The landscape has changed. Dramatically.

In 2020, Americans reported losing $90 million to job scams. By 2024, that figure had exploded to over $501 million – according to the FTC. And those are just the cases people actually reported. The real number is almost certainly far higher.

I wrote the original version of this guide in 2023. Back then, the biggest threats were fake task scams on Telegram, dodgy data-entry gigs, and the ever-present network marketing “opportunities” that prey on people desperate for flexible work. Those threats haven’t gone away – but they’ve been joined by something far more sophisticated.

Artificial intelligence has transformed the scam landscape. Criminals can now generate convincing job postings at scale, conduct deepfake video interviews, clone voices, and create synthetic identities that pass background checks. The barrier to entry for fraud has collapsed, while the potential payoff has skyrocketed.

This guide is a complete overhaul. Whether you’re actively job-hunting, considering a career pivot to remote work, or just want to understand the threats out there – this is everything you need to know in 2026.

One thing hasn’t changed, though: falling for a scam doesn’t make you stupid. These operations are designed by professionals. They exploit hope, urgency, and the very real desire for a better working life. Understanding how they work is your best defence.

AI-generated deception – the new face of remote work scams

1. The AI revolution in scamming

The single biggest shift since I last wrote about this topic is the weaponisation of AI by criminals. It’s changed everything – the speed, the scale, and the sophistication of remote work fraud.

AI-generated job postings

Creating a convincing fake job listing used to require effort. Someone had to write plausible copy, research salary ranges, mimic a real company’s tone. Now, a large language model can generate hundreds of polished, keyword-optimised job postings in minutes. They read perfectly. They include all the right details – benefits packages, reporting structures, growth opportunities. They’re often indistinguishable from real listings.

This isn’t theoretical. Fraud detection firms report AI-driven scam activity surging by over 1,000% in 2025 alone. The economics are brutal – AI-powered scams scale at almost zero marginal cost, while traditional fraud required human effort for every target.

Deepfake video interviews

Here’s a statistic that should concern every hiring manager and every job seeker: 17% of HR managers report having encountered deepfake technology during video interviews, according to Resume Genius research. In the tech and finance sectors, that figure is even higher.

How does it work? Scammers superimpose stolen photos – often scraped from LinkedIn profiles – onto live video feeds using real-time deepfake software. Combined with AI voice cloning, they create what amounts to a digital puppet. The scammer sits behind a screen while an AI-generated avatar attends the interview on their behalf.

This cuts both ways. Fraudsters use deepfakes to impersonate candidates and get hired at real companies (more on the North Korean operations doing this at industrial scale later). And scam “employers” use them to conduct fake interviews that feel legitimate, building trust before the financial exploitation begins.

Google and McKinsey reintroduced mandatory in-person interview stages by mid-2025, partly in response to growing concerns about AI-assisted cheating and identity fraud in hiring. That’s how seriously the corporate world is taking the integrity of remote interview processes.

The new economics of fraud

The FBI’s Internet Crime Complaint Centre (IC3) received 859,532 complaints in 2024, with total reported losses of $16.6 billion – a 33% increase from the previous year. Phishing and spoofing scams nearly doubled year-on-year into 2025, with median losses more than doubling to over $2,000 per victim.

What’s driving this? AI has lowered the barrier to entry dramatically. Tools marketed as “phishing for dummies” are sold on dark web marketplaces. You no longer need technical skill to run a sophisticated scam operation – just a subscription and a target list.

Ghost jobs – listings that lead nowhere

2. Ghost jobs – the silent epidemic

Not every fake job listing is a criminal scam. Some of them come from real companies, and that might be even more demoralising.

Ghost jobs are postings for positions that don’t actually exist – or that a company has no genuine intention of filling any time soon. A ResumeUp.AI analysis of U.S. LinkedIn postings found that 27.4% of listings were likely ghost jobs – positions posted for over 30 days with no apparent hiring activity. An overwhelming 81% of recruiters admit their employers engage in this practice.

Why do companies do it? The reasons range from the cynical to the merely careless:

  • Appearing to grow – an active careers page signals health to investors, clients, and competitors
  • Building talent pools – collecting CVs for future roles that may or may not materialise
  • Internal compliance – some policies require external postings even when an internal candidate is already chosen
  • Market research – gauging salary expectations and candidate availability at zero cost

For remote job seekers, ghost jobs are particularly damaging. You invest hours tailoring applications, preparing for interviews that never come, and gradually losing confidence in your search. The job market data itself becomes distorted – openings appear plentiful while actual hiring stalls.

