That text is a scam

0:08For Alex Salmon, it was just a normal day. until he got the text. I've been getting these texts basically every day, maybe every couple hours. And yeah, I got one. It was a group text, actually. It was a handful of numbers with Filipino country codes. And it was a wonderful job offer. Hi there. Sorry to interrupt. I'm from Indeed. We're currently recruiting remote product testers, U.S.-based. This role lets you earn$50 to$400 per day There's a curiosity, right? It's like, how could this possibly be a real thing? Or who could be on the end of this? Or like, what do they want even? If you're interested and meet the age requirement, please reply yes to receive more details.

0:52And so I said, yes. Just yes, that was it? Yeah. You know, I know how to follow instructions. I just said yes.

1:03We've all gotten these texts. A random recruiter sending a friendly message with an incredible job opportunity to make a lot of money for just a little bit of work. Hi, I'm Rebecca. I'm Isabella. I'm Daniel. We saw your profile in multiple job boards. Multiple online recruitment agencies. I think you'd be a great fit for our current part-time remote position. You'll receive$720 after three days of work. $100 to$500 per day. $2 ,000 per week or more. If you're interested in joining us, please text us at 1-2-7-866-4. The reason you're getting so many is because, unfortunately, they work.

2:03the check was fake. And I was out there at$200 I had since then. Being scammed can feel really embarrassing. But you should know that if it's happened to you, you aren't alone. Last year, the FTC received nearly 250 ,000 reports of tech scams. Americans lost about$500 million to them. I'm John Quillen Hill, and this week on Explain It to Me from Vox, we're going to figure out what the deal is with these scams, how they're pulled off, who's pulling the strings, and what can happen when you take the bait.

2:40Now, Alex from earlier, who replied to that text message job offer, he's actually a reporter for Slate. And he said yes to that job so that he could write about it. When I said yes, when I wanted this job, they were like, someone will reach out to you on WhatsApp and they'll train you. And that someone went by the name of Kathy. My name is Kathy, and I'm a coach from Interleave. I just received a notice from Elena, who works in the recruitment department, that you are looking for a remote part-time job. She would text me basically every day, being like, Let's do the training. Let's get started on this.

3:17This is the best version of yourself. Like, you're going to realize your wildest dreams. She was, like, pretty versed in the grind set. Then one day I got a phone call from a number I didn't recognize, and she was like, It's Kathy from Interleave. Oh. And from the jump, she was what I would call a micromanager. She was like, what is going on? Do you want this job or don't you? And I was like, oh, yeah, yeah, I'm so sorry. And she was like, let's get going. Okay, yeah, sorry, my bad. From then on out, she would call me like we were in touch and she was a real person.

3:57So you take the job. What was the job? What did they have you doing? They told me in broad strokes that like what we were doing was juicing play counts for like low performing songs on Spotify effectively. You know, there would be all these album covers and you would click in the middle of this three by three rubric. And I mean, that was ultimately it at a very basic level. I was just clicking in place over and over and over again. I think it was like click, click, click, click, click, click, click 90 times. That was a completed task. I did three of them a day and that was sort of it. Were you actually kind of working?

4:35It's a great question. It took me a really long time to figure this out, but it is a job that people do and it is something that exists. I think it was just ultimately sort of like a mock-up of that to justify the actual scam, which was finally far cruder and much more elementary. And how are you getting paid in all of this? Yeah, so this is where, if I wasn't going into this eyes wide open, this is probably where, like, the red flags start showing up. They were like, you're going to be paid in cryptocurrency, you're going to be paid in Bitcoin. You know, you have to have a Bitcoin wallet. So Alex set up this wallet, and he was told that in order to move on from task to task, he'd need to maintain a minimum balance.

5:17You need to ensure that the account balance is at least$100 to reset the next set of tasks. And he figured? Why not? He was crushing this job. Kathy was like, you did such a great job at this training. You encountered this thing called a bumble. Bumble. And the result of which is that someone needs to put up$200 to refresh the account because this great thing happened, which is very hard to explain. Um, I think we got to pause. Because what is a bumble? I thought she was saying bundle at first, but she was adamant and continued to text me. It was a bumble. Bumble. B-U-N-B-L-E. According to Kathy, a bumble was like, if you get lucky and you happen in the course of your clicking to click onto a song that's like so low performing that they can put multiple songs together, then you hit a bumble.

