Ep. 273: “Profiler Jay Jones Takes on Fake Job Scams”

“What the Hack?” is DeleteMe’s true cybercrime podcast hosted by Beau Friedlander.

Disclaimer: This transcript was auto-generated and may include minor errors.

Beau: There’s some basic advice everyone gets after a layoff. Don’t take it personally. Polish the resume, right? And post that you’re looking for a job on LinkedIn.

Jay: And then literally within twenty minutes or an hour, you get a bunch of messages in your inbox stating that they have a position that’s perfect for you, and they wanna get your resume.

Beau: Have you ever stopped to wonder if the person who got in touch with you after you lost your job and you’re looking for a job, or you have a job and you’re not looking for a job, but that recruiter, quote unquote recruiter, is actually a recruiter?

Jay: It started with this fake company called Ten Star Resume Limited, they had over three thousand fake profiles.

Beau: And what happens next? Maybe you lose some money, or months later you get a rejection letter for a job you never even applied for.

Jay: And I look at it and I’m like, “Well, somebody did apply because you got that email.” “Somebody applied to that job as you,”

Beau: Today we’re talking about the resume trap, which is when a fake resume writer gets in touch with you, and the rest is, if you take the bait, history. Your history, not the part of the history that you wanna be telling in books anyway.

Jay: Because it’s not just general scam awareness. Like no, this is economic terrorism.

Beau: I’m Beau Friedlander, and this is “What the Hack?” The podcast that asks, in a world where your data is everywhere, how do you stay safe online?

Start

Beau: Jay Jones is also known as The Profiler. He is a force of one, like think Chuck Norris, but cyber. He’s going after folks that post fake jobs. And if you think like he’s going after a few people, maybe he’s gotten like 10 or 20, he’s not on “What The Hack” because he got 10 or 20. He’s on “What The Hack” because he’s taken down more than 58,000 jobs. Jay Jones, I think I just got that number right. What’s the right number?

Jay: It’s fifty-eight thousand five hundred and fifty-nine. Fifty-eight thousand four hundred and nine were on LinkedIn, and an additional hundred and fifty fake jobs were on Teal’s website.

Beau: So not to put too fine a point on it, a lot

Jay: Yeah, I mean, it’s a sad reality, but, you know, when I saw this problem in the beginning, I knew something had to be done about it, and so it progressed to where it is now.

Origin Story

Beau: Before Jay was the profiler, he was a 19-year-old college student who woke up to a surprising phone call saying that somebody was using his identity to take out credit cards. Now, if you’ve listened to this show for a while, you know that it’s really quite common for an identity thief to be someone you know. In fact, it’s really, really common for it to be a family member. And the reason is obvious, right? They don’t need to steal anything. They have access to everything. The only thing they might need is your Social Security number, and come on, let’s face it, that can be had in your home. Somebody knows it. Somebody has it written down somewhere. Today, of course, everyone has your data, every company out there that deals and traffics in data. People search sites, data brokers, breaches, and as we’re about to find out, a so-called recruiter sliding into your LinkedIn inbox. Feh. But the rule hasn’t changed. Whoever gets your information can really mess up your life.

Jay: I woke up one morning in college, and I got a call from Capital One stating that I owed over $6,000 in credit card debt, but the problem was I never had a credit card. And I’m sitting here, like, scared. I’m thinking I’m gonna get arrested. I don’t know what to do. And so I’m trying to work with Capital One. I’m like, “Hey, I didn’t open this credit card. Can you send me a statement?” But they thought I was being dishonest, and so they wouldn’t comply at first. So I had to go file a police report, and then I was doing research into how identity theft happens. And as you said, the most common perpetrators are immediate family. So I ruled out my mother and my sister, and then I started to focus in on my brother, and I was like, “Well, he wouldn’t do that,” ’cause, you know, I looked up to him as a father figure. And then I remembered when my sister took him and I to Las Vegas for a trip back when I was 17 to go look at the mountains and stuff, and we were at the Johnny Rockets at the Pittsburgh Airport, and some cards fell out of his wallet, and one of them had my name on it. And I asked him, I said, “Hey,” you know, “what’s that about?” And he said, oh, he was just using it to build my credit. So I wrote it off ’cause I was like, yeah, I trusted him, looked up to him. And then later on down the line, I moved out of my mother’s house. This is going back in time a bit. I was 15, and I moved out of my mother’s house, and I stayed with him that summer for about two months. And another thing that is required for identity theft is your Social. So I was like, “Well, how did he get my Social if I never gave it to him?” But then I remembered one time out of the blue, he called me, and he asked if he could claim me on his taxes since I stayed with him for two months. But the problem is you have to stay with somebody for an entire calendar year in order to claim them on their taxes, and I didn’t know that at the time. But when I started to look into this, that’s when I figured this out. So the last nail in the coffin, so to speak, was to get the statement from Capital One showing the address where the statements were delivered to. And so finally, when I showed them the police report, I showed them all the steps I was taking to actually figure this out, the holds I put on my credit report, they’re like, “Okay, this guy is not actually lying. He’s telling the truth.” And so they sent me the statement, and then it had his address on it, and so that’s when I knew he did it.