How to spot a ghost job

  • Check the posting date. Anything over 30 days old with no updates is suspect.
  • Look for identical repostings. Some companies cycle the same listing every few weeks.
  • Research on Glassdoor and LinkedIn. Are current employees mentioning hiring? Is the team actually growing?
  • Ask directly in interviews. “What’s the timeline for this hire?” and “How many candidates are you speaking with?” are entirely reasonable questions.
  • Watch for vague urgency. A real opening has a start date and a budget. If neither is mentioned, be wary.

Ghost jobs aren’t illegal, but they’re a systemic waste of job seekers’ time and energy – and they erode trust in the entire remote hiring ecosystem. For remote workers specifically, the impact is amplified. You’re already competing in a global talent pool for location-independent roles. When a quarter of those listings lead nowhere, the emotional toll of endless applications and silence becomes genuinely corrosive. If your job search is feeling like shouting into the void, it might not be your CV that’s the problem – it might be the listings themselves.

The lure of easy money – task scams and pig-butchering

3. Task scams and pig-butchering

If you’ve ever received a random WhatsApp message asking if you’d like to earn money reviewing apps or liking YouTube videos, you’ve already been targeted by the most widespread scam pipeline in the world.

These operations have evolved dramatically. What started as simple “do a task, get a small payment” schemes have mutated into sophisticated pig-butchering operations – a term borrowed from the Chinese phrase for fattening an animal before slaughter. The victim is the pig.

How the pipeline works

  1. First contact. An unsolicited message arrives – SMS, WhatsApp, Telegram. Often a “wrong number” pretext or a vague job offer. Research suggests nearly 70% of victims are first contacted via unsolicited text messages.
  2. The hook. You’re offered simple tasks – rating products, watching videos, boosting social media posts. The pay seems reasonable for minimal effort.
  3. Real payments. This is the clever part. They actually pay you. Small amounts, but real money hits your account. Trust builds.
  4. The escalation. You’re invited to “premium” tasks or “investment opportunities” that require you to put money in first. Returns are promised at higher rates. Early investments may even pay out, reinforcing the pattern.
  5. The trap. Larger sums are requested. Your account is “locked” pending verification. Withdrawal requires additional deposits. The money is gone.

Chainalysis estimated at least $9.9 billion in global crypto scam revenue in 2024, much of it from pig-butchering operations – up 40% year-on-year. The global cumulative toll from these schemes is estimated at over $75 billion.

The human cost

These aren’t just financial crimes. Many of the people running the scam operations in Southeast Asia – particularly in Cambodia and Myanmar – are themselves victims of human trafficking, forced to work in scam compounds under threat of violence. It’s an entire criminal ecosystem.

WhatsApp banned over 6.8 million accounts linked to scam activity in the first half of 2025 alone, primarily tied to these networks. But new accounts are created faster than they can be shut down.

Red flags for task scams

  • You were contacted first, out of the blue
  • The “employer” communicates exclusively via messaging apps
  • Tasks seem absurdly simple for the pay offered
  • You’re asked to set up a crypto wallet or make any kind of payment
  • There’s rapid escalation from chatting to “investing”
  • Video calls are refused or avoided (90% of scammers in these operations avoid video)

4. Crypto and Web3 recruitment scams

The cryptocurrency and Web3 space has become a particularly fertile hunting ground for scammers – partly because the roles are in high demand, partly because the workers already have crypto wallets, and partly because blockchain transactions are harder to reverse.

Fake meeting apps and malware

In early 2025, a campaign dubbed GrassCall targeted Web3 job seekers through fake interview invitations. Scammers posed as a company called “ChainSeeker.io,” posted legitimate-looking job listings on LinkedIn, WellFound, and CryptoJobsList, then directed applicants to download a custom “meeting app” via Telegram. The app installed remote access trojans and crypto wallet stealers. Hundreds of victims had their wallets drained. When the campaign was exposed, the operators simply rebranded to “VibeCall” and continued.

