The vacancy sounds harmless: junior assistant to an analyst, remote, flexible hours, start this week. Contact arrives through a Telegram bot or a cheerful “HR” account, not a careers page you applied to. The work is liking posts, rating products, or “helping marketplace analytics” — anything that looks busy without producing a real deliverable for a named employer.
Security researchers and consumer reports describe the same arc again and again. Small “payouts” appear on a dashboard so the balance feels earned. A group chat may cheer your progress. Then the script asks for a deposit: unlock a higher tier, cover a “negative balance”, pay tax, or stake crypto to keep the tasks flowing. The salary was theatre; the fee is the product.
Proofpoint and others have tracked crypto-linked job lures that borrow big-brand language and move hiring into messaging apps. Legitimate employers do not hire you in minutes via an anonymous bot, pay entry-level roles only in USDT, or require you to fund your own training wallet. A title as foggy as “assistant analyst” with no company registration, no contract, and no verifiable email domain is not a career step — it is a funnel.
If the chat already asked for ID selfies, seed phrases, or a top-up, stop. Do not recruit friends for a “team bonus”. Search the company name yourself, ignore screenshots of balances, and treat any follow-up “refund helper” as a second scrape.
If a pitch already took money or keys, start at Get help. Follow-up “refund agents” are covered at Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.