A few days ago I received some spam emails in a test account that I use as a honeypot. Several messages were sent at the same time they were searching recruit money mulesThat is, people who unknowingly launder what is stolen by cybercriminals on the network.
The idea of the next article is to show how these criminals operate.
It all starts with a job offer very well paid and with few requirementsIn this case addressed to people from Uruguay, they speak of an initial salary of 30,000 pesos (about 1,500 dollars). You just have to respond by sending the resume:
The following is the text of the emails, they are all the same although they seem to be sent by different people:
In relation to the global expansion of our company, we actively recruit new employees from all over the world! We offer you an interesting and highly paid job. With us you will be able to achieve yourself and earn good money, also having a free practice day. We are ready to employ a reliable and determined person to work remotely. You can carry out this work from your own home.
We always have new interesting vacancies and the possibility of job growth. His starting salary will comprise 30,000 pesos, our reward allows to increase your salary.We guarantee you the education in the initial phase of the work, you should be responsible at the same time attentive to the execution of the work. We need people with a great desire for work and aspiration to earn money. You don't have to invest money for this job!
These are our requirements for the candidates:– Be over 21 years old – have the ability to use the Internet network – be able to quickly find the necessary information – The absence of credits. and good credit history – Have the ability to make quick decisions and show initiative.
If you are interested in our proposal, we are waiting for your CV. Our request to send the CV only to this address: **** @ *****. Com
Send the CV only with these data: – The country and city of residence Uruguay only– The phone to be in contact in international mobile format. fixed. – Name Surname: – Age, sex: – e-mail:
Sincerely, Personnel Department.
After sending them a false resume that really didn't say anything, as it was worse than the messages they sent with misspellings, they responded by sending documents describing the job and an enrollment form:
The following are the screenshots and the text of the 3 documents:
Comment: The Financial Services application Interviews start from January 3 to August 30, 2013.
Good morning. We are a company with prospects, opening field in the world market. In relation to our growth as a company, we are looking for regional managers in Spain, Portugal, Argentina, Uruguay, Chile. The work consists of expanding the company in foreign markets, work with clients and perform financial procedures.
The work is very well paid and requires corresponding treatment. The employee must possess qualities such as being organized, communicative, having basic knowledge in the sphere of sales and finance. We offer our services worldwide and payments are made to the company's corporate account. But since in most cases they are payments abroad, their appropriation requires a long time, which delays the labor process. With the goal of saving time and improving the labor process, we have opened several corporate accounts in Spain, Portugal, Argentina, Uruguay, and Chile since consignments within the same country are carried out much faster. So we need a regional manager, a person responsible for sales and who controls the consignments made to the corporate account in a given region.
The method of consignment of payments is as follows: The client consigns the payment for the services rendered or merchandise to the corporate account of the company, you obtain access to our account, withdraw the money and send it to our main office through services instant payment.
You receive a package of documents from the corporate account and sign an employment contract with us. Everything is legal.
To obtain the position of regional manager, you must first read the Working Conditions. If you agree to the conditions, print, sign, and scan and send them attached with this email. Also fill out the application form and send it to us. After having done this, our consultant will contact you and have the opportunity to ask everything that interests you. After this, you will begin your trial period.
The trial period lasts from 3 to 10 days. Our company will pay you for these training days. In the course of the trial period we will agree with our constant clients and they will send their bank account minimum payments for inquiries in our company. We will send you all the necessary payment information. You will have to receive the payment, withdraw it from your bank account and send it by instant consignments (Western Union or Money Gram) in the name of the main manager of the company. In total it will be 2-3 payments of these. Then we pay you for the trial period 20,000 pesos plus 4% of each transaction made.
Within 2-3 days after the trial period, the employment contract will be sent to your address. After signing it, all documents will be sent and you will have access to the company's corporate account in your region. The salary is 40,000 pesos plus 4% of each transaction made. We pay the salary the way you choose: by bank account or by check every week.
If you believe that this job is for you, fill out the application form and sign the employment contract, which are attached in this email. Also send us your identity document: Passport, ID or driving pass. We will contact you immediately after receiving all your information.
Sincerely, Zimmer Personnel Department
They put signature and everything:
1. The names of the contracted parties
2. Job Description The employee's occupation is: Beginning Distributor. The tasks of the beginning distributor is to process payments between our customers and our company, in particular handling money and account receipts, managing accounts, etc. The work is remotely via the Internet. . Each payment order will be accompanied by detailed instructions. The employee will also be in charge of interacting and reporting all the details of each action performed to our manager. Be a short trial period, some details of our company's work may change. But there is no reason to worry, as our employees are always notified of changes in advance and will only do the job if they agree to the changes.
