Fake work-from-home jobs: recognise money-mule recruitment and respond to unfamiliar funds
An easy work-from-home offer may actually move money obtained through fraud. You may be told to forward it, withdraw cash, buy cryptocurrency or hand over banking access.
What happened?
The response depends on whether you only saw an offer, shared information, granted account access or already handled someone else’s funds.
I only found the offer
It promises high pay, home working or simple financial tasks.
See the steps →I sent personal details or documents
You sent an ID, selfie, address, phone number or other personal information.
See the steps →I opened an account or shared access
Someone obtained a password, device, card, authorisation code or remote access.
See urgent steps →I received or forwarded someone else’s money
A payment arrived from someone unknown, or funds were already sent, withdrawn or exchanged.
See urgent steps →What is a money mule?
Someone whose account or identity is used to receive, move or conceal criminal funds. The reward may be described as a commission for easy work.
Personal bank account
Payments arrive from unfamiliar people or sources you cannot explain.
Forwarding or withdrawal
You are told to send the money on immediately, withdraw it or exchange it for cryptocurrency.
Commission
You may keep part of the payment as a fee for “processing” it.
Concealing the organiser
The account or registration in your name is visible in the payment trail.
If unfamiliar funds arrive
Leave the funds untouched and explain the full situation to your bank. Do not return them to a different account supplied by the supposed recruiter or sender.
Official guidance linked belowHow a fake job usually starts
The first task may look harmless. A small reward or apparent recruitment process can build trust before the request to move funds.
Attractive home-working offer
High pay, flexible hours and almost no experience required.
Moving to chat
Communication continues on WhatsApp, Telegram or another app.
An easy first task
A form, test registration or small payment for an activity.
Account or document request
You are told to open an account, send ID or add a banking device.
Receiving unfamiliar funds
Payments arrive from different people with no clear employer connection.
Sending it straight on
You must transfer, withdraw, hand it to a courier or deposit it at a crypto ATM.
How moving money is disguised as real work
Job titles vary, but the task still involves other people’s funds, your account, identity or registrations in your name.
Payment or finance assistant
You supposedly receive customer payments and forward them to accounts.
Foreign company without a local account
The company supposedly needs a local worker to handle domestic payments.
Investment company
You are told to move customer funds to crypto wallets or other accounts.
Testing a payment system
You supposedly test transfers, a bank account or a new financial service.
Refunds or logistics
You receive a payment and send it to another customer, courier or warehouse.
An account for the employer
You must open a bank, fintech or crypto account in your own name for someone else to use.
The money may not come from the employer
Payments can come from victims of other scams. Your account is used as an intermediate step that makes the organiser harder to trace.
Your salary is paid to you. An ordinary employee’s personal account should not process customer funds for an alleged employer.
Your banking credentials
An employer does not need your banking password, PIN, authorisation codes or app access.
An account opened for someone else
Do not open a personal bank, fintech or crypto account for someone else to control.
Customer payments into a private account
An ordinary employee does not route company customer payments through a personal account.
Cash for a courier
Do not withdraw cash and hand it to a stranger as a supposed work task.
Buying crypto with other people’s funds
Do not exchange received payments for crypto or send them to a stranger’s wallet on recruiter instructions.
Remote access to your device
A recruiter does not need control of your personal phone, computer or banking app.
Your bank card or SIM
Do not hand over your card, SIM or device for another person to use.
ID for another person’s registration
Do not send an ID and selfie for an account someone else will actually operate.
How to recognise a fraudulent job offer
One sign alone may not prove fraud. High pay, an unverifiable company, your personal account and rapid transfers together are a serious reason to reject the offer.
High pay
Little work, no experience and unusually high income.
A fee from every payment
You keep part of someone else’s money as your wage.
WhatsApp or Telegram
All recruitment happens in chat without a verified company contact.
Missing or unverifiable company details
The operator cannot be verified or the details are copied.
Your personal account
It is supposed to handle customer payments, refunds or payment processing.
Payments from different people
Unknown individuals pay you instead of the employer.
An immediate deadline
You must forward the money before there is time to verify anything.
Cash or cryptocurrency
The next step uses an ATM, courier or crypto wallet.
What to do if you responded
Preserve messages and do not try to fix the situation with another recruiter-directed transfer. Use the closest situation below.
