Digital Nomad Remote Job Hunting Fraud Prevention Guide: Your Wallet Could Be Emptied Even Before the Interview Starts

Author: TT3LABS, Remote Recruitment Platform

Remote job hunting allows you to search for jobs across cities and countries, offering opportunities to connect globally. However, working entirely remotely from employers and colleagues, often with stablecoins for salary payments, and recruitment frequently conducted via TG private messages and emails makes it harder to verify the legitimacy of positions compared to in-person interviews. Scammers posing as recruiters are also more common than in offline settings.

This guide compiles scam tactics actually encountered and reported by members of the TT3Labs community, categorized by "What the Scammer Wants from You," and includes some practices to avoid pitfalls. We also welcome everyone to share their remote job hunting experiences in the community. Each real experience shared could help others avoid a trap.

Real Case Study

First, a Real Story

A member of the community shared a complete scam encounter:

Someone proactively contacted him on TG, claiming to have an operations role at a project. They asked for his resume, quickly replied "Passed initial screening," and scheduled an interview. Before the interview, he requested project materials, and the other party sent a GitBook link. The link itself was legitimate, but the project documentation hadn't been updated for a year.

During the interview stage, the first round was on Zoom. The interviewer was a "foreigner" with poor Chinese, claiming to be French. However, this friend had studied in France and immediately recognized the accent as fake. The interview was superficial and hastily passed, after which the other party rushed to schedule a second round.

The second round was scheduled for 4 PM. The other party sent the meeting link precisely at 4 PM, using an obscure software he'd never heard of. He couldn't open it and suggested switching to Zoom, Google Meet, or Lark. The other party immediately retorted: "Don't deceive me, this link can be opened by anyone." He insisted on refusing, and the other party instantly deleted the TG chat history.

If he had clicked the link and installed that "meeting plugin," what would have followed is: the plugin would request microphone and speaker permissions, then run a command in the background, essentially installing malware to scan his computer for wallets, passwords, and private keys. The interview was fake, the job was fake, and the company might not even exist.

Looking back, three things were off about this interview:

1. The project materials hadn't been updated in a year. They claimed to be hiring, but no one touched the documentation.
2. Claimed to be French, but the accent was wrong.
3. Sent the link exactly on the hour using unfamiliar software. This exploited the job seeker's eagerness, making them lower their guard.

Part One

What Do Scammers Actually Want?

There are dozens of common scam tactics; it's normal not to remember them all. But scammers ultimately want one of three things:

1. Access to your devices and wallets
2. Your money directly
3. Your identity information

When encountering a suspicious or odd interviewer, ask yourself: what does he actually want to take from you? The answer often becomes clear.

Most Common: Your Device Control and Wallets

This type is most frequently reported in the community. The common denominator is simple: at some step, they ask you to install or run something on your computer.

• Ask you to download an unfamiliar meeting software. Common video interview tools are Zoom, Google Meet, Lark, and a few others. Scammers send you a tool with an unknown name; installing it deploys malware designed to steal wallets and create backdoors, affecting both Mac and Windows.
• Upon joining the meeting, they say "Can't hear you," asking you to install a plugin or adjust backend permissions. This is the actual attack point. The plugin is malware; "adjusting backend commands" grants it authorization, giving it access to your device permissions.
• Turn the coding test into malware. For developer roles, the interview task asks you to clone a repo and run it locally. The code contains hidden elements specifically targeting wallet extensions, browser-stored passwords, SSH keys.
• No download required, just "paste a command." A newer tactic. Uses a fake verification page or says "Your audio seems off, follow the prompts," guiding you to copy and run a command. No download action makes it harder to detect.
• Pretend to "help you operate" by asking you to share your screen. They seize the chance to see you enter passwords, verification codes.
• Ask you to connect your wallet under the pretext of "seeing your blockchain experience." Once you connect a real wallet and sign the authorization, assets can be transferred instantly.

From running the code to assets being transferred, it often takes just seconds to minutes.

After Your Money Directly

Common old tactics, also seen offline, work remotely too.

• "Pre-employment test" is actually task farming (like click-farming). You're asked to perform "test tasks": advance money, complete orders, "donate" to a project. The first few transactions give you small returns as a sweetener. As you invest more, large amounts become non-withdrawable. They then claim "operational error" and ask you to compensate.
• Paid internal referral, guaranteed offer. Someone charges you money, promising guaranteed entry into a certain big company or project. This can usually be dismissed outright; legitimate recruitment doesn't charge candidates. If you spend money job hunting, it should at most be for career coaching or resume editing. No one can buy a real job offer from a stranger with money.
• Training loans, employment loans. Under the guise of "train first, then work," they induce you to take out loans to pay fees.

After Your Identity

• Asking for ID card, passport, bank card, or a selfie holding ID before you've even started. These are used to create fake identities for opening accounts, taking loans, fraudulent charges, or using your accounts as money laundering channels.
• Legitimate companies conduct background checks, but typically after you've signed the contract and officially joined, not during the interview stage.

Another Category to Warn About: Not Getting Paid After Joining

Not all risks come from fake companies. Some companies are real, and you join, but the company uses excuses like "hard to verify remotely" or "hard to chase cross-border" to withhold or delay wages, most commonly the last month's pay before resignation. Due to remote work and cross-border issues, this money is hard to recover, which is why they dare to do it. Checking the company's reputation before joining and asking in communities can help avoid some problematic companies.