3. The candidate's requirements: 3.1 Being 21 years of age or older. 3.2 Being able to work from home responsibly. 3.3 Being able to make efficient administrative reports. 3.4 Having experience working with clients is a plus, but it is not strictly 3.5 Be honest, responsible and punctual 3.6 Be communicative 3.7 Be used to working online, have knowledge of the Internet and email 3.8 Have the possibility of being in contact with our company and report on time 3.9 Have one or more personal bank accounts
4. Workplace Your home or primary workplace.
5. Salary The employee's salary is 3,500 Euros per month plus 4% of each transaction made depending on the amount of the transaction. The current commission will be discussed just before making the transaction. The sum of the transactions varies from 1000 to 45000 Euros. The number of transactions carried out by you is not limited and only depends on your personal capacity, responsibility and communication skills. If our manager sees that in your work, you will be responsible for higher sum transactions. In other words, your salary depends on yourself, without limits. Payment of the salary is made biweekly directly to your bank account (specified on the form) or by check. In case of not having a bank account, the employee must open one.
6. Hours of WorkApproximately 1-3 hours a day, Monday through Friday. In some cases, the employee may be asked to work overtime.
7. Vacation The employee is entitled to 4 weeks (20 days) of paid vacation per year.
8. Filing of complaints In case of any complaint, the employee must report it to his project manager.
9. Disciplinary Procedure In the event that the employer believes that the employee has acted improperly in the course of his or her job, or if the employee discredited the employer's company in any way, the employee will face disciplinary proceedings. If the employee has committed For a minor offense, the employer has the option to issue a verbal (written) warning, or a written warning depending on the severity of the absence. If the employee has committed a serious offense, the employer has the option to issue a warning verbal (in writing), or a written warning, a last written warning, or immediate dismissal. The employer also has the option to suspend the employee, where the employee will be questioned about the absence.IMPORTANT: In case of not following the instructions of the employer and not sending the money of payments for more than 2 days, the employee will be denounced . ZIMMER, LLC has signed a cooperation contract with Interpol and FBI and in the case of accusing the employee of fraud, he will ultimately be arrested and take full responsibility.
10. Required notice periods for the employer and the employee The minimum deadlines are as follows:
Minimum employment notice time Less than 1 month without notice More than 1 month 1 week 2 years of service 2 weeks 3 to 12 years of service one week each year to a maximum of 12 weeks The employee must send a copy of the notification to the address of the company, as 1 above. The employee must send a copy of the notice to the employer's address, as 1 above. In the event of the employee's dismissal for serious misconduct, the employer will decide whether any notice time will be applied or executed.
Changes in the terms of this contract or other terms, conditions and working rules will be notified to you before the supposed date of the change and will take effect with your consent.
I accept and agree to all the terms and conditions of my employment: Signed:
And the form where the personal data is put:
To convince victims, they pose as a company called Zimmer (zimmer.com) that actually exists but has nothing to do with the job offer. In this way, when people look for information or references about the company, they find various results and believe that it is legitimate.
However, the email address they use to send and receive the documents is under the domain zimmer-hr.comwhich was registered last week (notice that it has a hyphen and the letters hr to appear real):
On the other hand, analyzing the documents and their metadata, the form was created in July 2012, which suggests that they have been using it for months.
Once I answered them by completing the information, they answered the following:
Dear *****, we are currently looking for people who work remotely over the Internet. People who make the payments of our Uruguayan clients. We pay well.
You will start earning money from the first day, the only thing we ask is honesty and seriousness for this job and follow the instructions that we are going to indicate you to do the job.
If you have a bank account at the ITAU bank or at COMERCIAL or SANTANDER bank, you can start working from today, if you do not have an account at this bank, TAU or COMERCIAL or SANTANDER we ask you to open an account as soon as possible to start with the trial period.
The first month you will earn a minimum of 20,000 PESOS, while completing the trial period and waiting for the original employment contract, to be able to work with the company's corporate account. We wait for the data of the new bank account in this way:
1.Account name 😕
3. Product Savings or checking account:?
4.Bank limits how much money can you withdraw at the bank:?
Your role in our company as Regional Manager, would be to make payments from our Uruguayan clients, after completing the trial period, you will make different online payments of money, manage and carry data from one of the company's corporate accounts. An executive will work with you through different programs such as Skype, this person would be in charge of giving you daily work tasks and paying your weekly salary.
Sincerely, Zimmer Personnel Department
At this point I was no longer playing the game, the idea was simply to show how these criminals operate trying to convince the victims that they will work for a large company. What they need are people who receive money in their bank accounts and then send it to them – anywhere in the world – for services such as Western Union or Money Gram.
In this way they manage to launder and convert into cash the capital that they stole virtually, since the money mules receive is transferred by criminals from stolen bank accounts using phishing and other techniques.
Hence the name money mules because instead of transporting goods, they transport money from one place to another.
When the police investigate and follow the trail, he ends up knocking on the door of the innocent mules since are the only people who can be identified throughout the operation. That is why you have to be very careful with these job offers, as tempting as they are it is stolen money and being part of them is a crime.
See also: The deception of making money by answering surveys.