How Scammers Are Stealing People's Identities With Fake Job Ads

This story was originally published on ProPublica by Cezary Podkul.

It has become a ubiquitous internet ad, with versions popping up everywhere from Facebook and LinkedIn to smaller sites like Jobvertise: Airport shuttle driver wanted, it says, offering a job that involves picking up passengers for 35 hours a week at an appealing weekly pay rate that works out to more than $100,000 a year.

But airports aren't really dangling six-figure salaries for shuttle drivers amid some sudden resurgence in air travel. Instead, the ads are cybercriminals’ latest attempt to steal people’s identities and use them to commit fraud, according to recent warnings from the FBI, the Federal Trade Commission and cybersecurity firms that monitor such threats.

The U.S. Secret Service, which investigates financial crimes, also confirmed that it has seen a “marked increase” in sham job ads seeking to steal people’s personal data, often with the aim of filing bogus unemployment insurance claims.

“These fraudsters, they’re like a virus. They continue to mutate,” said Haywood Talcove, chief executive of the government division of LexisNexis Risk Solutions, one of several contractors helping state and federal agencies combat identity theft. (ProPublica subscribes to public records databases provided by LexisNexis.)

This particular mutation is an emerging threat, Talcove and others said. The numbers are small so far, but they’re rapidly increasing. In March, LexisNexis detected around 2,900 ads touting unusually generous pay, using suspicious email domains and requiring that one verify one’s identity upfront.

The total had grown to 18,400 by July, and then to 36,350 as of this month. Talcove said these figures are based on a small sample of job ads and that the real number is likely much higher.

This form of scam is surging at a moment when targets for job application fraud abound. Millions of Americans are quitting jobs and looking for new ones.

An all-time high percentage of workers — 2.9% — quit their jobs in August, according to the U.S. Department of Labor. Meanwhile, huge numbers of laid-off workers are still looking for work, making for a historic churn in the labor market.

The ads reflect a tactical adjustment by cybercriminals. A massive wave of unemployment insurance fraud during the pandemic prompted authorities to heighten identity verification requirements.

In most U.S. states, cybercriminals can no longer simply input stolen identity information into government websites and frequently collect unemployment insurance aid.

Now, applicants whose names are used to apply for unemployment benefits often need to verify on their phones that they’re the ones seeking assistance, a process similar to two-factor authentication.

That means scammers may need help from their victims — and sometimes they go to elaborate lengths to mislead them. Some fraudsters recreate companies’ hiring websites. One fake job application site uses Spirit Airlines’ photos, text, font and color code.

The phony site asks applicants to upload a copy of both sides of their driver’s license at the outset of the process and sends them an email seeking more information from a web address that resembles Spirit’s, with an extra “i” (spiiritairline.com). Spirit Airlines did not respond to requests seeking comment.

Other job scams are less elaborate and have more visible signs of inauthenticity. One fake ad for airport shuttle drivers on Facebook was posted by a woman who purported to be working at Denver International Airport.

Diligent readers may have noticed that the only location linked from the woman’s Facebook profile was a Nigerian city called Owerri. (A spokesperson for the Denver airport reported the profile to Facebook after an inquiry by ProPublica, and the ad is no longer active.)

In other instances, unsolicited job offers simply land in applicants’ inboxes after they’ve uploaded their résumés to real job search sites, which scammers can access if they pose as potential employers.

Jeri-Sue Barron has received a slew of emails since the start of the pandemic informing her that she was preapproved for a variety of jobs she hadn’t even applied for. Barron, a retiree in suburban Dallas, had uploaded her résumé to several job hunting sites in hope of finding some part-time work to supplement her Social Security income.

She then received multiple job offers with nary a request for an interview. One email originated from a school in India’s Kerala state; another came from a Croatian website she’d never heard of.

“They started coming in from places that were weird,” said Barron. “You almost don’t want to find out the next stage.” She ignored the offers.

As with fake unemployment claims more broadly, the fraud is being facilitated by an underground infrastructure, including online forums where cybercriminals share advice on how to perfect their techniques.

A person using the handle “cleverinformation” on a U.K. forum called Carder put together a how-to video that recommends posting fake job ads using a generic job application that can be modified to collect personal data.

In September, someone going by “mrdudemanguy” on another forum, known as Dread, offered this advice to a person seeking stolen identities: “Pretend to be a local business and post some job ads. When they send in their résumé, call them and ask some basic job application questions.

Make them think they’ve got the job as long as they can do a background check. For the background check request they send you photos or scans of ID documents.”

In response to a query from ProPublica, mrdudemanguy did not answer questions about sharing fake ads and instead focused on explaining the source of his recommended technique and its success.

“I have not tried this method myself,” he wrote. “It’s just a method that I know other people do and it does work. It can be done in any part of the world, the country does not matter. As long as the job ad looks legitimate, a person looking for a job will be likely to apply.”

Questions sent to cleverinformation yielded a similar response. “It’s effective,” the person said, noting that it’s an underused technique. The person added: “Trying to start a group chat where we share our knowledge.”

The ubiquitous ad for airport shuttle drivers was discussed in a similar forum. One version of it was posted in a Telegram channel of a Nigerian scam group called Yahoo Boys Community, along with instructions on what to tell applicants to get them to share their Social Security number, photographs of their driver’s license and other personal details.

The post urged the group’s 5,000 members to ask applicants generic questions via email and offer them the gig — but only if they first shared their personal documents to land the plum job.

