Timeline: The Evolution of an Online Job Scam
This timeline represents a longitudinal study of a single job scam as it evolved from July 16, 2003 to July 7, 2004. The scam is a “payment forwarding” scam. Con artists tricked jobseekers by using a fake job ad asking for “accountants,” “agents,” or “finance managers.” The job was fake, but the scam was real — victims were tricked into sending personal account numbers to the con artists so paychecks could be “direct deposited,” then victims were fooled into transferring stolen money, which is a criminal offense.
Scam artists stay ahead of job sites by changing the company names the jobs are posted under. Researchers tied the changing company names together by applying to the jobs and comparing employment contracts, phone numbers, unique linguistic patterns in the ads, email correspondence from victims, and other items. When the scam was discovered, researchers notified all affected companies, which then took down the fraudulent jobs. The same job ads using the known fraudulent company names were reposted in some cases even after the ads had been taken down one or more times. As of July 7, 2004 this scam was still in operation. The timeline is set up as follows:
COMPANY NAME posted a job at (job site name) — city job posted at: file download
The company names that the job ad was posted under are in bold. Names researchers have linked to this scam include Unk Electronics, Macrocommerce Intersales, Nanjing Panada Electronics, Omega Inc., BestElectrics, and Antares Electronics. Cities where the job were posted appear next to the name of the job site that posted the ad. Victim events are marked in red. Each posting has some form of corresponding documentation. Listings containing a “PDF” link are those listings that have screen shots of the job listings and/or the job ad. To see the job ad, click on the PDF link and the file will download. If a job was reposted after it was known to be fraudulent, “job reposting” appears next to the date.
For the complete report and findings about this scam, please see http://www.worldprivacyforum.org/2008/07/report-year-in-the-life-of-an-online-job-scam/
UNK Electronics job scam makes first known appearance at PickaJob – job listing PDF
UNK Electronics, Inc. job scam posted at JobSpider- New York. job listing PDF
Victim of UNK scam
Victim arrested, indicted for felony theft
MACROCOMMERCE posted at Preferredjobs.com – Atlanta; PDF.
UNK CareerBuilder – Dallas, Oregon; PDF
UNK posted at Chicago Tribune (via CareerBuilder) ; Unk Chicago Trib listing PDF.
November 18 (approx.)
MACROCOMMERCE posted at PickaJob.com – Phoenix, AZ; Phoenix PDF.
-Victim of Nanjing Panada Electronics
-Victim of Nanjing Panada Electronics
Personal information stolen. Unknown consequences.
UNK posted at JobSpider – New York PDF. Jacksonville FL; PDF actual FL job ad ; PDF 2 of list; Houston Houston Job Ad PDF ; Nov. 24 JobSpider PDF ; Houston PDF 3. MACROCOMMERCE posted at Jobspider – Cincinnati; PDF
-Victim of UNK
-Victim of Nanjing Panada Electronics
MACROCOMMERCE posted at CareerBuilder – Los Angeles; PDF.
-Victim of MACROCOMMERCE
MACROCOMMERCE posted at Preferred Jobs – Cleveland; PDF.
MACROCOMMERCE posted at CareerBuilder – Seattle PDF
WPF first learns of scam when it is contacted by Nick Corcodilos of Asktheheadhunter.com about the scam via a jobseeker tip-off.
WPF begins research on the scam. Finds MACROCOMMERCE job active at Jobvertise – Miami; PDF. PickaJob.com – Wash. D.C., Denver, San Francisco, Phoenix; PDF. The WPF found active postings (already detailed in the timeline) at CareerBuilder, Job Spider, Jobvertise, and PreferredJobs. WPF Notified CareerBuilder, Pickajob, JobSpider, Jobvertise, Preferred Jobs of job scam and requested it be taken down.
Publication of WPF Consumer Alert (Jobseekers warned of jobs from Macrocommerce Intersales, Unk Electronics.) Alert was posted to site, sent to media. Consumer alert: http://www.worldprivacyforum.org/2006/06/consfraudalert1/. At the time the alert was published, the WPF only knew of job postings between November 20 and December 11, 2003.