Part Two

The Common Look of Almost All Scams

The following signals aren't much individually, but several appearing together warrant caution.

• Too good to be true. The most common one: low barriers to entry but unrealistically high salary, overly lax interview (constantly praising you, asking no substantive questions). Combined, it's suspicious. Even if you don't understand the tech, the feeling of "too good to be true" is common, and your gut feeling is often right.
• Only willing to discuss in private chat. The other party proactively contacts you, provides no company information, communicates entirely via encrypted tools like TG, refuses phone calls, won't show their face, and won't use major meeting software.
• Rushing. Eager to schedule the next interview but sends the link exactly at the scheduled time. Normal interviews send the link after scheduling; sending it precisely on the hour gives you no time to verify, making you flustered.
• Offering to pay you before you even start. Some scammers proactively mention advance salary, signing bonuses, joining bonuses, appearing very sincere. This is mostly to make you invested, afraid to miss out, and neglect proper verification. When someone fixates on that money, they tend to overlook necessary checks.
• Communication feels odd. Their dialogue sounds machine-translated, with awkward titles, sentence structure, and word choice; claims to be from a certain country, but accent doesn't match. Often, it's an overseas group using translation software to impersonate a local HR.

That said, stilted language alone doesn't equal a scam. Many legitimate overseas teams and foreign recruiters also use translation tools to communicate with candidates. Poor English or Chinese doesn't equal a scam. It's more accurate to look at several signals together.

Relying on remembering names to prevent scams isn't very effective. Scammers change aliases frequently; today's account, software name, tomorrow it's different. Keeping lists can't keep up, but understanding these basic logics can help avoid many pitfalls.

Part Three

Self-Protection Strategies

In remote settings, you often can't verify the other party's authenticity. So "seeing through scams" itself isn't very reliable. Change your mindset: regardless of their authenticity, there are a few things you can verify yourself and some bottom lines you can hold.

Things you can verify yourself, roughly three categories.

• Use trusted channels. A safer approach is to only recognize entrances you find yourself. To confirm a company is hiring, go to trusted job platforms, official websites to find the careers page yourself, rather than casually clicking links, domains, or QR codes sent by others. The same for meetings: even if they send a link, download the official app from the meeting software's website and enter using the meeting ID yourself.
• Check the HR's background. See if this HR is a specific, real person online, e.g., on LinkedIn or other verified platforms. You can also quickly check the materials they provide, like whether update times are correct, like the "GitBook not updated for a year" from the opening story. Another method: casually ask a culturally specific question. Machine translation and non-native speakers easily give themselves away. Some scammers, unable to answer, simply hang up the interview.
• Watch what they ask you to do. This is most useful because it's independent of the company's authenticity. Before a formal job offer, legitimate companies won't ask you to install unfamiliar software, run commands, pay fees, hand over wallets or private keys, perform "tests" involving money transfers, or demand secrecy from everyone.

Device isolation is also crucial. Don't install software they request on your daily-use phone or computer; don't connect real wallets; don't pay money; don't hand over documents or private keys. This way, even if the other party is a scammer, it's hard for them to take information or assets from you.

If a developer needs to run code provided by the other party, it's much safer to run it outside the main machine, such as in a clean virtual machine, sandbox, or a separate empty device. This also has the benefit of allowing you to confidently discuss early-stage or confidential projects.

Part Four

Several Hard-to-Judge Situations

• Early-stage projects, naturally scarce information. Scarce information is normal for some early-stage projects, not necessarily a scam. Real early-stage projects have shallow but genuine traces: founders have public identities predating the project, verifiable funding, contracts, or code repositories. Scams are often the opposite: fancy website, but behind it are mostly new accounts, with no traceable, real person with a past.
• Claims of confidentiality, won't give company name. Confidentiality applies to the project itself, like the product, token, or unannounced plans. But the HR talking to you usually doesn't need to hide their own identity. Proper confidentiality is about you leaking project information. This kind of "confidentiality" is the opposite—they're afraid you'll verify them.
• Claims to be a big company HR, with complete materials. The company is real; the question is whether this person is truly from that company. First, check the email domain: is it the company's official domain, or Gmail, a lookalike domain, a knockoff domain with a suffix? Prefer official email, recruitment systems, verified LinkedIn for process steps.

Part Five

If You've Already Been Compromised, What to Do

Do the following as quickly as possible, roughly in this order.

1. Disconnect from the internet immediately, then shut down the device. While the malware is active, it can see any remedial actions you take on that machine.
2. Switch to a clean device. Transfer any remaining assets in your wallet to a new address, starting with the valuable ones. Consider the original wallet as compromised; do not use it again.
3. On the clean device, change passwords for important accounts and enable two-factor authentication everywhere.
4. Take screenshots of chat records, transfer records, the other party's account, and links. Save them, and also post them to community exposure boards to warn others who haven't been targeted.
5. File a police report. The chance of recovering funds from some cross-border scams isn't high; be mentally prepared. But filing a report is still worthwhile, for the sake of having a case record and leaving a trail.

Everything has two sides. Remote work offers more freedom but also breeds more scams and traps. The job hunting journey is already challenging, and scammers often exploit job seekers' anxiety, which can lead to greater harm than just a failed interview. We hope everyone can enhance their fraud prevention awareness and successfully find their ideal jobs.