Watch Out for Crypto Scams

Family, friends, co-workers, bosses, retail employees; these are the people you interact with as you go about your week. Hopefully, most of the people you’ve encountered in your life are true Homo sapiens getting by, day by day, like you. Not all people are human though. Some of them are shapeshifters. Such beings never deliberately reveal their true forms. Therefore, you must hone your vision and sharpen your thinking to spot them. Only then will you begin to see the foxes and snakes that surround you.

Indeed, many YouTube advertisements are narrated by these deceitful creatures. These cunning animals also craft infomercials, send emails, and sell faulty cars so that they can get their filthy paws and jaws on your hard-earned money. Incapable of making, or unwilling to make, an honest living, con men have been convincing unsuspecting people to pay for ineffective or nonexistent products and services for centuries.

In today’s world, a relatively new type of scam is popping up more and more. These scams involve cryptocurrency. Remember that cryptocurrency, by definition, is a digital currency that is not regulated by any government. This type of currency can be traded internationally. The tricksters that operate crypto scams can take money from people that don’t even live in the same country as them. What’s more? Your government will most likely not be able to confront the scammers. Many international scammers operate in corrupt areas where unethical dealings are perfectly legal.

I have recently encountered one such scam. Fortunately, I’m the type of person that uses critical thinking, so I incurred no net financial loss in the process of dealing with the scammers. The story of my encounter is explained below, along with the methodology of the scam. The scam, which is likely still alive today, involves a fake job. In short, the scammers impersonate RudderStack and trick people into buying cryptocurrency and giving said money to them. RudderStack is a company that helps clients with their data infrastructure.

I was first contacted by an individual, who will be called “Olivia” for the purpose of this post, claiming to be an employee from a professional employment agency that I worked with. She texted me in late April. Normally, I don’t engage with texts from strangers. However, I had submitted my résumé to said employment agency in or around September of last year. I also met with two employees of the agency in-person to discuss employment opportunities. Each of the employees were located in a branch (read: building) that is close to where I reside. I specifically gave the company permission to contact me via phone. Again, I hardly interact with strangers.

Olivia asked if I’d be interested in a remote full-time or part-time role. I responded to her in the affirmative. She told me that the person in charge of the role will send me information via WhatsApp. I clicked on my phone number, which was a link to WhatsApp.

After being directed to WhatsApp, I met the scammer. The scammer will be called “Yiling” (she could have been a bot with a fake profile picture). She told me that Olivia recommended me to her. She then went on to tell me about the role of the job. Per her explanation, “Our job is to help Rudderstack merchants perform SEO engine optimization and obtain data optimization for all Rudderstack sellers. Provide every merchant with good real data, which can increase the merchant’s revenue.”

For this job, she described two types of tasks – normal tasks and “combination” tasks. She stated that the latter type of tasks grants higher commission than the former. She gave me the username and password of a training account. Then, she had me perform the tasks using the training account to get me acclimated to the job. After I demonstrated to have performed well on the tasks, she had me create my own account on the (illegitimate) “RudderStack” platform. 

After I created the account, Yiling told me that the commissions are sent to workers via the account. However, stated Yiling, in order to withdraw the payments from the “RudderStack” account, workers need to have a crypto wallet. She had me sign up to MetaMask and set up an ETH wallet so that I could receive the payment in crypto currency. Before signing up to create a MetaMask account, I had never in my life dealt with or handled cryptocurrency. In the “RudderStack” account, the profits are displayed as USDT. It is converted to Ethereum when it is transferred to MetaMask.

Yiling walked me through how to complete tasks with my own account. Tasks are completed in sets of 40. For the first set of tasks I completed on my own, all of the tasks were normal tasks. Afterwards, I encountered one of these so-called combination tasks. I got stuck and asked Yiling for help. She told me that she had already trained me on how to do the tasks. Combination tasks involve negative balances. When I used the training account, Yiling had me send Online Services 001 (@Rudderstask on Telegram) a snapshot to receive an address so that she could fix the negative balance. Once I was using my own account, I was lost on how to remove the negative balance. I asked her how to remove the negative balance. Yiling tells me something peculiar: I must get an address from Online Services 001 and submit it to my MetaMask account. Why? So that I could use my own money to offset the negative balance.

