7 ms·

This is the appropriate place to share the following anecdote, which happened to a friend of mine (disclaimer - in the context of this comment and how I wrote i

This is the appropriate place to share the following anecdote, which happened to a friend of mine (disclaimer - in the context of this comment and how I wrote it I assume you will immediately notice the red flags, but I assure you these are only obvious in hindsight) My friend applied for, and got hired as, an external tester. The idea is: you get a web page and a task (e.g. order item xyz), you perform the task and you fill out a usability report, for example explaining which things you found obvious or where you ran into issues. The gig went fine for a week or two with dozens of assignments per day for all kinds of things. Then one of the tasks included opening a bank account at Bank X. This went fine without an issue, and my friend had to use personal data to open that account. She didn’t think any of it - at this point the trust level was high and after all she was supposed to test from an end users perspective, so it kind of made sense to her. Way later she was asked to apply for a loan, and she did. Of course she did not provide any personal details, but the data the company provided to her - but given how much time had passed she didn’t realize that these data were from the bank account she had opened in her own name. The money arrived, the attackers took it and vanished. As far as I can tell the scam was set up in a very sophisticated way, faking not only the job but the whole company, with the clear idea that only luring in one innocent person would be enough. And they succeeded. The worst thing besides the financial damage is the shame that comes with it, the „I can’t believe this happened to me“ moment - which is why I share this here: scams can happen to anybody, including your friends who „should know better“, including you.

