identity has been verified )
- mzagaja 4y agoThis happened to me and I sent a notice to Upwork's legal department demanding a takedown. Using my likeness to make money is a violation of Massachusetts Right of Publicity law (https://www.dmlp.org/legal-guide/massachusetts-right-publicity-law https://www.dmlp.org/legal-guide/massachusetts-right-publici...) so I would be entitled to any profits made by Upwork for using my likeness. It is possible and likely your jurisdiction may have similar laws, and if your likeness is being used, do not hesitate to deploy them to expedite these takedowns.
- johnm212 4y agoI've been hiring on Upwork since 2007. I love the idea of being able to hire people with particular skillsets for a short time. For example, we had a unique issue with elasticsearch. We hired someone on Upwork with a Ph.D. and wrote a book on it. For a few hundred dollars, he was able to resolve our issue in a few hours. For every good experience, we have had about four bad experiences. The Upwork marketplace is filled with accounts pretending to be in North America and using fake photos. If you start looking at the profile pics on Upwork, you'll see they have the fake teeth from thispersondoesnotexist. We've accidentally hired some of these fake people. Not only can they code, but they are pretty good. Upwork usually freezes the contractor's account when they try to get their first payout and fail the identity verification. Then we get a request from the contractor to pay by Paypal. It's a mess. Here's the chat response from one of the contractors when they were found out: > OK, let me explain. > To be honest, i am based on China. > But i can complete the task really well. > But i can't work with high rate on upwork as Chinese. > I am really sorry for that. > You can confirm me through video call. > Anyway, i am really good developer in Bootstrap 4 and css3, Html5 and etc. > you can check my result. Upwork should be doing more to fix this. They are very aware of the issue. I once emailed their old CEO about the issue and got a reply from an assistant offering an account credit. I wish there was a good alternative!
- ghostly_s 4y agoYou've kept using this service for over 10 years despite a 1/5 success rate?
- sixhobbits 4y agoIt's a huge problem on some large dev slacks I am part of and one I used to help run. Someone will join and DM every existing member with a sob story about how he cannot join upwork because of his country of origin and asking to use theirs in exchange for 10% of profits he makes. Not sure if anyone actually responds positively to these DMs but I guess if they do it feeds into the same scam.
- __mharrison__ 4y agoI was just emailed by a "client" asking me why my responses on Upwork had such poor English when I've written multiple books... Turns out that someone was impersonating me on Upwork. I now have a call with a potential real client next week. I feel like I need to go cybersquat my identity everywhere now.
- pvaldes 4y agoThe root of the problem is that you uploaded an image of your face on Upwork. Somebody discovering how to use your own data against you, is just a matter of time.
- mdrzn 4y ago99% of the work offers I receive on Upwork are fake/spam/"contact me outside of this website" kind of deals.
- Slix 4y agoHow do I check if my identity is being used on Upwork? Can I see the names of people there without being registered?