As soon as I heard that I’d be giving up my own money to provide funds for the “job,” a nasty whiff of rotten tuna infiltrated my nostrils. Startled, and holding a can of Febreze spray, I walked down the stairs to inspect the gross odor. Once I entered the kitchen, I spotted a pile of bright red flags. Suspicious, I started asking questions. I asked both Yiling and Online Services 001 if they were true RudderStack employees. They defended themselves with stubborn determination yet flimsy evidence. I requested the latter to provide me with an adequate reason why I ought help facilitate the transaction with my own money. OS 001 stated that the merchants needed the money to buy the items. Upon reading the silly explanation, I decided to forgo trusting these scammers.

Later, in mid-May, I sent a message using RudderStacks’ contact form. I inquired if RudderStack is in any way affiliated with https://www.rudderstack-entire.com/ (here is an image in case the scammers sneak off and change the site’s URL). I received an email the next day from a RudderStack employee stating that RudderStack is not in any way associated with the impersonating website. The employee stated to have alerted RudderStacks’ security team about the circulating scam.

“Thanks for reaching out. Unfortunately, we don’t engage with third-party recruiters or communicate via that website. It seems there’s a scam circulating, and I’ve alerted our security team.”

Don’t engage with third-party recruiters? Interesting. If Olivia is a scammer, how would she have known that I submitted an application to the employment agency last year? I never publicly published my dealings with the agency. Where did she get that info from? I’m not sure what to think of Olivia.

Yiling and OS 001, on the other hand, are definitely scammers. They lied when they claimed to be authentic RudderStack employees.

“Our job is to help Rudderstack merchants perform SEO engine optimization and obtain data optimization for all Rudderstack sellers. Provide every merchant with good real data, which can increase the merchant’s revenue. The operation method is also very simple. You only need to ‘click’ to increase the merchant’s product orders. Because the platform has an automatic conversion system, each click will automatically upload AI data for optimization, thereby increasing product sales and increasing the merchant’s credibility.” – Yiling, WhatsApp

The job itself is simple, you click items to increase orders for merchants.

When I first created my account, if I recall correctly, it had about $115 (USDT) stored in it. It was a “gift” from the company for signing up for the account using an invitation code. Yiling instructed me to withdraw the funds from my (impersonator) “RudderStack” account to my MetaMask cryptocurrency wallet. After the first set of tasks, I was required to transfer $100 of my own money from my MetaMask wallet to “RudderStack.”

Every worker (read: victim) is required to provide funds of at least $100 before they can start a set of tasks. Before transferring the funds from MetaMask to “RudderStack,” the worker must notify Online Services 001 to receive an address to validate the transaction. Proof of the transaction enables Online Services 001 to refresh or “reset” the set of tasks. Every time a set of tasks is completed, workers can withdraw the $100 they respectively put in plus the profit they made from completing the set. Therefore, I was profiting from the impersonating company for a short while.

After working five consecutive days, I received my $600 pay from the fraudulent company. I was notified of my reward by Online Services 001. I went on to start my second set of tasks for that day. Each set of tasks has 40 tasks that must be completed. In this set of tasks, I encountered a “combination” type of task. Each of these special types of tasks, unlike “normal” tasks, utilizes the victim’s funds in such a manner that leads to a negative balance in the “RudderStack” account. The unknowing victim of the scam must pay off the negative balance.

When I was completing my tasks, Yiling instructed me to withdraw my funds, along with my profit money, every time before starting a new set. However, she never warned me to take out the $600 reward before starting my next set of tasks. Nor did she tell me that a negative balance ranges from 30% to 150% of the victim’s funds; only after bombarding Online Services 001 with questions did I find that out.

