Recently, we looked into a work abroad job scam making the rounds. Here is the email as it appears in an inbox.
Dear Sir/Madam,
We are Legal Job Consultant company agency based here in Canada, Right now
we are deploying workers to Canada for HOTEL SERVICES. Please let us know
if you have skilled and unskilled workers.
TERMS AND CONDITIONS:
1. Accommodation - Provided.
2. Ticket - Provided (FOR FREE)
3. Medical - Provided.
4. Transportation- Provided.
5. Working hours- 8a.m-4p.m [Mon-Sat]
6. Vacation- 28.5 days every year
7. Salary- Cash $21 per hour for unskilled,$34 for skilled workers.
8. Contract- 2 years.
9. Extra time- Ca$18per hour
10.Insurance & Pension- According to laws.
11.Other Benefits- Family status, group benefit and other fringe benefits.
For more information reply to the following person for further
communication:
CONTACT:
Pst Mr Frederic Philippe
Human Resources Services
We will help you locate your destiny..
Email address: fredericphilippe9854@gmail.com
Canada
Telephone: +14382381805
Whatsapp contact Number: +14387929433Obviously, this email is targeting those in the hospitality sector with the juicy prospect of working in Canada. Currently, with the high rate of unemployment being experience in the hospitality sector due to loss of jobs as a result of Covid-19 travel restrictions, this email will be very tempting to most.
We decided to role play and respond to Pst Mr. Frederic Philippe at his Gmail address to find out more about this job offer. In his response, he lays out the process for an intending migrant worker:
Here is our procedures for visa processing,if you are interested to work here in Canada go ahead and pay for your Application form which is 199 usd and they Application form fee is refundable , , Once you receive they application form you can go ahead filled it and send us your CV and international passport, after we receive it we forward your documents to the employer if successful we will get back to you with your job offer letter. ,once job offer letter is obtain you are expected to pay 10% of your visa processing which is $850 (Eight hundred and fifty USD ) for CAQ and LMIA processing, Immediately we receive your fee we then proceed with your VISA processing starting from your CAQ, LMIA, IMMIGRATION CLEARANCE AND TEMPORARY WORK PERMIT after we must have obtained the mentioned document we will proceed to get your VISA stamped in your country residence:
NOTE: Once you receive your JOB OFFER LETTER your visa is secured and 100% guaranteed ,CAQ means Certificate Acceptance of Quebec while LMIA means Labor Market Impact Assessment .Free air ticket is provided by the Employer, if you agree with us then you proceed to send us your CV and international passport for further processing.In essence, the play here is for the applicant to pay $199 for an application form, though they claim the fee is “refundable,” you can be sure that as soon as payment is made, this money is never coming back. In such schemes, once initial payment is made, the scammers come up with more excuses to squeeze their victims for more cash. We were curious to know how they intended to collect this cash, so we sent a follow-up email asking for payment details, to which we were asked our country of residence, to which we responded Nigeria. Then we were directed to make payment via western union to their “agent” in Burkina Faso, see below:
You will make they payment to our Agent in Burkina Faso through western union
Name: RAISSA TRAORE
Country: Burkina Faso
Amount: $199
Make the payment through western union money transfer.
Thank you.Most likely, “our Agent” is a money mule, and we wondered if “Pst Mr Frederic Philippe” was also based in Burkina Faso. During the back and forth, we were able to social engineer Pst Mr Frederic Philippe into taking an action that revealed his IP address, see below:
So Pst Mr Frederic Philippe is in Benin and his money mule is in Burkina Faso, both in West Africa. So we decided to dig some more to see if the circle would get bigger. First, we did a search using the telephone number in the initial email that was sent out, and it revealed that it was used in another job scam in 2018 about a Gavin Wytt Western Hotels & Suites, see below:
info@gavinwyttwestern.com / Scammer Impersonating GAVIN WYTT WESTERN …
archived 18 Mar 2021 19:16:23 UTC
The report gives the domain of of the scam as gavinwyttwestern.com but since it had expired we had to dredge up an old copy from the Wayback Machine. Below is a screen capture from the contact section:
The screen capture provided another phone number, with which we did another Google search, revealing another fake job scam with the name LA’ CONSULTANCY SERVICES, see below:
Scammers Impersonating LA’ CONSULTANCY SERVICES / Fake Job Scam Fraud…
archived 18 Mar 2021 21:40:07 UTC
The report of the scam lists three numbers, +16362037548, which we searched to find out about the scam, +14385584936, and +14188008699. Doing a Google search for +14385584936 leads us to yet another Job scam, with the name Royal Versailles Seafood, see below:
ScamNumbers.info • View topic – +14385584936
archived 18 Mar 2021 22:33:21 UTC
The report contained the WHOIS details showing the registrant information, we plugged in the domain royalversailleseafood.com in DomainBigData and obtained a similar result. The registrant is called MutualFunds Community and is located in Nigeria.
As shown above, the registrant’s email is associated with 12 domains, you can find them in our link analysis below showing everything encountered thus far.
So putting it all together, we have a money mule in Burkina Faso, someone sending out emails in Benin and someone in Nigeria helping with the website aspect of the scam, thus we have a West African connection. This is just a preliminary analysis and there’s no telling how far or deep it goes or how many other people might be involved. As always, thinking critically and doing some internet research are the best defense against these kinds of scams. Other things to take note of are use of free email providers like Google as opposed to a company domain, requests for payment in the guise of buying forms or processing applications, and the use of a P.O. Box or a virtual office address instead of a physical address. Finally, always try to find reviews or track down people who can testify about working for the business or using the hiring service. Observing these should keep you from the clutches of Job scammers.
One Response
This person with number +14387929433 sits also on Tinder and tries to catch bit dumb ladies all over the world. Send pictures, videos and even his ID card photo for greater reliability. Call himself – Barry Dragomir Jaoquin who works in oil company. All conversation is quite believable except : he claims that there are monkeys living in the open air in Berlin :D.