NANJING posted at Monster.com, Unk ad tried as Nanjing Panada Electronics (email, Monster job #19846633)
January 4; job reposting of Macrocommerce
MACROCOMMERCE reposted at CareerBuilder – Portland Maine Maine Job ad PDF; PDF listing; Atlanta, Philadelphia, Minneapolis; PDF job reposting ; Job repostings on same page as news reports of fraud PDF.
-Victim, Jan. 6 from Maine, MACROCOMMERCE Ad
Bank account numbers stolen, SSN. CareerBuilder notified by jobseeker of job scam.
-Victim, fired from job due to victimization by MACROCOMMERCE job fraud
CareerBuilder notified by jobseeker of job scam.
January 8; job reposting of Macrocommerce
MACROCOMMERCE reposted at CareerBuilder -Minneapolis, Boca Raton, Kissimmee, Pompano Beach, Coral Springs, Miami Beach, Ft. Lauderdale, Lawrence, Massachusetts, Andover Massachusetts; PDF.
January 25; job reposting of Unk
UNK reposted at CareerBuilder – Kansas City; PDF.
Jobseeker email notifying World Privacy Forum of UNK ads exactly like MACROCOMMERCE showing up in Phoenix, AZ. (email)
ANTARES Antares Electronics, Inc. job ad makes first known appearance at CareerBuilder – Florida, Miami, Hollywood FL PDF
February 12; job reposting of Unk
February 19; job reposting of Unk
ANTARES posted at MSN Careers- Ft. Lauderdale, Washington State; ANTARES posted at AOL Careerbuilder – Ft. Lauderdale, Philadelphia, Coral Springs PDF ANTARES posted at CareerBuilder – Miami, Hollywood FL, Brementon, Yolo PDF
ANTARES posted at CareerBuilder – Seattle, Sacramento, Chicago, Detroit, Dallas, Orlando, Hollywood FL, Miami, Merrillville IN PDF
ANTARES posted at CareerBuilder – Philadelphia PDF
ANTARES posted at Jobvertise — Detroit, Philadelphia, Chicago, Dallas, Sacramento, Seattle PDF
ANTARES posted at Jobvertise – Philadelphia PDF
-WPF Notified of UNK victim awaiting trial.
ANTARES Jobvertise – Detroit PDF
ANTARES posted at CareerMag.com – Texas PDF
BESTELECTRICS posted at Jobvertise — New York City, San Francisco, Miami PDF
July 3; job reposting of Macrocommerce
BEST ELECTRONICS actively posted at Jobvertise PDF
MACROCOMMERCE actively posted at Jobvertise-powered site 18.104.22.168 – San Francisco, Indianapolis, Orlando, Dallas, Atlanta PDF
As of July 3 this scam was still operational. ANTARES Jobs were posted on Preferredjobs.com in Washington DC, Los Angeles, San Francisco, San Diego, Chicago, and Dallas. Other known job sites posting the ANTARES job ad include: AOL.com ,aftercollege.com , australiajobsite.com ,canadajobsite.com , careerspan.com, collegegrad.com (College Grad Job Hunter, Preferredjobs.com, Retiredbrains.com. Other known sites that posted Unk Electronics jobs during this time frame: dallasjobsite.com, jobs.pearlhaven.com, baltimore.4jobs.com, tutorgig.com.
Known Contact Names used in Scam
Known contact names used in this scam include:
Chan Hoi Wo: firstname.lastname@example.org (NANJING)
Wong Po Hang: Wong.Po.Hang@npehk.com (NANJING)
James Brownn (MACROCOMMERCE)
Thomas Becker: email@example.com (MACROCOMMERCE)
Thomas Becker firstname.lastname@example.org MACROCOMMERCE
Ral Fernando (UNK)
Andrew Stevenson email@example.com (ANTARES)
Note on Corporate Name-jacking
*Please note that Antares Electronics Ltd. is the name a legitimate company, as is Antares Technology Solutions. There may be other legitimate companies using the name “Antares.” It is an unfortunate fact of scams that the scammers steal company names or names very close to legitimate companies in order to appear “safe.” Additionally, Nanjing Panda is a legitimate company. Note that the scam company name was spelled very similarly to the real company name: Nanjing Panada is the scam spelling there is an “a” added into the name to confuse job seekers. At the time this report was published, Monster.com listed jobs from the real Antares employers. As of the last date checked, July 7, 2004, these jobs are not from fraudulent companies.