Job and task scams

What it is

A job scam inverts employment. Instead of being paid for work, you pay to keep working.

The offer arrives by text or on social media: flexible remote work, no experience needed, paid daily. The tasks are trivial and slightly odd — rate apps in an app store, “optimise” hotel listings, like products, complete sets of clicks. Small commissions accumulate, and at first they really are paid out. That is not a glitch; it is the product.

Then the account goes into deficit. A “combination task” or a “premium set” requires more capital than the balance holds, and the platform will not release accumulated earnings until the deficit is cleared. The only way forward is to deposit your own money — and the amounts grow, because each deposit is framed as the last step before withdrawal.

The numbers have moved sharply in two directions. Canadian losses rose from C$9.5 million in 2021 to C$48.9 million in 2024, more than fivefold, while report counts fell — meaning loss per victim quadrupled. Australian reports doubled in 2025, with losses up 81.5% to A$24.8 million. US employment fraud losses went from $70.2 million in 2023 to $362.9 million in 2025.

How it actually works

1. An unsolicited offer

   A text from an unknown number, a WhatsApp message, a comment reply, an Instagram DM. No CV, no interview, no company you can look up in any meaningful way. Australia’s data shows online contact producing three times as many loss reports as other channels.

2. Trivial tasks, real payouts

   Rate apps. Like listings. Book imaginary hotel rooms. Complete a set of thirty clicks. Small commissions appear in the platform balance, and early withdrawals clear to a real bank account.

3. The first withdrawal works

   This is the hinge, exactly as it is in pig butchering. A payout that arrives converts belief into personal experience, and it is the cheapest credibility the operation can buy.

4. A negative balance appears

   A “combination task” or “premium order” costs more than the account holds. The balance goes negative. Earnings are frozen until it is cleared.

   Where it could have stopped

   No job requires you to deposit your own money to unlock earnings, and no legitimate work platform can put your account into deficit. The mechanism exists so that you fund your own supposed wages. The moment a deposit is required, the “job” has told you what it is.

5. Colleagues encourage you

   A group chat of fellow workers, most of whom are part of the operation, sharing screenshots of their own withdrawals and reassuring you that the deposit always comes back. Social proof one recruiter cannot manufacture alone.

6. Escalating deposits

   Each one is the final step. Each one reveals another. Some victims borrow, and the operators suggest it — the FBI’s April 2026 takedown describes scammers pushing people to borrow from friends and family and take out loans.

7. Sometimes, a mule role

   The “job” becomes receiving payments into your own account, keeping a percentage and forwarding the rest. At that point you are a money mule, with criminal exposure of your own, whether or not you understood.

Why it works

It arrives where a real offer might. Recruiters do contact people cold on LinkedIn and by text. Gig work is genuinely advertised this way. The scam does not need an implausible premise, only a plausible one.

It targets people who need the work. Australia’s figures make the targeting visible: the largest increases were among people aged 25 to 34, and among First Nations, disabled and culturally diverse communities — up 76%, 114% and 51% respectively. This is not random dialling.

The early payouts are real money. Withdrawing $40 successfully is not a trick you can spot; it happened. Everything afterwards is evaluated against that experience.

The tasks are meaningless, which makes them plausible. People broadly believe the internet is full of pointless paid engagement work, because it is. “Rate these apps” does not sound absurd.

Deposits are framed as capital, not payment. You are not buying anything; you are temporarily funding an order that will return with commission. That framing survives a surprising amount of scrutiny.

Sunk cost does the rest. Each deposit makes the frozen balance larger and abandoning it more expensive, and by the time borrowed money is involved, stopping means an admission that is harder than paying.

Where it comes from

A substantial share of task scams aimed at English-speaking countries runs from the Southeast Asian compound network that also produces pig butchering — the same operations, the same buildings, a different script. The FBI’s April 2026 coordinated takedown, which produced at least 276 arrests, describes operators encouraging victims to borrow from friends and family and take out loans, which is the same escalation logic applied through a job rather than an investment.

That connection matters for how the scheme reads. The person messaging about the job is frequently themselves a trafficked worker in a compound, meeting a quota. The UN estimates at least 300,000 people have been drawn into these operations from 66 countries — many of them recruited, in the first place, by a job advertisement.

There is also a West African strand, particularly around the mule-recruitment variant, where the “job” is receiving and forwarding payments. The Connecticut case below describes exactly that: a scheme combining business email compromise and romance fraud in which elderly victims were exploited to serve as unwitting money mules.

Real cases

Red flags

• Any requirement to deposit your own money. This is the scam in one sentence. There is no legitimate version.
• An account that can go into deficit. No employer can put you in debt for doing work.
• An unsolicited offer by text, WhatsApp or DM, with no CV, no interview and no verifiable employer.
• Tasks that produce nothing — rating apps, liking products, “optimising” listings you cannot see.
• Early small payouts. Treat these as evidence of the scheme, not against it.
• A group chat of enthusiastic colleagues confirming that deposits always come back.
• Payment in cryptocurrency, or a requirement to open a crypto account to be paid.
• Being asked to receive money and forward it, for any reason, keeping a percentage.
• Being asked to open a bank account “for the company”, or to add someone to yours.
• Upfront costs for training, equipment, software or a background check.
• A company name that has a website and nothing else — no registration, no address, no employees findable anywhere.

If it’s happening to you

If you have deposited nothing. Stop and block. There is nothing to recover and nothing to negotiate. Report the account or number to the platform it arrived on.

If you have deposited money.

1. Do not make the final deposit. There is no balance to release. This is where most of the total loss happens.
2. Call your bank today and report it. Recent transfers may be recallable.
3. If you paid in cryptocurrency, send the transaction hashes to the receiving exchange immediately.
4. Screenshot everything — the platform, the balance, the chat, the recruiter’s profile, the payment instructions — before you are removed from the group.
5. Report it. See where to report.
6. Expect a recovery approach. See recovery scams.

If you received and forwarded money for them. This is the part people delay dealing with, and delaying makes it worse. You may have been used as a money mule. Stop immediately, do not send anything else on, keep every message showing what you were told, and report it yourself — proactively raising it is a materially better position than having your bank find it. Expect your account to be frozen while it is investigated; that is normal and is not an accusation.

Checking an offer before you take it. Look the employer up independently — a company register, not their own site. Ask for a contract with a legal entity name on it. Note that no legitimate employer asks for money, cryptocurrency, or the use of your bank account, and that a real recruiter will happily speak to you on a video call from a company domain.

Where the money goes

Deposits go straight out. Most task platforms take payment in cryptocurrency, which is why so many victims are walked through opening an exchange account as part of “onboarding” — the operation needs the rail, and getting the victim to build it themselves is easier than explaining it later.

Where deposits go by bank transfer, they go to mule accounts and move within hours, often into crypto at the second hop.

The mule variant is different in kind: there, the victim’s own account is the infrastructure. Money from an unrelated fraud — a business email compromise, a romance scam, a benefits fraud — lands in their account and is forwarded, and the fee they keep is the wage. That is why prosecutors describe these victims as unwitting mules rather than as employees.

By the numbers

No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.