Trojanised coding tests

Developers applying for blockchain roles have been targeted with coding assessments delivered via GitHub repositories. The code appears to be a legitimate technical challenge, but includes hidden malware that installs information-stealing software when executed. If you’re a developer, never run untrusted code on your main machine – use a sandboxed environment or virtual machine for any take-home assessment from a company you haven’t thoroughly verified.

State-sponsored operations

North Korean hacking groups – particularly the Lazarus Group’s “Contagious Interview” subgroup – have been systematically impersonating recruiters for blockchain and tech roles on LinkedIn, Upwork and other freelance platforms, and specialist crypto job boards. They create fake agencies (identified names include BlockNovas, Couch Chain, AppSaga, BitLink, and Zentify) and run what appear to be professional hiring processes. The end goal is either malware installation or direct wallet theft.

This isn’t petty crime. It’s state-sponsored industrial-scale fraud – and it targets exactly the kind of skilled remote workers who make up our community.

Protecting yourself in crypto/Web3 job searches

  • Never download meeting apps or tools you haven’t independently verified. If a company insists on a platform you’ve never heard of, suggest a standard alternative like Zoom or Google Meet. Their reaction will tell you everything.
  • Run any take-home coding assessments in a sandboxed environment – never on your primary machine with access to crypto wallets.
  • Verify the company independently. Check domain registration dates, look for real employees on LinkedIn, and search for the company name alongside words like “scam” or “fraud.”
  • Be especially wary of job listings that appear exclusively on Telegram or Discord rather than established platforms.

5. Fake employers and the North Korean IT worker pipeline

One of the most extraordinary scam operations uncovered in recent years doesn’t target workers at all – it targets employers.

The laptop farm scheme

In 2024, Arizona resident Christina Marie Chapman was sentenced to 102 months in federal prison for running a $17 million fraud scheme that enabled over 300 U.S. companies to unknowingly hire North Korean IT workers. Chapman operated “laptop farms” – physical locations housing company-issued laptops – while North Korean operatives worked remotely from overseas, using stolen American identities to pass background checks and appear as domestic workers.

The FBI seized 137 laptops from 29 sites across 16 U.S. states. Four American accomplices pleaded guilty to supporting the scheme. The North Korean workers earned real salaries from real companies, with the revenue flowing back to fund the regime’s weapons programmes.

This has direct implications for the remote work ecosystem. Companies that discover they’ve been defrauded often respond by tightening remote work policies for everyone – demanding in-person verification, restricting fully remote roles, or adding surveillance measures that affect legitimate remote workers.

Fake onboarding scams

A more traditional variant targets job seekers directly. You “get hired” by a company that looks legitimate – professional website, branded email addresses, a seemingly normal onboarding process. Then comes the catch: you need to purchase specific equipment through their preferred vendor, or pay for mandatory training or certification, or provide banking details for a “signing bonus” that requires you to return the overpayment.

In one documented case, a fake company calling itself “TechCore Innovations” ran a complete onboarding experience. The victim lost $1,200 purchasing a laptop through the company’s fake vendor portal before realising the entire operation was fraudulent.

No legitimate employer requires you to purchase equipment through them before your first day. If a company needs you to have specific hardware, they either provide it or reimburse you after you start – through verified, standard channels.

6. Resume harvesting and data theft

Your CV is a goldmine of personal data – full name, address, phone number, employment history, sometimes date of birth and nationality. Criminal operations are increasingly targeting job seekers specifically for this data.

How it works

  • Fake job boards. Sites that mimic legitimate platforms but exist solely to collect applications. They often lack basic security features and expose user data.
  • Fraudulent listings on real platforms. Scammers post convincing job ads on LinkedIn, Indeed, and Monster. For a deep dive into LinkedIn-specific scam tactics and how to verify postings, see our dedicated guide. The “application process” collects far more personal information than a real employer would need at the initial stage.
  • Malware-embedded applications. In a particularly nasty twist, Russian-speaking cybercriminal groups have targeted HR departments with fake CVs that contain malware – but the reverse also happens. Job seekers are sent “application forms” or “pre-employment assessments” as downloadable files that install keyloggers or data-harvesting tools.

