Online Job Scam: Payment Transfer Scams and How They Operate

Report home | Read the report (PDF) | Previous section | Next section


Payment transfer scams begin with a con artist that pretends to be an employer. The con artist uses a job ad to lure in an unsuspecting job seeker, or they may use information from a resume they have found. The con artists can be quite convincing, and may even steal company names and corporate logos to convince victims that they are legitimate. After the con artist has won the job seeker’s trust, the con artist tricks the job seeker into giving up bank account numbers. The reasons given for this can be clever. One common reason the con artists give out is to say they only deliver paychecks by “direct deposit.”

The “job” a job seeker will be asked to do involves forwarding or wiring money from a personal bank account, a PayPal account, or from a Western Union office to another account or person. The other account or person is often overseas. The job seeker is instructed to keep a small percentage of the money as their payment. Sometimes the payment for making the money transfer is as low as $15, sometimes it is as high as several hundred or several thousand dollars. Almost always, the money the victims are transferring is stolen, and therefore, the victims are committing theft. Usually, this kind of scam involves at least two or three victims.

The amounts tranferred in this kind of scam are usually just under $10,000. In Appendix A, there is a good example of this kind of request in an email from the scam artists to a victim. The instructions are to wire $9,600 and keep $480. Transfers in amounts under $10,000 are subject to less scrutiny from banks than amounts over $10,000.

There are many variations of payment scams, but following are the basics of how a payment forwarding scam works:

1. The con artist poses as an employer, sometimes very convincingly. Often, names of real companies are used, and real corporate logos may be stolen from Web sites to make the scam look convincing. The con artist gains access to a job site or job distribution network, and they post multiple fraudulent ads. Con artists may also illicitly gain access to resume information.

2. Multiple victims are recruited through the online job advertisements. The job ads are typically for an accountant or finance manager.

3. After the victim sends the fake employer a resume, the fake employer contacts the victim and goes through a convincing interview process with them. Victims say that this process is extremely credible. The con artist eventually over time lures the victim to give up their bank account number and other personal details.

4. After victims are asked to give their bank account numbers for direct deposit of paychecks.

5. The bank account numbers of some of the victims may be used access their accounts and steal money.

6. The stolen money is used to rapidly purchase goods, often from online sites.

7. A last victim is chosen. This last victim is wired the stolen money from the first set of victims and told it is their (the last victim’s) paycheck or a similar excuse. They are told to keep a percentage of the money and transfer the rest to a new account that the con artist gives them. The transfer may take place at a bank, or often, in person at Western Union, or via a PayPal account.

8. The moment the last victim transfers the money, they have unwittingly committed theft because they have transferred and taken stolen money. These victims are further victimized if they are then arrested for theft, which is a real possibility.

Again, many variants of this scam exist. One variant is related to money laundering of stolen credit card numbers instead of stolen bank account numbers. Victims will be told they are processing payments for “domestic sales” of an overseas company, often located in Europe or China. The victim gets deposits into their bank account or a PayPal account, then they are told to forward the money, usually in person, at Western Union. Like in the first variant, the moment the victim transfers the money from the stolen credit cards, they have committed a crime.

The World Privacy Forum has spoken to numerous victims of payment transfer scams, and have found that a good con artist can ensnare even the most knowledgeable financial professionals in these scams before becoming aware of any problems. The key is that even the most reasonable person, given a lack of expertise in computer crime, will typically not understand the complexity of the crime and is typically not equipped with enough information to walk away from the scam in time. [3] The victims of this scam that transfer the money can no longer count on forgiveness.

Note: Another type of scam closely related to payment forwarding scams are the “Postal Forwarding” scams. In this scam, stolen money is used to purchase goods. Those goods are sent to a victim who believes he or she has gotten a job as a shipping or receiving clerk. The victim then forwards the stolen merchandise to an address, usually overseas. The US Postal Inspector General has detailed information about Postal Forwarding scams available at its Web site:< >.






[3] See for example a student described in a New York Times article on job fraud victims. New York Times, “Fraud in Online Job Listings” Bob Tedeschi, May 17, 2004. The student did forward stolen money unwittingly.



Roadmap: A Year in the Life of an Online Job Scam – A Longitudinal Study: II. Payment Transfer Scams and How They Operate


Report home | Read the report (PDF) | Previous section | Next section