“Once the client gives you the details, buzz me on WhatsApp and let start work on it Asap,” read the July message, whose initiator could not be identified.

Job application scams have been around in various forms for years. Some entice applicants to buy equipment or software from the scammers in preparation for a nonexistent job. Others try to trick victims into working for free or reshipping goods bought with stolen credit cards.

But, according to law enforcement agencies, using fake job ads to steal identities and using them to cash in on government benefits is a new wrinkle.

Alexandra Mateus Vásquez fell for one such scam in December 2020. An aspiring painter, Vásquez was thinking of quitting her sales job at a suburban mall near New York City. She applied for a graphic designer position at the restaurant chain Steak ‘n Shake via the widely used job website Indeed.

She was elated when what appeared to be a Steak ‘n Shake representative invited her via Gmail to participate in an email screening test for the job.

Conducting an interview via email initially struck Vásquez as odd, but she proceeded because the questions seemed standard. They included queries like “How do you meet tough deadlines?” according to emails she shared with ProPublica, and she provided earnest answers.

Hours later she received an email offering her the job and asking for her address and phone number so a formal offer letter could be dispatched. The offered pay was attractive: $30 per hour.

When the letter arrived, it sought her Social Security number, too. Vásquez provided all the requested information.

Soon Vásquez was invited for a background check, via online chat, with a supposed hiring manager. She found herself trading messages with an account that had a blurry photograph of an old man and the name “Iran Coleman” attached to it. (Several other applicants described similar experiences in a discussion about the Steak ‘n Shake job on the hiring site Glassdoor.)

The person claiming to be the Steak ‘n Shake’s hiring manager requested copies of Vásquez’s personal records to verify her identity. She shared photographs of her New York state ID and her green card but grew suspicious when the person asked for her credit card number, too.

As Vásquez hesitated, she got a call from ID.me, an identity verification vendor used by 27 states to safeguard their unemployment insurance programs. The company asked if she was applying for jobless aid in California. That’s when she realized she was being scammed.

“I was so disappointed,” Vásquez said. “I really believed that that position was real.”

Steak ‘n Shake did not respond to messages seeking comment. (ProPublica was able to reach Iran Coleman, the purported Steak ‘n Shake manager cited in the scam. He said the Louisville Steak ‘n Shake he used to manage is closed and he hasn’t worked there since at least 2014. He said he hadn’t updated his cursory LinkedIn profile, which lists him as a Steak ‘n Shake restaurant manager, in years. Coleman said he now manages three Waffle House restaurants. “I feel for that person,” he said of Vásquez when informed of her experience.)

Vásquez reported the incident to the police and contacted the Social Security Administration, which informed her that it had denied multiple requests to create an account in her name. (A spokesperson for the agency said privacy laws preclude it from discussing individual cases.)

She then gave up on her job search. “I started doubting if all the jobs I’m applying for are real,” she said. Vásquez recently launched a website to begin selling paintings online and still hopes to become a design professional.

Blake Hall, chief executive of ID.me, said the company has rolled out language on its systems that informs users when their identities are being used to apply for unemployment insurance benefits and warns them not to proceed if they are being offered a job.

Hall said it’s ultimately up to users to heed such warnings. “We will do as much as we can to make it clear that they’ve been scammed,” he said, “but ultimately protecting somebody from themself is a really tall order.”

He compared his company to a goalkeeper who also needs help from other members of the team, in this case the job websites where criminals post fake ads.

The Better Business Bureau said in an alert last month that Indeed, LinkedIn and Facebook topped the list of online platforms where users reported spotting fraudulent job advertisements that duped them.

Indeed removes tens of millions of job listings that do not meet its quality guidelines each month, according to a company spokesperson, and it declines to list employers’ jobs if they do not pass those guidelines. In July, the site published a blog post detailing how to spot scam job ads.

“Indeed puts job seekers at the heart of everything we do,” the spokesperson said.

LinkedIn removed 10 fake airport shuttle job postings after they were pointed out by ProPublica. A spokesperson said that posting bogus job ads is a “clear violation” of LinkedIn’s terms of service and said the company is investing in new ways of spotting them, such as hiring more human reviewers and expanding a work-email verification system for potential employers.

Facebook took down some of the airport shuttle posts after ProPublica alerted the service, but the company did not respond to questions about its processes for spotting and removing fake ads.

In recent months, the social media platform has also been plagued with fraudulent pages masquerading as state unemployment agencies.

Some states complained to the U.S. Department of Labor that Facebook was slow to act on their requests to remove such pages, according to a March email from the department to state workforce agencies disclosed under a public records request.

A Department of Labor official said that in March the agency set up a new process for states to report fake unemployment insurance websites to Facebook and that “to date, Facebook has been responsive in taking down fraudulent pages” reported by states.

New ones, however, keep popping up: A fake version of California’s Employment Development Department Facebook page was live as of Oct. 12. The agency confirmed the page was not its own, and it was removed from Facebook shortly after ProPublica’s inquiry.

Even if online platforms clean up their job postings, other identity theft scams are proliferating.

On Oct. 15, the FBI issued an alert warning about fake websites that cybercriminals created to resemble the state unemployment websites of Illinois, Maryland, Nevada, New Mexico and Wisconsin.

Criminals use the sites to steal victims’ sensitive personal information, according to the FBI.

Photo by Martynas Marcenko on Unsplash