What happens with your data

Harvested resume data enables a cascade of downstream fraud:

  • Paycheck diversion scams – criminals impersonate your HR department and redirect your salary payments
  • Identity theft – your data is combined with other stolen information to create synthetic identities
  • Credential stuffing – your email and any reused passwords are tested against banking and financial services
  • Targeted phishing – knowing your employer, role, and colleagues makes spear-phishing far more convincing

Protecting yourself

  • Never provide your national insurance/social security number, bank details, or passport information during an initial application
  • Be suspicious of application forms that ask for more than name, email, phone, and work history
  • Use a dedicated email address for job applications
  • Check that any job board you use has HTTPS encryption and a clear privacy policy
  • Reverse-search the company name and job listing to see if it appears elsewhere

7. MLM and network marketing – still lurking

Multi-level marketing schemes haven’t gone anywhere. They’ve just gotten better at disguising themselves as remote work opportunities – particularly targeting expat communities, digital nomads, and people seeking location-independent income.

The pitch has evolved with the times. Where once it was supplements and skincare, now it’s often “AI tools,” “digital marketing platforms,” or “crypto education” – but the structure remains the same. You pay to join, your real job is recruiting others who also pay to join, and the mathematics guarantee that the overwhelming majority lose money.

I’ve written an entire book about this – Remote Readiness for Jobseekers covers the MLM trap in detail, including why expat communities in smaller markets are particularly vulnerable. The short version: if the “job opportunity” requires you to invest before you can earn, and the primary revenue comes from recruitment rather than selling a product to genuine end customers – it’s an MLM, and the odds are stacked against you.

Watch for these signals:

  • “Be your own boss” language combined with an upfront fee
  • Income claims that focus on top earners rather than typical results
  • Pressure to recruit friends and family
  • Products or services that are significantly overpriced compared to market alternatives
  • Emphasis on “the team” and “the community” rather than the actual work

Warning signs – the red flags checklist

8. The 2026 red flags checklist

Print this. Bookmark it. Share it. These are the warning signs that apply across virtually every scam type operating today.

They contacted you first. Legitimate employers rarely cold-message candidates on WhatsApp, Telegram, or SMS. If you didn’t apply, be very cautious.

Communication happens only on messaging apps. Real companies use email, applicant tracking systems, and scheduled video calls – not Telegram channels and WhatsApp groups.

The job description is vague. Genuine remote roles are highly specific about responsibilities, required skills, reporting lines, and compensation. Vagueness is a feature of scams, not a bug.

Unrealistic pay for minimal effort. If someone will pay you handsomely for simple tasks that AI could do in seconds, ask yourself why they need a human at all.

You’re asked to pay something. Training fees, equipment purchases through their vendor, “verification” deposits, background check costs – no legitimate employer charges you to get hired.

Urgency and pressure. “This offer expires today.” “We need someone immediately.” “Don’t miss this opportunity.” Real hiring processes have timelines, not deadlines designed to prevent you from thinking clearly.

The company has no verifiable digital footprint. Search the company name. Check Companies House (UK), the relevant national business registry, or your country’s equivalent. Look for LinkedIn company pages with real employees, Glassdoor reviews, a professional website with verifiable contact details.

Interviews are text-only or feel scripted. While deepfakes complicate this, a refusal to do any live interaction at all is still a major red flag. Real hiring involves real human conversation.

Payment involves crypto, gift cards, or wire transfers. These payment methods are favoured by scammers precisely because they’re difficult or impossible to reverse.

Something feels off. Trust your instincts. If the opportunity feels too good, too easy, or too rushed – pause. A legitimate employer will wait for you to do due diligence. A scammer won’t.

9. What to do if you’ve been scammed

First: don’t blame yourself. These are professional criminal operations, and they target intelligent, motivated people. Shame keeps victims silent, and silence helps scammers operate. Here’s what to do instead.

Report it

The more reports filed, the easier it becomes for law enforcement to identify patterns and shut down operations.

  • UK: Action Fraud – the national fraud and cybercrime reporting centre
  • USA: FBI IC3 – Internet Crime Complaint Centre
  • EU: Europol’s reporting page and your national police cybercrime unit
  • Spain: Policía Nacional or Guardia Civil cybercrime divisions – you can file a denuncia online
  • International: econsumer.gov for cross-border scam reporting

Also report the listing on the platform where you found it – LinkedIn, Indeed, or whichever job board was used. Report scam accounts on WhatsApp, Telegram, and any social media involved.

