Pig Butchers Enter the Gig Economy, Targeting Job Seekers in Cryptocurrency Scams
In a recent report, Proofpoint reveals how cybercriminals have evolved their tactics, preying on job seekers with fraudulent job offers that ultimately drain victims’ cryptocurrency wallets. These “Pig Butcher” scams, historically reliant on elaborate investment schemes, have now transitioned into gig economy scams, offering fake remote jobs to unsuspecting victims.
Traditionally, Pig Butcher scams entice victims with promises of high returns on cryptocurrency investments. Proofpoint describes the classic scheme: “Once a target’s initial small investment starts turning into a large (but fake) ‘profit,’ the scammers pressure the victim to invest vast sums of money.” Victims are soon left with nothing, realizing too late that their profits were fabricated and their investments lost.
Pig Butcher scammers have now pivoted to remote job scams, capitalizing on the growing demand for work-from-home opportunities. Typically, the scam begins with an unsolicited message on platforms like SMS, WhatsApp, or social media, posing as a recruiter for a “remote” job. Once the target expresses interest, the scammers introduce them to a phony “work platform” where they perform repetitive tasks, such as boosting music streams or reviewing hotel services, tasks commonly known as click farming.
After registering on a malicious website using a referral code, victims are asked to share screenshots of their profiles, furthering the illusion of a legitimate employment process. Proofpoint details the bait-and-switch tactic that follows: “The handler does not give a clear explanation as to why the account balance was reduced to zero, but claims it is good for the victim.” Here, scammers convince victims they are “lucky” to encounter a negative balance that, once “cleared,” will supposedly unlock higher payouts.
The scammers expertly exploit psychological factors to manipulate victims into compliance. Proofpoint’s resident psychologist, Dr. Bob Hausmann, highlights three key mechanisms: the sunk cost fallacy, loss aversion, and the principle of reciprocity. These mechanisms make it psychologically difficult for victims to abandon the scam, even as they invest more money. Dr. Hausmann explains, “The job scam victim likely feels they have put too much time and effort into making a perceived sum,” and thus continues paying into the fake platform to avoid the emotional toll of loss.
By tracking cryptocurrency transactions linked to these scams, Proofpoint and its partner, Chainalysis, found that some job scam sites have reaped substantial profits in a short time. The website “temu-workbench[.]com” alone recorded over 1,000 deposits in a single month, totaling $275,203. Other sites impersonating major brands like TikTok and Outlier Ventures also show staggering amounts of cryptocurrency flowing into scam wallets.
Proofpoint’s report concludes with advice for staying safe from these scams:
- Be wary of unsolicited job offers on any platform.
- Never provide payment to a supposed employer.
- Trust your instincts: if an offer seems too good to be true, it likely is.