notyourwork 3y ago
Hindsight? When I test our app, I don't use my CC, I ask the company for one or for mock data that would pass through the production system. I would never use my personal information to tie my personal finances to my employer for a work task. That's just setting yourself up for problems like your friend found.
- 0cf8612b2e1e 3y ago
  Considering how much personal data you have to give to a legitimate employer, seems like the scammers just invoked a lot of unnecessary effort in making the applicant fill out the loan paperwork themselves.
  - ShittyKickflips 3y ago
    Difference might be in voluntarily making bank account and applying for loan and impersonating person. One might be punishable as criminal offence, other as minor scam (not sure about proper legal terms). Also in certain jurisdictions it makes sense as different police units investigating certain crimes and scammers might be connected.
- pflenker 3y ago
  The trick here was that of course my friend did not use her own sensitive bank information to ask for the loan - she asked for test data, and the company provided her with data. What she did not realize is that the data they fed her were things she had created in her own name earlier in the scam. For example, she opened a bank account in her own name quite early, after some trust was built. The data she used for that didn’t seem that sensitive to her, and she made sure the account was not a paid one and so on. And she was right - that account in itself was not what screwed her over. Days to weeks, and dozens of assignments, later when she applied for the loan, the test data they provided to her upon her request were partly from that opening of a bank account. So from her perspective it was a competely new flow to test for an existing customer - the bank - with test data provided. They even changed the login data a bit so that it looked like a different account. Since this was framed to der as a test as close to reality as possible it didn’t seem off that the „test account“ showed her her own name. From the perspective of the bank it was an existing, verified customer applying for a loan. This was a really, really clever bit of social engineering.
  - ithkuil 3y ago
    I don't understand. What prevented the scammers from just performing all the same operations she performed using the data they had about her? They could have her run some gateway on her laptop so all network access would appear to come from her IP address. Is there some offline interaction that is required to open an account?
    - dylan604 3y ago
      plausible deniability? why commit the crime yourself when you can have someone else do it for you? also, the loan would probably only be offered to a US citizen while the scammers were most likely not. after reading about it, it sounds like a pretty good operation
      - chatmasta 3y ago
        Also if the bank requires any KYC process, she'll probably go through with it thinking that it's part of the "external test."
- riizade 3y ago
  Same. Expedia asked me to test production ticket booking flows using my personal credit card. It was a flow where you can use a special code to book a refundable ticket. I asked what happened if I forgot to refund it in time, or if something went wrong. "Don't forget!" I asked for a corporate card to test with and was denied. I refused to ever input my personal card. I think the team lead said I could use his, but I refused to use anyone's actual, real card. I was young at the time, and I'm glad I saw the red flags quickly enough and left.
- williamcotton 3y ago
  You probably don’t need ask anyone as I’ve found these almost always work in practice: https://developers.bluesnap.com/reference/test-credit-cards https://developers.bluesnap.com/reference/test-credit-cards
AceJohnny2 3y ago
Thanks for this story, and for mentioning the key point > at this point the trust level was high As your story demonstrates, this is really what these scams hinge on. It's scary sometimes how easily we can come to trust something. (on an unrelated note, I setup Monarch (Mint replacement) a couple days ago, which of course requires giving them financial credentials just so they can pull transaction history...)
kulahan 3y ago
I think about this a lot - wouldn't it be super easy to just pretend to be offering a job that pays a tiny bit more than most might expect, then steal all the personal data you inevitably hand over for employment reasons? It seems like a market ripe for exploitation
- CAPSLOCKSSTUCK 3y ago
  Rife
  - AnimalMuppet 3y ago
    Nope. Ripe for exploitation; rife with exploiters. Two different words for two different concepts.
  - deleted 3y ago
    [deleted]
- medstrom 3y ago
  For Swedish citizens, most of that data is already public. Addresses and everything. Exactly which data do you envision causing problems? It's not as if you can draw money just by knowing someone's bank account number.
  - brnt 3y ago
    Actually, you can, with a business account. You need to collect proof that you have permission, so that you can produce it when asked, but technically I can deduct money from any (national?) bank account right now with nothing more than the IBAN.
    - alwa 3y ago
      To do so fraudulently seems like a really good way to go to jail, though, no? And, as a requirement to hold your business account, the authorities know where to find you to put you there should the need arise?
LeafItAlone 3y ago
> Way later she was asked to apply for a loan, and she did. Of course she did not provide any personal details, but the data the company provided to her - but given how much time had passed she didn’t realize that these data were from the bank account she had opened in her own name. I’m confused about this. What information, if not her own, was used to acquire the loan? All of loans I have applied for (which is admittedly single digits over the course of my life) required my personal info. If she didn’t use hers for the loan, why did they need her at all after the bank account was set up?