6:11and what happens is that you have to put up some money to buy more something to clear up the account but the great news is you get that money back and then a way more money when it when it comes time to cash out that was sort of the day in day out of it it was like do a lot of clicking click click click click click click numbers go up and then every once in a while it hit a bumble and then i would say you know hey we need a couple bucks might have been like 19 i think was the first hit and I was like all right you know I got to see this thing through like I'm happy to patch in $19 so I'd buy that amount in Bitcoin and uh and I would send it over and I had to prove that I'd done it yes and they would refresh my account they would congratulate me for my great work and then I would go back to doing it click click click click click click click yes click click click click click yes click click click yes and then with slightly more money I had to fork over and I would do that yes sometimes it was because if I wanted to level up and get more work I had to put more money in.

7:08It was never like totally explained as to why that was required. I did this job for a while and then I was like, okay, time to cash out. But then every time I tried to cash out, there was always a problem. I would put in my Bitcoin wallet and then they would say like, oh, you didn't, you didn't clear this with the right person. Like Kathy would say, if only you had told me you were cashing out, I could help you. And then she would be upset. You'd be like, no, no, now it's too late. You can't cash out right now. You have to go back to work. When you are done, remember to tell me, and I will teach you how to get another reward.

7:48I think I was on for about six weeks, and there came a time when I was out$96 at that point. She asked at that point for$300, and at that point I felt like I've seen enough. Finally, I was not ever able to cash out. I made many attempts. They were not very well received. And crucially, they did not work.

8:11Alex told Kathy he wanted out. He also finally told her he was a reporter writing a story about scams. Kathy seemed undeterred by that. She still wanted him to stay in the scam. As for Alex, he figured losing 96 bucks made him a lot luckier than other people. You have to, unfortunately, you know, know that like the idea that you might be sending your boss money via cryptocurrency or any sort of other alternative currency, you know, gift cards have become a big part of this. Like those sorts of things should concern you. Like if you have a job, you're probably not sending money to the job. There's a lot of shame around it, too.

8:52I think that once you get down these things, you're like, how could I possibly fall for this? And not wanting to believe that you've fallen for it actually makes you go deeper.

9:03You know, like the few things that exist, the few law enforcement agencies that exist to combat this stuff, like they've seen a hatchet taken to their budget, to their staff, to their administrative capacity. You can report this stuff to the FTC. It's unlikely they're going to be able to do that much for you. Did you ever hear from Kathy again? Kathy will pop up, I want to say once a week, and will say, Hello? What's going on? The tone changes all the time. It goes from stern and scolding to encouraging and concerned. But she still will call me sometimes. I'll get phone calls from her as well.

9:40So ongoing, certainly. I hope you're okay. Why'd you leave? Come back to work.

9:51So that's how these scams play out. And on their face, they're pretty absurd. They're even kind of funny. But if you dig a little deeper, it gets really dark. That's next.

10:12Support for the show comes from Grow Therapy. Everyone thinks they're therapists, especially in the new year, when you might be getting advice from every corner of your life. Your feed, your group chat, even your barista. But here's the thing. Advice isn't therapy. Therapy is therapy. And if you're looking to start therapy with licensed professionals, Grow Therapy is there to help. Grow can connect you with thousands of independent licensed therapists across the country, offering both virtual and in-person sessions. You can search therapists by what matters most to you, like insurance, specialty, identity, or availability, and get started in as little as two days.

10:51And if something comes up, you can cancel up to 24 hours in advance at no cost. Grow says there are no subscriptions and no long-term commitments. You just pay per session. Whatever challenges you're facing, Grow Therapy is here to help. Sessions average about$21 with insurance, and some pay as little as$0, depending on their plan. Visit growtherapy.com slash explained to get started. That's growtherapy.com slash explained. growtherapy.com slash explained. Availability and coverage vary by state and insurance plan.

11:53things. Bombas has great kid socks. I have a three-year-old. She runs around a lot indoors in her socks and she's often slipping on the hardwood floors. But Bombas kid socks have grips on the bottom and they're really great to prevent that slipping around on hardwood or tile floors. So we love those for her. They're definitely our preferred socks for our daughter. Bombas says that for every pair of Bombas you buy, they donate one to someone facing homelessness. Anytime you get something cozy, someone else can too. According to Bombas, you can go to bombas.com slash explain and use code explain for 20 % off.

12:29Your first purchase, that's B-O-M-B-A-S dot com slash explain, code explain to check out.

