A fake recruiter. Either you pay for equipment or training that does not exist, or you are recruited to move money and goods for someone else.
The first version is simple: a role that pays unusually well, a hiring process that never involves a real interview, and a request for money — for equipment, training, a background check or a deposit.
The second version is worse. The job is real, the pay arrives, and the work turns out to be receiving transfers, holding parcels or opening accounts in your own name for someone else.
The recruitment version
- Contact arrives unbidden on WhatsApp, Telegram or a social profile, not through an application you made.
- The interview is a text chat or an interview over an unusual app, without any conversation with a person who knows the field.
- A contract is provided immediately, often with a logo taken from a real company's site.
- Money is requested early: 'reimbursed with your first salary'. A genuine employer never charges a candidate.
The money mule version
- The work is described in vague terms: 'process payments', 'receive and forward packages', 'handle customer transfers'.
- You are asked to use your own bank account, or to open a new one, to move money that is not yours.
- You are offered a commission for each transaction — the commission is the bait, and the transactions are the crime.
- Parcels are sent to your address for you to forward, which is how stolen goods are moved across borders.
This version is the more dangerous of the two, because it is the one that can leave you facing a criminal investigation rather than a lost deposit.
How to check an offer
- 1Check the domain of the email against the company's own website. Lookalike domains are the standard tool here.
- 2Call the company on a number published on their own site — never a number from the message — and ask whether the person and the vacancy exist.
- 3Refuse any payment, in any form, at any stage, including 'refundable' fees.
- 4Never receive money or goods for someone else through your own accounts or address.
- 5Run unfamiliar links and domains through a checker before you click, and read the domain immediately before the first slash.
Frequently asked questions
They sent a contract with a real company's logo. Isn't that proof?
No. Logos and contracts are copied from company websites in minutes. What matters is the domain the email came from and whether the company itself confirms the vacancy.
The pay is high but the work sounds simple. That is just a good opportunity, no?
An offer that pays well above market for work anyone can do has to be explained. The usual explanations are that you are the product, or that the money is not clean.
I already forwarded one package. What now?
Stop, and keep everything: messages, labels, tracking numbers, payment records. Then speak to a lawyer or to the police before contacting the sender again, because your position depends on what you can show you knew.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.