- earthling8118 3y ago
  She opened the bank account and applied for the loan at separate times. So she wasn't aware that the loan being applied for was related to the bank account previously made.
  - pflenker 3y ago
    Exactly. From her perspective, she had Task A: open a bank account for client SomeBank, performed that task and way later had Task B, apply for a loan at SomeBank. It's not at all suspicious to perform those tasks for the same customer, and the "test data" given to her looked legit (it's because they were the actual data from Task A)
    - LeafItAlone 3y ago
      I still don’t get it. Presumably there’s more information needed to apply for a loan than a bank number, such as name, DOB, and address (and maybe SSN or other personal ID, depending on country). What data was used for that?
      - everforward 3y ago
        The bank presumably already has that from the KYC on the open account. I'm assuming that's the clever bit. The scammers got the victim to apply using their own personal data by hiding that fact behind the account number.
Scoundreller 3y ago
There is a company that kinda does this with online gambling. Basically has you signup for a bunch of online casinos to get the sign-on/referral promos, but say you're an undercover "tester" for the casino. Best I can tell, they'll ask you to open up a fresh bank account and coinbase account and they'll fund your buy-ins through USDC that you withdraw yourself. Casinos generally require some amount of play to get the bonus/commissions, so you're "testing" the functionality by playing slots (or they just takeover or remote-coach you on doing it). For sports, it's easy to coordinate off-setting bets that cancel each other out in aggregate at a slight loss. When spread across accounts, this won't be detected. They probably earn some referral fees on the coinbase and bank account signups too. It seems you do get paid for the work: they appear too above-board to have virtually zero victim complaints (like actual corporate year-ends on UK's Companies House, corps, mgmt that seem to be real people) and the fraud is just against the casinos. They'll subtly suggest you keep some payment at some of the casinos to withdraw or play, because if you play, the referrer often gets a cut of your losses. Nice way to get "natural" looking signups and geographically diverse signups that are hard to detect. I got an invite on Linkedin, and I had a bit of trouble trying to figure out the scheme, so there you have it. Didn't do the "interview" but it was surprisingly polished. Big money in gambling and Customer Acquisition Cost is huge.
- defen 3y ago
  I still don't understand the scam here - if they're giving you money, and you're losing it to the casino on slots, how do the scammers make money?
  - meheleventyone 3y ago
    The get a bonus for referring users (get $100 if you sign someone up that plays for xxx) and signing up (get $100 if you sign up and play for yyy) to the platform. The platform wants to attract gamblers but instead is getting people ‘doing a job’ that are probably significantly less sticky. Is that illegal or just against the T&Cs of the platform? Im not sure. I’m not sure how this makes money overall though since the reward money has to be balanced at the population level so the platform always comes out ahead. I suspect there’s an element of getting the employee to gamble with their own money with promises to pay that don’t materialise.
tiler2915072 3y ago
This is like a modern version of the red headed league
commandlinefan 3y ago
> the scam was set up in a very sophisticated way What I don't understand is... where the hell are the police on this stuff? Checking account fraud is ridiculously easy to pull off - if you know an account number, you can steal an arbitrary amount of money from a checking account. Why isn't it more common? Because the U.S. treasury department comes down like the wrath of God on people they catch doing it. Of course scammers are trying to set up scams and take advantage of people in various clever ways. We're _supposed_ to have police who make things very, very unpleasant for the people who do so, but as far as I can tell, they don't even care.
wutwutwat 3y ago
Your friend sounds like they are not telling you the truth, because applying for a loan requires a social security number and your friend would have noticed being given their own. Even if your friend was given information that was not hers, that’s not any better. To use someone else’s information to apply for a loan is identity theft and wire fraud. That would be why the fake company had your friend do all of it, because they didn’t want their systems or IPs linked to the federal offenses they were doing, and instead they conned your friend into committing the crime and taking the fall, because if the company packs up and vanishes after the payday, the story your friend gives to the Feds is going to sound like something they probably hear all the time “people who used fake names and a fake company that vanished tricked me into committing wire fraud I swear it wasn’t me” Your story smells fishy and not realistic imo, but that’s because I’ve known my SSN since I started working and filling out w4s at 14. I’d notice if someone gave me my own ssn to apply for a loan. I’d also never go apply for a real loan using my info or anyone else’s for some company asking me to. What other crimes did your friend commit on behalf of the mystery company?
junon 3y ago
A buddy of mine got the exact same "recruiter" cold-call message. Luckily we sniffed out the scam but I can totally understand why someone wouldn't pick up on it.

