What this tutorial says in five lines
- A legitimate employer never requires a payment from you to give you work.
- Task-based "jobs" that require a deposit to unlock higher-paying tasks are fraud, every time.
- Overpayment refunds and equipment-cheque schemes are the same fraud with different framing.
- A recruiter who moves you off-platform immediately is avoiding a paper trail you could verify.
- Verify the company on its own site and by phone, never through the link the recruiter gave you.
Why this matters
Employment fraud is the most trusted delivery mechanism in this entire library, because it inverts the direction of the relationship. Nobody feels suspicious about being recruited; being chosen is flattering, and the first weeks look exactly like work. The stage where money moves always comes with a reason that sounds like an administrative detail. This tutorial covers the four shapes the fraud takes, and the one rule that makes all four impossible.
Why the job framing outperforms every other approach
Fraud that begins with an investment pitch meets an immediate defence. Fraud that begins with an offer of employment meets none, because the premise is ordinary: companies recruit, recruiters message candidates they found, jobs sometimes pay well and start quickly.
The other advantage is structural. An employment relationship legitimises requests that would otherwise be absurd. Asking a candidate for a deposit, a fee, a document purchase or a device payment is normal-seeming inside a job context and obviously wrong outside one.
One rule covers every variant: a legitimate employer never requires a payment from you in order to give you work. Not for training, equipment, verification, insurance or a deposit.
The four shapes
Each of these presents as a job, and each eventually requires you to send money or receive and forward money. The correct response is identical in all four.
The last two are distinguished by the direction of the initial payment, which is what makes them feel safer than they are.
| Shape | How it starts | The tell | What it ultimately wants |
|---|---|---|---|
| Task / deposit job | Easy online tasks, paid per task, then a "premium tier" appears | A deposit to unlock higher-paying tasks | Your deposit, permanently |
| Fake recruiter | A message on a job board or a social platform, an immediate offer | Interview is text-only, offer comes fast, no named humans you can reach | Personal data, then a fee for equipment or documents |
| Overpayment fraud | You are "hired", then paid too much and asked to refund the difference | A payment that is later reversed, with a request for part of it back | A transfer of your own money before the original clears |
| Equipment cheque | You are sent a cheque to buy your own work equipment | The cheque is for more than the kit, and the balance is to be returned | A refund of the difference before the cheque bounces |
| Payroll mule | Your "salary" arrives in crypto and you forward part of it | You are asked to move funds onward to a third party | Your account as a laundering channel — with legal exposure to you |
Why the task-job variant is the most common
The task-based job is the most efficient version because the first payments are real. Small amounts do arrive for completing trivial work, and that single experience of being paid legitimately is enough to carry the victim through the next stage.
This is the same trust device used by fake trading platforms, applied to employment. The chart below shows how the deposits escalate.
How the deposit demand escalates in a task-based job fraud
Relative index — amount required to "unlock" each tier
Reading: The first tier is free and genuinely paid. That is not generosity — it is the demonstration that makes every later deposit feel like an investment rather than a gamble.
The verification that works
You do not need to judge whether a particular recruiter is genuine. You need to confirm the job exists at the company they named, using a channel that did not come from them.
All four steps below are free, and the second one is where most of these operations fail.
- 01Find the company’s own website yourself — by search, not by the link you were given — and look for the role on its official careers page.
- 02Call the company’s published main number and ask whether the named recruiter works there. Recruitment rarely survives this call.
- 03Insist on a live video interview with a named employee who has an independent professional presence.
- 04Check the recruiter’s email domain character by character against the company domain. Free mail services are the standard tell.
- 05Never accept a role where any payment, deposit, purchase or transfer flows from you to them, in any direction, for any reason.
The single best test is a phone call to the company’s published number. It costs two minutes and it is the step these operations are built to avoid.
The mule trap, which has legal consequences
One variant deserves separate treatment because the harm is not only financial. If funds pass through your account or your wallet as part of the operation, you may be treated as a participant rather than a victim.
The signs are specific and worth recognising early.
- 01Your "salary" arrives in crypto, or as a transfer from a third party you have never heard of.
- 02You are asked to forward part of it onward, keep a commission, and not ask questions about the sender.
- 03You are asked to receive packages, use your own bank account for "client payments", or cash cheques for the company.
- 04You are told the arrangement must stay confidential and that discussing it with your bank will cause problems.
- 05The instructions involve urgency, unusual payment methods, or splitting amounts to stay under reporting thresholds.
If money is passing through your account on behalf of someone else, stop immediately and tell your bank. This is the point at which a fraud investigation can touch you directly, and the honest report you make now is what distinguishes you from a participant.
If you have already paid or forwarded funds
Act quickly and in this order, because the fastest-moving deadlines are financial.
- 01Contact your bank or card issuer immediately if you paid by card or transfer. Those dispute windows are the shortest available to you.
- 02If funds passed through your account, tell your bank what happened and that you were recruited into it — proactively, before they discover it.
- 03Record everything: the recruiter’s handles, the company name used, the addresses you were given, and every transaction hash.
- 04Report at IC3.gov and ReportFraud.ftc.gov, and report the job post to the platform where you found it.
- 05Do not accept any "recovery" offer that arrives afterwards. The same operation often follows up with one.
- 06Warn the job board or group where the listing appeared — the same operation runs many postings at once.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Turn the payment trail into a filed dispute
Enter the addresses and amounts once, and the Report Builder produces your bank dispute letter, complaint email and a police statement from the same details.
Primary sources and further reading
- FTC — Job Scams consumer.ftc.gov
- FBI IC3 — Employment Fraud www.ic3.gov
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.