12:42We're back. This is Explained It to Me. I'm JQ. And today we're trying to figure out what's up with all these text message scams and who's behind them? Matt Burgess writes all about privacy and information security for Wired, and he's reported on one of the main actors in the world of texting scams. It's called the Smishing Triad. Yeah, so over the last three years or so, this group called the Smishing Triad has emerged as one of the most prolific senders of scam messages and they are one of several groups of scammers that are known as smishing syndicates and they've been estimated to be sending 100 ,000 messages per day.

13:28They have around 200 ,000 malicious websites that have been linked to them and these smishing syndicates in general they develop their own software and they sell it to other cyber criminals who may be able to use that software to then go and scam people further, you know, almost in a plug and play style way. And I think some of these Chinese language phishing scamming groups have actually been estimated to be making around a billion dollars in the last couple of years. What are the odds that you or I have gotten a text from the smishing triad? Like, is their reach that big that, you know, they're probably in my phone right now?

14:00There's a good chance of it. The smishing triad has been linked to scam messages in more than 120 different countries and a big one that they do is impersonating in the US, the US Postal Service. A text message from the Postal Service. Wow, I didn't even know they had my cell number. They don't. And they don't send text messages about unclaimed packages. But around the world, they have also impersonated banks. Police say in just the last week, in fact, a handful of people have lost nearly$100 ,000 to this scam. They've impersonated cryptocurrency platforms. It looked like it's from Coinbase sharing a withdrawal code.

14:38It felt like someone was trying to take money from my crypto wallet. E-commerce, healthcare, law enforcement, all kinds of different organizations that may want you to take action, such as clicking onto a website to confirm some details or to get your parcel sent back to you. They are constantly evolving and constantly adapting their software, becoming like targeting more different organizations or impersonating more different organizations. What is smishing? I'm not going to lie, when you say it, it sounds really adorable, but it is not cute. What is it? So yeah, many people may be familiar with phishing to email accounts.

15:14So really, when you're talking about smishing, that is just the SMS text message equivalent of that. But I would say with smishing, because it is via text message and straight to your phone, you will have something that is pinging up. Some of these scam text messages are very successful because they are straight, direct to you that you may be out and about and see a message come in and then respond to it, click on the link straight away without thinking about it. So there's real that direct sense of urgency with a text message that you don't get with an email or another type of phishing scam. So all of these scam texts are being sent, like just so many messages.

15:53How are they doing this? when cyber criminals are collecting phone numbers or other contact details, they can be purchasing these on underground markets, on forums, potentially from data breaches, where we've all seen people having their details linked elsewhere, or possibly even data brokers. And then when it comes around to them sending the messages, they're quite often using automated software on a device, such as a laptop or a computer, where they can have multiple sort of virtual phones running on their screen at the same time and send out multiple thousands of messages from those accounts.

16:27All right. So that's how these texts get to our phones. But I want to get a sense of how it looks to the scammers. Let's say I get a text and there's a link and I click on it. What happens? When you click that link, you'll end up on a website. So if this scam message is coming from allegedly the U.S. Postal Service, you will end up on a website that looks like the U.S. postal service. You'll end up on a website that looks like the bank that scammers are trying to impersonate, which want you to enter your personal details. They might want you to enter your name, your postal address, your bank account details, your financial details, and then the scammers will be collecting these pretty much in real time.

17:11Okay, let's say I get the text. I don't click anything, but I block the number. Will these texts keep coming? Like, is there a way to stop this? Yes. You're not going to get text from that same number, but you may get text from another number or another account that is trying to scam you. So I think that the scale that these scams are happening, people are going to continue to receive scam messages pretty much like on a very frequent basis. I'm curious what tech companies are doing. You know, Apple, Google, they have millions of their own users at risk. What are they doing about it? I think there are a few players that are involved in trying to reduce the amount of scams that are happening around the world.

17:53So you've got the telecoms firms, the companies that own the networks. These websites have to be hosted with a domain company. So those domain companies can be better at blocking scam websites as well. And then, yeah, you've got Apple and Google and other mobile providers as well. A lot of them now are using on-device machine learning to be able to detect the kind of language that is used in these scams. And they are able to better classify some of these scams from happening. I think that they are getting better, but this is a problem that is still affecting everybody very frequently. So there's more to be done in that space.