notyourwork 3y ago

Hindsight? When I test our app, I don't use my CC, I ask the company for one or for mock data that would pass through the production system. I would never use my personal information to tie my personal finances to my employer for a work task. That's just setting yourself up for problems like your friend found.

0cf8612b2e1e 3y ago
Considering how much personal data you have to give to a legitimate employer, seems like the scammers just invoked a lot of unnecessary effort in making the applicant fill out the loan paperwork themselves.
- ShittyKickflips 3y ago
  Difference might be in voluntarily making bank account and applying for loan and impersonating person. One might be punishable as criminal offence, other as minor scam (not sure about proper legal terms). Also in certain jurisdictions it makes sense as different police units investigating certain crimes and scammers might be connected.
pflenker 3y ago
The trick here was that of course my friend did not use her own sensitive bank information to ask for the loan - she asked for test data, and the company provided her with data. What she did not realize is that the data they fed her were things she had created in her own name earlier in the scam. For example, she opened a bank account in her own name quite early, after some trust was built. The data she used for that didn’t seem that sensitive to her, and she made sure the account was not a paid one and so on. And she was right - that account in itself was not what screwed her over. Days to weeks, and dozens of assignments, later when she applied for the loan, the test data they provided to her upon her request were partly from that opening of a bank account. So from her perspective it was a competely new flow to test for an existing customer - the bank - with test data provided. They even changed the login data a bit so that it looked like a different account. Since this was framed to der as a test as close to reality as possible it didn’t seem off that the „test account“ showed her her own name. From the perspective of the bank it was an existing, verified customer applying for a loan. This was a really, really clever bit of social engineering.
- ithkuil 3y ago
  I don't understand. What prevented the scammers from just performing all the same operations she performed using the data they had about her? They could have her run some gateway on her laptop so all network access would appear to come from her IP address. Is there some offline interaction that is required to open an account?
  - dylan604 3y ago
    plausible deniability? why commit the crime yourself when you can have someone else do it for you? also, the loan would probably only be offered to a US citizen while the scammers were most likely not. after reading about it, it sounds like a pretty good operation
    - chatmasta 3y ago
      Also if the bank requires any KYC process, she'll probably go through with it thinking that it's part of the "external test."
riizade 3y ago
Same. Expedia asked me to test production ticket booking flows using my personal credit card. It was a flow where you can use a special code to book a refundable ticket. I asked what happened if I forgot to refund it in time, or if something went wrong. "Don't forget!" I asked for a corporate card to test with and was denied. I refused to ever input my personal card. I think the team lead said I could use his, but I refused to use anyone's actual, real card. I was young at the time, and I'm glad I saw the red flags quickly enough and left.
williamcotton 3y ago
You probably don’t need ask anyone as I’ve found these almost always work in practice: https://developers.bluesnap.com/reference/test-credit-cards https://developers.bluesnap.com/reference/test-credit-cards

AceJohnny2 3y ago

Thanks for this story, and for mentioning the key point > at this point the trust level was high As your story demonstrates, this is really what these scams hinge on. It's scary sometimes how easily we can come to trust something. (on an unrelated note, I setup Monarch (Mint replacement) a couple days ago, which of course requires giving them financial credentials just so they can pull transaction history...)

kulahan 3y ago

I think about this a lot - wouldn't it be super easy to just pretend to be offering a job that pays a tiny bit more than most might expect, then steal all the personal data you inevitably hand over for employment reasons? It seems like a market ripe for exploitation

CAPSLOCKSSTUCK 3y ago
Rife
- AnimalMuppet 3y ago
  Nope. Ripe for exploitation; rife with exploiters. Two different words for two different concepts.
- deleted 3y ago
  [deleted]
medstrom 3y ago
For Swedish citizens, most of that data is already public. Addresses and everything. Exactly which data do you envision causing problems? It's not as if you can draw money just by knowing someone's bank account number.
- brnt 3y ago
  Actually, you can, with a business account. You need to collect proof that you have permission, so that you can produce it when asked, but technically I can deduct money from any (national?) bank account right now with nothing more than the IBAN.
  - alwa 3y ago
    To do so fraudulently seems like a really good way to go to jail, though, no? And, as a requirement to hold your business account, the authorities know where to find you to put you there should the need arise?

LeafItAlone 3y ago

> Way later she was asked to apply for a loan, and she did. Of course she did not provide any personal details, but the data the company provided to her - but given how much time had passed she didn’t realize that these data were from the bank account she had opened in her own name. I’m confused about this. What information, if not her own, was used to acquire the loan? All of loans I have applied for (which is admittedly single digits over the course of my life) required my personal info. If she didn’t use hers for the loan, why did they need her at all after the bank account was set up?

earthling8118 3y ago
She opened the bank account and applied for the loan at separate times. So she wasn't aware that the loan being applied for was related to the bank account previously made.
- pflenker 3y ago
  Exactly. From her perspective, she had Task A: open a bank account for client SomeBank, performed that task and way later had Task B, apply for a loan at SomeBank. It's not at all suspicious to perform those tasks for the same customer, and the "test data" given to her looked legit (it's because they were the actual data from Task A)
  - LeafItAlone 3y ago
    I still don’t get it. Presumably there’s more information needed to apply for a loan than a bank number, such as name, DOB, and address (and maybe SSN or other personal ID, depending on country). What data was used for that?
    - everforward 3y ago
      The bank presumably already has that from the KYC on the open account. I'm assuming that's the clever bit. The scammers got the victim to apply using their own personal data by hiding that fact behind the account number.

