In this guide 10 sections
At a glance
The short version.
Watch for
- A generic unexpected text with no specific role, location or relevant experience
- An interview conducted only by text on WhatsApp, Telegram or another messaging app
- Payment for liking, rating, reviewing or ‘optimising’ products
Already acted?
Tell your bank that a deposited cheque or transfer may be connected to a job scam.
See every recovery stepWhat is changing now
The current pattern.
A 2026 FTC alert describes generic recruiter texts that ask recipients to reply “YES” or “INTERESTED” before providing meaningful job details. Other current variants use messaging apps, simple rating tasks and dashboards that show invented earnings before demanding a deposit.
How it works
How the scam unfolds.
The contact promises flexible remote work, unusually high daily pay or simple online tasks. The recruiter may borrow the name and branding of a real company while using a personal email address, phone number or messaging account.
After a quick text-only interview, the scam moves toward money or identity. A fake cheque may supposedly pay for equipment, followed by instructions to send part of the money elsewhere. A task platform may show early rewards, then require a deposit, cryptocurrency purchase or fee to continue or withdraw.
Some fake employers collect identity documents and bank information through convincing onboarding forms. Real employment paperwork exists, but it should follow a vacancy and hiring process that you have independently verified with the employer.
Warning signs
Reasons to stop and verify.
- A generic unexpected text with no specific role, location or relevant experience
- An interview conducted only by text on WhatsApp, Telegram or another messaging app
- Payment for liking, rating, reviewing or ‘optimising’ products
- A cheque for equipment followed by instructions to pay a supplier or return money
- A deposit, training fee, crypto payment or negative task balance
- Requests for identity or banking information before the employer is independently confirmed
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
‘Emma’ · recruiter, Lumen Talent Group
Hi! I found your CV online1 (warning sign 1) and think you’d be perfect for a flexible remote role. Earn £300–£800 a day2 (warning sign 2) rating products from home in 60–90 minutes.
No experience needed. Interested? Reply YES3 (warning sign 3) and I’ll add you to the training group.
Three days later, inside the task app
Congratulations — you’ve unlocked a premium combination task! Your balance is now −£1,120.4 (warning sign 4) Top up with USDT to complete the set5 (warning sign 5) and release your £2,450 commission.
- Contact you did not ask for
Genuine recruiters do make cold contact, but they name a real company, role and process that you can check independently.
- Pay out of proportion to the work
Hundreds per day for simple online tasks is designed to excite rather than inform.
- A reply test
Asking you to reply confirms that your number is active and hooks you before any real details are shared.
- A balance the platform controls
The negative balance exists only in the scammer’s app. It makes paying look like a normal part of the job.
- Paying to get paid
A real employer does not ask workers to deposit money — least of all cryptocurrency — to unlock their own earnings.
Work that requires you to pay first is not a job. Stop before the first deposit: each later ‘task’ usually asks for more.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
Simple tasks turn into a negative balance
- 01The opening
An unexpected message offers flexible remote work rating products. A recruiter moves the conversation to a messaging app and provides a dashboard that credits a small welcome bonus.
- 02The escalation
Early tasks appear to produce earnings. A later ‘combination task’ pushes the balance below zero, and the worker is told to deposit cryptocurrency to finish the batch and unlock a larger commission.
- 03The decision point
The dashboard is controlled by the recruiter and is not proof of employment or earnings. Paying to remove a negative balance reverses the normal employer–worker relationship.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Locate the vacancy independently
Find the organisation’s real careers page and search for the exact role. A company name in a message is not proof that the recruiter represents it.
- 02
Verify the recruiter’s route
Match the email domain and contact process to the organisation’s published recruitment information. Personal email and messaging-only interviews require extra caution.
- 03
Map the money direction
List every requested payment, deposit, cheque, purchase or transfer. If applicant money must flow toward the employer or a nominated supplier, stop.
- 04
Delay sensitive onboarding
Provide identity, tax and bank details only after the employer, vacancy, contract and secure onboarding system have all been verified separately.
Prevention
Make the next attempt harder.
- 01
Keep a simple application log
Note where and when you applied. An offer for a role you never applied for is easier to recognise as unexpected.
- 02
Trim public CV details
Remove your home address and date of birth from public CVs and profiles. A phone number and email address are usually enough for a recruiter to reach you.
- 03
Verify before onboarding
Before sending identity or bank details, confirm the role on the company’s own careers site and speak with someone through its published switchboard.
- 04
Set a personal ‘no deposits’ rule
Decide in advance that you will never pay, deposit or buy cryptocurrency to start or continue work. The rule saves you from arguing with a convincing story later.
If you already acted
Protect access and contact the real provider.
- Tell your bank that a deposited cheque or transfer may be connected to a job scam.
- Stop adding money to a task platform, even if its dashboard says a larger payment will unlock everything.
- Change exposed passwords and monitor accounts if identity or banking information was submitted.
- Contact the real company whose name was used so it can warn applicants.
- Expect recovery offers or new job messages after disengaging; do not pay anyone who promises to retrieve funds.
Common questions
Short answers to real doubts.
The company named in the message is real. Doesn’t that make the offer genuine?
Scammers often borrow the names of real companies and recruitment agencies. Find the company’s careers page yourself, look for the exact role, and contact its recruitment team through published details to confirm that the recruiter works there.
I was paid a small amount at first. Why would a scammer pay me?
Small early payouts build trust and make the platform feel legitimate. They are usually far smaller than the deposits requested later. A real payment in the past does not make the next request for your money safe.
They sent me a cheque to buy equipment. What should I do?
Do not deposit it and send money on. A fake cheque can appear to clear and then be reversed days later, leaving you responsible for money you have already sent. If you have deposited it, contact your bank.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.