We've recently become aware of a recruitment scam where bad actors are impersonating Instil via various channels including fake websites, email, messaging and social networks. In this post we provide details of the scam, how to recognise it and what you should do about it.
The job offer
The WebWyrm Scam is a complex scheme in which malicious actors pose as a brand offering their victims a role at that company. The scam will often start with an outreach message from a social media platform, e.g. WhatsApp. From what we've seen, victims are being approached directly out of the blue or as a result of engaging on a job board.
Once the victim has been engaged they will then be put through a multi-stage 'interview' process, communicating with multiple people along the way, all in an attempt to appear more authentic. Some of these people have adopted the names and avatars of actual employees stolen from the internet. It is all very convincing.
The webwyrm scam
So how do to you spot the scam? Key indicators include:
-
Misleading domains: Have you been pointed to a website with a suspicious URL? The names are typically long, don't make much sense and (in our case) nearly all end with
.cc. Note that there are dozens of sites and as soon as we report one, another appears. -
Rewards for Tasks Are you being offered rewards or undertaking certain tasks? The job interview process will often require some kind of task to be completed at some stage of the process but never for a reward.
-
Request for Personal Information: Are you receiving early requests for personal and finanical information?
-
Request for Payment: Are you being directly for a payment of some kind? No firm would ever ask you for money as part of a recruitment process.
-
Urgency Is the 'recruiter' being pushy and forcing you to make a decision under pressure? Again, no reputable firm would do this.
All of the above should be red flags but the scam is incredibly sophisicated - the multi stage process and involvement of many people along the way can make it all feel genuine. It is not. After 'securing the role', victims will then be asked to hand over money, usually cryptocurrency, as a deposit to cover travel costs and/or visa requirements or they will be mislead into handing over money on the promise of getting more back in return for completing tasks as part of their new job.
To be clear, Instil would never send a job offer or any form of official communication via WhatsApp or social networks. We do not pay in cryptocurrency and we would never ask for payment of any kind during our recruitment process.
What can you do?
If you have been approached by someone via social media (especially but not only WhatApp) then immediately block that person. If that person points you to any URL other than this website, then block that person. If they request money or dangle the possibility of rewards for tasks then block that person.
If you have been victim of one of these scams, it is important that you do not send any money to the scammers, stop all communication with them immediately and report the incident to your local authorities. For UK residents, you should report the incident to Action Fraud and the National Cyber Security Centre also has a service which can be used to report malicious websites.
