Fraudsters create fake Canadian company, steal foreign website to victimize job seekers
10 Aug 2020

When Ashley lost her position as a French program co-ordinator due to the COVID-19 pandemic, she threw herself into an aggressive search for another job.

With experience in sales, marketing and co-ordination, the 25-year-old sent her resume out widely and posted it on Indeed, Linked-in and other reputable career sites.

So when a Vancouver-based technology company called Gux-IT contacted her in June and invited her to apply for a full-time “general assistant” position she would work remotely from her Toronto home, she was excited — but also cautious.

Although working from home has become the norm, especially over the past several months of the pandemic, Ashley was also conscious that employment scams — where people desperate for work are “hired” into jobs that don’t exist and tricked into using their own money for things — have been on the rise.

Her first step was to make sure there was a job posted on Gux-IT’s website and thoroughly examine the rest of it.

“I also always check, too, when I do go on websites, the red flags,” Ashley said. “That means the ‘about us’ page, that means a number, an address, all the different links that are able to be clicked. I did check all of those things.”

The people she was communicating with used Gux-IT email addresses. In her job interview, she spoke with someone on the phone who appeared to be calling from a B.C. area code. Ashley even looked up the company’s headquarters with Google Street View.

She thought she had checked all the right boxes. But what she didn’t realize was that Gux-IT itself is a fake organization — nothing more than fraudsters hidden behind a duplicated website and an incorporated company that doesn’t belong to them.

Job scams on the rise

Job scams are on the rise and becoming more sophisticated, said Jeff Thomson, senior RCMP intelligence analyst at the Canadian Anti-Fraud Centre.

In 2019, the centre received more than 2,400 job-related fraud reports, he said. The number of reports counted in 2020 is already more than 2,300 — and that’s only up to July.

With more people losing their jobs during the COVID-19 pandemic and seeking work, as well as shifting to doing business primarily online, “it’s sort of ripe for job scams right now,” Thomson said.

Ashley’s first day of work at Gux-IT on July 6 started normally enough. She gave the company a copy of her driver’s licence, but not her social insurance number. She didn’t supply any banking information; she was told she’d be paid via e-transfers biweekly.

The person introduced as Ashley’s HR manager communicated with her using the Telegram messaging app — something that didn’t seem strange in an era of teleworking. Her manager used the name Nancy Garapick. After the fact, Ashley realized it was a fake identity — the stolen name of a Canadian Olympic swimmer.

CBC News has agreed to use only Ashley’s first name because it’s not known who or where the people behind Gux-IT are. She fears for her safety after sharing her experience publicly.

For the first part of the day, Nancy had Ashley watch training and orientation videos. She urged Ashley to contact her with any questions or concerns.

Later in the day, Nancy messaged Ashley with her first task: to help the IT department, which she was told advised clients on what software and website hosting tools they needed and also bought them on clients’ behalf.

Cryptocurrency transactions

“It is quite simple: you will need to buy domains, hosting for websites, pay for various tools that they need in their work,” Nancy wrote in a message Ashley screengrabbed and provided to CBC News.

To do that, Nancy wrote, “we will carry out the task of replenishing your work wallet” using Ethereum, or “Ether” — a cryptocurrency much like bitcoin.

There are bitcoin and Ethereum ATMs — just like regular ATMs — in convenience stores across Toronto, and several in other Canadian cities, such as Calgary, Montreal and Vancouver. Ashley was told she would receive an e-transfer of $2,000 from the company and then go deposit it into a cryptocurrency ATM located in a convenience store on Gerrard Street in Toronto to start her “work wallet.”

Wanting to be extra cautious, Ashley contacted her Scotiabank branch and told them an e-transfer was coming from a new employer, and to alert her if anything looked suspicious. When the transfer arrived within a couple of hours, the bank didn’t raise any alarms, so Ashley withdrew the $2,000 as instructed and made the deposit.

She had just deposited the money into the Ether wallet when her phone rang with devastating news. The Google Street View she had previously seen had shown a building with several businesses in it, so her boyfriend had contacted a bar on the ground floor and asked an employee there if he would check the office directory after his shift.

‘My heart and my stomach just sank’

Still standing beside the ATM, Ashley listened as this “kind soul” returned their call.

“He’s like, ‘Hey guys, I looked into it for you … and this company doesn’t exist. Like, it’s nowhere in the building,'” she said. “My heart and my stomach just sank.”

Thomson at the anti-fraud centre said they’ve received another similar, anonymous report from someone else who was “hired” by Gux-IT and asked to do the same thing.

The goal of “cash-out scams” like this, he said, is to move dirty money using “employees.”

“What we see is the fraudsters take time to set up fraudulent websites that may spoof real companies or seem legitimate,” Thomson said.

Then, they take money from “compromised accounts” and have unsuspecting people who think they’re doing legitimate work convert it into cryptocurrencies that are hard for law enforcement to track, he explained.

“They’re implicating you in a money laundering scheme, a cash-out scheme.”

Stolen website and parent company

CBC News investigated Gux-IT and found its website had been stolen — copied almost word for word, including the design, the description of the company’s services and even employee photos — from a company called Synebo based in Odessa, Ukraine.

The fraudsters substituted the name Gux-IT, or just “Gux, ” wherever Synebo is mentioned.

When reached by CBC News in Ukraine on Thursday, the founder and head of Synebo, Shimshon Korits, confirmed he had never heard of Gux-IT. Synebo had recently received a couple of messages through its “contact us” email, which Korits wasn’t sure what to make of, alerting him that Gux-IT appeared to be stealing his company’s identity.

CBC News reviewed the emails: one was from someone who had been checking out Gux-IT for a friend who had been offered a job there and found the same photos were on both websites through a reverse image search. The other was from a woman who said she had clicked on the phone number listed on Gux-IT’s website and Synebo’s number came up.

When CBC News called the number at the bottom of Gux-IT’s website, it was out of service.

By Nicole Ireland and William Wolfe-Wylie, CBC News, 7 August 2020

Read more at CBC News

RiskScreen: Eliminating Financial Crime with Smart Technology

You can claim CPD minutes for this content, by signing up to our CPD Wallet