01
Infrastructure
Domains mimicking employers.
Job scam
Offers that pay you with your own money
Fraudulent recruiters collect onboarding fees, training crypto, or mule transfers under guise of remote work.
Job scam pattern
Victims receive unsolicited offers with minimal interviews and rapid hiring.
Tasks involve moving crypto between accounts or paying for software licenses in coin.
Flow
- 01
Outreach
LinkedIn or email impersonating known brands.
- 02
Onboarding fee
Crypto payment for background checks or equipment.
- 03
Mule role
Victims asked to receive and forward funds—legal exposure risk.
Red flags
- Hired without verifiable video interview
- Salary too high for stated role
- Payments required before start date
Movement
Fees go to operator wallets; mule flows may layer victim transactions.
- — Direct fee deposits
- — Pass-through transfers
- — Exchange cash-out by operators
Evidence
- Offer letters and chat with HR persona
- Fee TXIDs
- Corporate domain email headers
Investigation
02
Tracing
Fee wallet clustering.
Now
- 01Stop forwarding third-party funds
- 02Report to platform where job was posted
- 03Consult counsel if you acted as unwitting mule
Never provide a seed phrase, private key, or authentication code to anyone claiming they can recover funds—including parties who contact you unsolicited. Legitimate investigators do not need wallet secrets to begin a case review.
Frequently asked questions
Am I criminally liable as mule?
Depends on jurisdiction and facts—legal counsel is essential.