If someone has $110 in their account – $100 from their own pocket and $10 from the profit they earned – and they encounter a combination task for which the negative balance is 150%, then they will have a negative balance of $165. Once they offset the $165 negative balance with their own money, their balance will be (positive) $275. If the remaining tasks are normal tasks, then the worker will be able to withdraw the $275 (plus some profit) from their account and put it into their crypto wallet.

On the contrary, if another combination task pops up, then the victim will have to pay the corresponding negative balance. Tasks are assigned randomly in every set. Therefore, the amount of combination tasks that appear in a set is determined by luck. The victim is unable to withdraw his funds and profit until the end of each set. If the victim runs out of funds before the set is complete, and can’t offset the negative balance for a combination task, then he is out of luck and will not get his money back until he offsets the balance and completes the set.

That is, at least, how I understand the process.

Ultimately, I trusted the fake “RudderStack” only because I received a text from what at the time looked like an employee from a legitimate staffing agency. I am aware that plenty of jobs that are advertised on Facebook, WhatsApp, Telegram, Reddit, and Craigslist are scams. Had Yiling contacted me directly via WhatsApp, instead of through Olivia (trusted agency middleman), I would have ignored her.

In late 2023, I gave the agency permission to text me if they find a job that I may be interested in. The employment agency has my number in their database since I provided it in the account I created on their website. Not once have I ever posted publicly (e.g. via LinkedIn or Indeed) my relationship with the agency. Nor did I list the company on any résumé. Also, a legitimate RudderStack employee told me that RudderStack does not work with third-party recruiters. As of now, I’m not sure if Olivia was a real employee of the staffing agency.

I was not born yesterday. Scams abound in the digital age. I am aware that each person has the responsibility to remain vigilant and prevent themselves from falling for scams. For example, if you get a random text message about a prize from a corporation like Wal-Mart or Albertsons, you know it’s an impersonator if you have not signed up to receive messages from the retailer. Retailers never send text messages out-of-the-blue to customers.

Also, with regards to scams, people are advised to not interact with messages from individuals or organizations that they don’t know. Had I been contacted by an employee from another employment agency, I would have ignored the message.

As stated previously, we must keep our guards up against the devilish foxes and slimy serpents that attempt to dupe us into paying money. Below are some resources that will serve as reminders of how to spot scams.

• It’s safe to assume that no legitimate company will ever pay employees using cryptocurrency, be it Ethereum (ETH), Ripple (XRP), or any other unregulated form of digital currency.

• Look at the pay of the job and compare it to the salary provided by similar jobs. For example, if a company is looking for an entry-level software engineer in California and lists a pay of $250,000/year, then that is a red flag. Such positions in said state typically range from $60,000 to $80,000 per year.
• If the company has an email address, check the domain of the email address. A professional company will typically have a domain that links to a legitimate website. This excludes domain names such as @yahoo.com, @gmail.com, and @proton.me. Any layman can create an email address with those domains in less than 10 minutes. Examples of professional emails that are tied to legitimate websites would be admin@elegantthemes.com and admin@segment.com. The creation of those emails requires a host – Kinsta, Bluehost, SiteGround, etc. I know this from personal experience. I created username@swiftwriterj.com using HostGator.

• Check if the website that is shared by a recruiter matches that of the real company. I should have done this as soon as the scammer provided me with a link to the fake RudderStack website.
• Be wary of recruiters that require the purchasing of devices before the hire is made.
• Make sure the recruiter has a valid identity. Does (s)he have an email address that is tied to the company’s website?
• Does the hiring manager offer interviews via phone and/or webcam? The person or scam bot, called Yiling in this post, who lied to me did not. Text-only interviews are red flags; even worse, no interview process whatsoever. I currently work remotely for a company that helps train artificial intelligence. A recruiter contacted me about the company via a sponsored message on LinkedIn. I applied for a position and attended a webcam interview via Zoom.

• If you are partnering with an employment agency, and you suspect that a client (employer) they direct you to is fraudulent, then ask an employee from the agency how they verify the legitimacy of clients. For you American citizens, a real company will be able to provide a tax form such as a W4 or 1099.