Scoundreller 3y ago

There is a company that kinda does this with online gambling. Basically has you signup for a bunch of online casinos to get the sign-on/referral promos, but say you're an undercover "tester" for the casino. Best I can tell, they'll ask you to open up a fresh bank account and coinbase account and they'll fund your buy-ins through USDC that you withdraw yourself. Casinos generally require some amount of play to get the bonus/commissions, so you're "testing" the functionality by playing slots (or they just takeover or remote-coach you on doing it). For sports, it's easy to coordinate off-setting bets that cancel each other out in aggregate at a slight loss. When spread across accounts, this won't be detected. They probably earn some referral fees on the coinbase and bank account signups too. It seems you do get paid for the work: they appear too above-board to have virtually zero victim complaints (like actual corporate year-ends on UK's Companies House, corps, mgmt that seem to be real people) and the fraud is just against the casinos. They'll subtly suggest you keep some payment at some of the casinos to withdraw or play, because if you play, the referrer often gets a cut of your losses. Nice way to get "natural" looking signups and geographically diverse signups that are hard to detect. I got an invite on Linkedin, and I had a bit of trouble trying to figure out the scheme, so there you have it. Didn't do the "interview" but it was surprisingly polished. Big money in gambling and Customer Acquisition Cost is huge.

defen 3y ago
I still don't understand the scam here - if they're giving you money, and you're losing it to the casino on slots, how do the scammers make money?
- meheleventyone 3y ago
  The get a bonus for referring users (get $100 if you sign someone up that plays for xxx) and signing up (get $100 if you sign up and play for yyy) to the platform. The platform wants to attract gamblers but instead is getting people ‘doing a job’ that are probably significantly less sticky. Is that illegal or just against the T&Cs of the platform? Im not sure. I’m not sure how this makes money overall though since the reward money has to be balanced at the population level so the platform always comes out ahead. I suspect there’s an element of getting the employee to gamble with their own money with promises to pay that don’t materialise.

tiler2915072 3y ago

This is like a modern version of the red headed league

commandlinefan 3y ago

> the scam was set up in a very sophisticated way What I don't understand is... where the hell are the police on this stuff? Checking account fraud is ridiculously easy to pull off - if you know an account number, you can steal an arbitrary amount of money from a checking account. Why isn't it more common? Because the U.S. treasury department comes down like the wrath of God on people they catch doing it. Of course scammers are trying to set up scams and take advantage of people in various clever ways. We're _supposed_ to have police who make things very, very unpleasant for the people who do so, but as far as I can tell, they don't even care.

wutwutwat 3y ago

Your friend sounds like they are not telling you the truth, because applying for a loan requires a social security number and your friend would have noticed being given their own. Even if your friend was given information that was not hers, that’s not any better. To use someone else’s information to apply for a loan is identity theft and wire fraud. That would be why the fake company had your friend do all of it, because they didn’t want their systems or IPs linked to the federal offenses they were doing, and instead they conned your friend into committing the crime and taking the fall, because if the company packs up and vanishes after the payday, the story your friend gives to the Feds is going to sound like something they probably hear all the time “people who used fake names and a fake company that vanished tricked me into committing wire fraud I swear it wasn’t me” Your story smells fishy and not realistic imo, but that’s because I’ve known my SSN since I started working and filling out w4s at 14. I’d notice if someone gave me my own ssn to apply for a loan. I’d also never go apply for a real loan using my info or anyone else’s for some company asking me to. What other crimes did your friend commit on behalf of the mystery company?

junon 3y ago

A buddy of mine got the exact same "recruiter" cold-call message. Luckily we sniffed out the scam but I can totally understand why someone wouldn't pick up on it.