Protect yourself immediately

  • Change passwords on any accounts that may have been compromised – email, banking, job platforms. Use a password manager and unique passwords for every service.
  • Enable two-factor authentication everywhere you haven’t already – authenticator apps are more secure than SMS codes.
  • Contact your bank if you shared financial information or made any payments. The sooner you act, the better the chance of recovery or freezing transactions.
  • Monitor your credit report for unusual activity – consider a credit freeze if you shared identity documents. In the EU, you can request your data from credit reference agencies under GDPR.
  • Scan your devices for malware if you downloaded any files, apps, or software during the process. Consider a professional security audit if you ran unknown executables or granted remote access.

Seek support

Being scammed can be genuinely traumatic – the financial loss, the breach of trust, the feeling of having been manipulated. You’re not alone. Organisations like Victim Support (UK) offer free, confidential help. Many countries have equivalent services. Don’t underestimate the emotional impact.

Want to go deeper? Maya’s book Remote Readiness for Jobseekers covers the full picture – not just avoiding scams, but building a remote career the right way. The 5Cs framework helps you approach job searching from a position of strength, not desperation. Available as ebook (EUR 4.99), paperback, or free with a Connected membership.

10. How to search safely in 2026

The threat landscape is real, but that doesn’t mean remote work itself is a minefield. Millions of people work remotely, legitimately, every day. The key is knowing where to look and what to look for.

Use verified platforms

Not all job boards are created equal. Prioritise platforms that actively screen listings:

  • FlexJobs – every listing is hand-screened by their research team. Use promo code FLEXLIFE for a discount. It’s a paid service, but the screening is the point.
  • LinkedIn – use verified company pages and check employee counts. Be cautious with direct messages from recruiters you can’t verify.
  • Company career pages directly – if you’re interested in a specific company, go to their website and apply through their official portal. Bypass aggregator sites entirely.

Check the 5Cs framework

In Remote Readiness for Jobseekers, I outline the five things you need to have in place before your remote job search: Clarity (what you want), Competence (what you offer), Connection (your network), Credibility (your online presence), and Confidence (your interview skills). Getting these right not only makes you more employable – it makes you less vulnerable to scams, because you approach the search from a position of strength rather than desperation.

Verify before you engage

  • Research every company before applying. A five-minute search can save you from weeks of wasted effort – or worse.
  • Look for vetted remote-first companies that have established track records and verifiable employees.
  • If you’re considering working through an EOR (Employer of Record), make sure it’s a legitimate, established provider. The rise of fake EOR schemes makes this verification essential.
  • For those considering self-employment in Europe, understand the real requirements – like becoming autónomo in Spain – rather than relying on grey-market intermediaries.

Consider curated communities

One of the most effective defences against scams is never being alone in your job search. Curated communities where job listings are vetted, members share intelligence about suspicious postings, and experienced remote workers can sense-check opportunities for newcomers – these are genuinely protective.

That’s a core part of what we do at RWE. Our Connected membership provides daily curated, scam-free job leads – hand-picked and verified, not scraped from the open web. When you’re searching inside a trusted community, the risk profile changes completely.

Stay alert, stay connected

Remote work scams will continue to evolve. AI will make them more convincing. New platforms will create new attack surfaces. The fundamental dynamics – high demand for remote roles, cross-border complexity, and the anonymity of digital communication – aren’t going away.

But neither is the remote work community. The best protection isn’t paranoia – it’s preparation, verification, and connection to people who’ve been doing this long enough to recognise the patterns.

Share this guide with anyone who’s job-hunting remotely. Talk openly about scams you’ve encountered – the stigma of silence only benefits the criminals. And if something feels wrong, trust that instinct. A real opportunity will still be there after you’ve taken the time to check it out.

The remote working life is absolutely worth pursuing – I’ve been living it since 2000, and it’s given me and my family freedoms I wouldn’t trade for anything. But those freedoms depend on making informed choices, and staying one step ahead of the people who’d exploit your ambition.

You deserve a real remote career, built on genuine opportunities. Just make sure that’s what you’re pursuing.

– Maya Middlemiss, Remote Work Europe

This guide is updated quarterly. Last reviewed: April 2026. If you’ve encountered a scam type not covered here, get in touch – your experience could protect someone else.