18:28You know, every era has its own scam. Why are tech scams so widespread right now? They're quick. They're successful, they're making money from them. And I think that because we're all on our phones all of the time and we're getting messages and notifications, it can be easy for anybody to click on these links and enter their financial details.

18:54I think as well, I think once scammers find something that will work for them, whether it is a romance scam or an employment scam or anything else, then they'll keep doing that until it doesn't work. Coming up, the horrifying employment scam on the other side of that text thread.

19:26Support for today's show comes from Rubric. Many companies are deploying AI agents at this time. They automate tasks. They handle workflows. They make decisions. And here is the thing. Sometimes, according to Rubric, they mess up. They might delete the wrong file. They might make changes you didn't authorize. They might go off script. When that happens, you can get stuck trying to figure out what went wrong and how to fix it. Enter Rubric Agent Cloud. Rubric Agent Cloud is a platform that they say lets you monitor, govern, and rewind AI agent actions. It's one platform. They say it helps you use more agents faster and without the risk.

20:08They say it runs in the background. They say it watches what's happening. They say it makes sure things stay on track. They say you can get full visibility. They say you can set guardrails so the agents don't go rogue. If your business relies on AI agents, you need the ability to monitor, govern, and rewind their actions, says Rubrik. Right now, our listeners get exclusive early access to Rubrik Agent Cloud. You can go to rubrik.com. That's R-U-B-R-I-K dot com, rubrik.com.

20:48If you find that you're a victim of a scam, you might call Erin West. She was a prosecutor in California for over two decades. And after seeing so many people get their money taken, she decided to do something about it. She started an organization called Operation Shamrock, And she's investigated scams coming out of Cambodia, Myanmar, all over Southeast Asia. And she found the people on the other side of the phone. Just a heads up, there are some descriptions of violence coming up that might be upsetting to some listeners. I met someone named Small Q. And Small Q is a Ugandan man. Small Q was working in a internet cafe in Uganda.

21:31He's 23 years old. And a fellow Ugandan came in and asked him, I know you're making$100 a month working here. I can get you$1 ,000 a month in a live-work facility in Bangkok. You'll be doing data entry. And so Small Q went through the interview process. He did two interviews. He did a typing test. He was delighted to hear that he got this job where he would literally be making 10 times what he made. So he told his brother, I could give this a shot or I could die poor in Uganda. And when he arrived in Bangkok, they took his phone, they took his passport, drove him for hours and hours. And ultimately, he found himself in a gated, massive walled community with large dormitories.

22:23And the men with AK-47s at the gate told him, you're a scammer now. This is your job. So it sounds like the people who end up being the scammers are actually victims of an employment scam themselves. That's exactly right. This is one of the first times in history we've got this tremendous, massive global crime where there are victims on both sides of it. And so inside these rooms where the scams are happening, people are in fear. That's the horrifying piece of this that people don't understand. on the other side of that text is likely a victim who has been human trafficked to be there. Erin, you've been to some of these compounds.

23:08I'm curious, what do they look like? What do they feel like? It's really horrifying. They are massive, 10-story tall buildings that are residential. They often have bars on the windows literally to keep the people from jumping out. It's dozens and dozens along the Moy River in Myanmar. It's hundreds in Cambodia. It's dozens in Laos. The scale of this is incomprehensible. Wow. And who's behind these massive compounds? Chinese organized criminals are no strangers to the gambling industry. And in combination with a road that China was building in Cambodia, Chinese organized criminals thought we should fill this area with casino towers.

24:04But COVID hit. And so when their casino towers sat empty, they had to pivot. So they decided they were going to do this. That's when they started the human trafficking angle on it. I want to get back to the story of Small Q. When people like Small Q arrive, what happens next? His day then becomes, okay, you're a scammer and you are living your life on the awake hours of the United States or whoever you're targeting. And Small Q's day would then be to report to a long table of people just like him, forced to be working on a desktop computer and 10 phones. and the way it works is there are different roles within this facility.

24:50So when you come in, you are one of the people who is trying to locate new contacts, new clients, they call them. Once you've been there a while, you elevate to becoming a chatter. And when you are a chatter, you have, they call it their model, their profile that they use. And every day they submit at the end of the day to their boss what their character will be doing that day. It sounds so oddly corporate. I'm glad you picked up on the corporate nature of this. You're on a team and there's very much a corporate incentive strategy for what's happening there. So if small Q were to be able to be successful and scam money from someone, that's a big win.