You got a message about a remote job. The pay is decent, the work sounds easy, and they want you to start soon. Is it real?
That question matters more when money is tight, which is exactly when scammers like to show up. A recent FBI warning shows how far these schemes go. In some of them, the “job” is you, and what the scammer wants is your home, your accounts and your identity.
What happened
According to a Korea Daily report on an FBI public safety alert, North Korean IT workers are using fake freelance listings to get into companies. They also approach people who are struggling financially with offers of easy remote tasks. The FBI says the money funds North Korea’s military and weapons programs.
The people recruited are often called proxies. Many don’t know they’re helping a foreign operation. According to the report, a proxy might:
- attend video interviews in place of the real applicant,
- rent out their social media accounts, or
- help verify fake identities.
The report also describes “laptop farms.” A proxy sets up a company-issued work laptop at home and connects it to the internet. Workers overseas then log in remotely and appear to be working from inside the United States. The report says some of the real coding is handed to low-cost freelancers in countries like Pakistan, India and Nigeria, while the North Koreans keep most of the wages.
It gets worse. The report says fired workers have threatened former managers and their families, and have threatened to leak company data and source code unless they were paid. Investigators have also seen attempts to get active-duty US service members to receive and store work laptops on military bases.
The alert is about the United States, and the report doesn’t mention Canada. But a fake job post doesn’t care about borders. Anyone who answers an online ad can get this pitch, and the red flags below apply to any remote job scam in Canada.
How to tell if it affects you
You don’t need to be a programmer. The report says proxies are recruited with “easy” tasks. Ask yourself whether any of this sounds familiar:
- You’re asked to receive a laptop or other equipment at your home and keep it plugged in and online.
- You’re asked to let someone else log in to that device remotely.
- You’re asked to sit in an interview or video call on someone else’s behalf.
- You’re asked to lend, rent or share a social media, email or professional networking account.
- You’re asked to help “verify” someone’s identity, or to hand over your own ID early.
If any one of those fits, stop. A real employer hires you to do the work yourself. It doesn’t need your address, your face or your accounts for somebody else’s use.
Red flags in a remote job offer
Some of these come straight from the FBI report. Others are standard fraud advice that I’d give anyone.
- The offer finds you. You didn’t apply, but a recruiter messages you with a vague, well-paid role. The FBI says operatives approach people directly.
- The work is oddly simple. Easy tasks, high pay and little screening don’t go together.
- You’re asked to receive equipment. This is the laptop farm pattern described above.
- You’re asked to move money. This one isn’t in the FBI report, but it’s a long-standing fraud pattern. Any job that has you receive payments and send them on, or deposit cheques and forward the difference, should end the conversation right there.
- Your accounts are part of the job. No legitimate role needs access to your personal accounts.
- The company can’t be verified. Look up the business yourself, not through links in the message. Check that the recruiter really works there by contacting the company through its official website.
- Pressure to move fast or move chats. Rushing you, or pushing you onto a private messaging app, is a common way to keep you from checking.
What to do today
- Don’t ship, forward or install anything. If equipment has arrived, don’t connect it to your network or let anyone remote into it. Set it aside.
- Keep every message. Screenshot the job post, the chats, the emails and any payment details. You’ll need them if you report it.
- Stop talking to them. You don’t owe them an explanation. Don’t confront them.
- Verify the employer independently. If you think the job might be real, find the company’s official website yourself and ask them to confirm the role.
- Change passwords on anything you shared. Use a unique password for each account, and turn on multi-factor authentication where it’s offered.
- Report it. Tell the Canadian Anti-Fraud Centre and your local police. The FBI urges the public to report suspicious job offers right away.
Signs something already went wrong
If you’ve already shared an account or details, here’s what a SOC analyst would check first. When we review sign-in activity after a suspected takeover, we look for things that don’t fit your normal pattern. You can check most of this yourself in your email or account security page.
- Sign-ins you don’t recognize. Look for unfamiliar locations, devices or times. A login from another country while you were at home is a clear warning.
- Verification codes you didn’t request. If you get multi-factor prompts out of the blue, someone probably has your password and is trying to get in.
- Password reset emails you didn’t ask for.
- New devices or apps connected to your account. Remove anything you don’t know.
- Email rules you didn’t set. Attackers sometimes set up forwarding or auto-delete rules to hide what they’re doing. Check your mail rules and forwarding settings.
- Messages sent from your account that you didn’t write. Friends may tell you before you notice.
- Unexpected remote-access software on your computer. If you installed something because “the employer” asked, remove it and treat the computer as untrusted.
- Money moving through your bank account that you don’t understand. Call your bank right away, using the number on your card.
If an account was rented out, sharing is the problem, not just the password. Change the password, sign out of all sessions and check the recovery email and phone number on the account. Make sure they’re yours.
When to get help
Get help right away in any of these cases:
- You received a company laptop or hardware and don’t know who really owns it.
- You attended an interview or call under someone else’s name, or gave out your ID.
- Money moved through your account.
- You’ve been threatened or pressured to keep going.
Contact your bank and the Canadian Anti-Fraud Centre, and go to the police if you feel threatened. If you’re locked out of an email or social account, use that provider’s official recovery process. If you already work for a company and think a colleague may be a fake hire, tell your manager or IT team. The report says these rings are run by organized teams, so don’t try to handle it alone.
Being fooled by a polished job ad is not a character flaw. These schemes are built to look ordinary. What matters is what you do once you spot the pattern: stop, save the evidence and report it.
Sources
Featured image: Image by StartupStockPhotos from Pixabay.