I only found the offer
- Do not follow more supplied links.
- Check the company in the relevant official register.
- Find its genuine website and contact details independently, then verify the actual vacancy.
- Do not send identity documents or banking credentials to an unverified recruiter.
- Keep the advert, profile and contact details.
I sent ID or personal information
- End further contact with the suspected scammer.
- Save the profile, messages and records of what you sent.
- Watch for unexpected registrations, accounts or credit applications.
- Contact affected institutions and the document issuer through official channels for advice on misuse.
- Report suspected identity misuse to local police or your country’s reporting service.
I gave access to my account or device
- Contact your bank immediately using an independently verified number.
- Change access credentials from a trusted device, following the bank’s advice.
- End unfamiliar sessions and remove unknown authorised devices.
- Block affected cards as advised by the bank.
- Review transactions, new payees and settings changes; have a remotely controlled device checked before further sensitive use.
Unfamiliar funds arrived, but I have not sent them on
- Do not move, withdraw or spend it.
- Do not return it on the supposed sender’s instructions.
- Contact your bank and explain the whole sequence.
- Keep messages and the incoming payment details.
- Report suspected crime to local police or the relevant reporting service.
I already forwarded, withdrew or exchanged the money
- Stop further transactions immediately.
- Contact your bank immediately.
- Send nothing further, including as a supposed correction.
- Keep account numbers, crypto addresses and confirmations.
- Do not delete messages.
- Report to local police and describe the complete sequence; seek independent legal advice if concerned about your position.
An unexpected payment is not proof of wages
Leave the funds untouched, approve nothing further and reach the bank through a contact you verify independently.
What can follow suspicious transfers
The bank may review or restrict transactions and ask you to explain the origin and movement of funds. Processes depend on the bank and country.
Account restrictions
The bank may stop suspicious transactions and request more information.
Return or freezing of funds
Funds may belong to fraud victims and become part of an investigation or claim.
Explaining transactions
You may need to explain why you received the payments and whose instructions you followed.
Legal proceedings
Depending on the facts and local law, helping move criminal funds can expose you to investigation or liability.
What to keep
Keep messages and documents even if you feel embarrassed or the recruiter calls it a misunderstanding. Preserve evidence safely without continuing the activity.
The job offer
Advert screenshot, job title, profile and where it was published.
Communication
WhatsApp, Telegram, email, phone numbers, aliases and usernames.
Documents
Contract, instructions, supplied IDs and confirmations.
Bank transactions
Account numbers, amounts, times, senders and recipients.
Cryptocurrency details
Wallet addresses, transaction IDs, payment QR codes and exchange details. Never share recovery phrases.
Apps and access
App name, device, connection time and granted permissions.
Personal information you sent
Record which documents, photos and details you provided.
Timeline
When contact, payments and instructions arrived, and when you took each action.
Fake jobs and money mules – FAQ
Is every job involving financial transfers fraudulent?
No. Genuine financial roles have verified processes, oversight and clear authority. An ordinary employee’s personal account should not process an alleged employer’s customer funds.
What is a money mule?
Someone whose account or identity is used to move or conceal criminal funds, sometimes under the guise of a job.
What if I did not know where the money came from?
Your position depends on the facts and local law. Stop further transfers, contact your bank and local police, preserve all records and seek independent legal advice if needed.
Can I simply send an unexpected payment back?
Do not follow a stranger’s refund instructions. You could send it to another account or create a further loss. Contact your bank first and follow its verified process.
What if I signed a contract?
It may be fake or copy a real company’s details. Verify the employer independently; a document alone is no reason to transfer funds or hand over access.
What if I shared online banking access?
Contact your bank immediately. From a trusted device, follow its instructions to end unfamiliar sessions, change credentials and review transactions and settings.
What if the bank already blocked my account?
Cooperate with the bank, provide complete messages and transaction records and delete nothing. Contact local police and obtain independent legal advice where needed.
Where should I report a fake job offer?
Report it to the platform, your bank if funds or access are involved, and local police or your country’s reporting service. DPP also accepts reports through its Czech form.
Found a job that asks you to move other people’s money?
Keep the advert, profile, messages, account details and a short timeline. Reporting to DPP does not replace contacting your bank or local police.