Beau: Incredible. So you know exactly what it feels like to have somebody use your data against you.

Jay: Yeah, and that’s why I don’t want anybody to feel that feeling. I don’t want anybody to wake up and realize that they’ve been defrauded, that they’ve lost their livelihood essentially because that could have just as easily been $6,000 out of a personal bank account ’cause that happens with these fake checks that get deposited. I carry that with me, and the purpose that I went through that was to do this work, so it worked together in the end.

Beau: Every time something bad happens in my life, I have been taught to ask this question, and it sounds like you did it. And the question is this: What’s the gift in it? And you’re like, “There’s no gift in it.” You’re like, “No, there is. Just gotta find it.”

Jay: Nothing we go through is for ourselves. Everything that we go through is to help, like, the next generation. So, like, if you were abused as a kid, then you know how to educate other kids on to avoid the signs of abuse or educate parents on how to try a different method with their children. And so, we have to be less selfish and more considerate in this time because it’s more cutthroat, it’s more robotic, obviously with the AI thing, and humanity is where we need to get back to.

Fast Forward to Today

Beau: And maybe it’s in that spirit that Jay got into the business of not just exposing scams, but taking them down because years after that phone call, the scammers came for him again. Different scam, but the same feeling ’cause it really is. I can tell you my scams were more cons that I fell for in real time, and they weren’t online, the ones that I’ve fallen for. But anyway, the feeling does suck, tell you that. And anyway, the second time he wasn’t in college. He had just gotten laid off. He was a copywriter working for an ad agency looking for his next job.

Jay: I was laid off in December of 2023, and you know what people are told being job seekers, it says, “Go to LinkedIn, put up your resume, put up the open to work banner, and all the opportunities will come flooding in.” But the problem is people aren’t told the true nature of the problem and what happens the second you put up that green banner. Because scammers, they infest the platform. They use bots to target people that use that banner. And then literally within twenty minutes or an hour, you get a bunch of messages in your inbox from fake resume writers, fake recruiters, fake hiring managers stating that they have a position that’s perfect for you, and they wanna get your resume. And so when they targeted me, which it started with this fake company called Ten Star Resume Limited, they had over three thousand fake profiles that all claimed to be resume writers out of Pakistan. But what tipped me off to something was strange was that they all had attractive women pretty much, like for ninety-five percent of these profiles, and they count on people falling for the attractiveness of the person reaching out to them to make them go into actually engaging.

Beau: When you first put up that green banner, how long was it before you started to receive the attack of the bots?

Jay: Between 20 minutes to two hours. Literally it’s pretty fast and, you know, they target people that use it because they know you’re in a heightened state of alertness and you’re trying to quickly get another role, and the main gatekeeper to your next opportunity is your resume. And so what they do is they know nine times out of 10 if you’re entering the job market, you don’t know what’s going on and you think it’s wise to tailor your resume, which it is. But what they do is they stopgap or insert themselves into the process before the real resume writers can reach you and claim to be resume writers that are certified because I’ve seen them falsify documents and basically forge resume certificates, and I did a case many months ago about that showing how they actually did it.

Beau: Tell me about the forging. Like, what does that even mean? What is a certificate?

Jay: So, a certified professional resume writer, it is a certificate that’s given to resume writers who go through the courses and the training through the PARWCC, and that’s the Professional Association of Resume Writers. And basically, they commit themselves to this business to help people get jobs, and so they go through the training. Same thing as like cybersecurity certificates and whatnot. But what these scammers did is they doctored the certificate because I looked at it and then the guy’s name was Sangin Khan, and it was where he claimed to be a certified resume writer, but when I checked the website, he didn’t appear there, and I checked other websites, and his name didn’t appear on the official directory. Now, there are instances where a certified resume writer doesn’t appear because they didn’t pay their dues, but this wasn’t the case with him. He had never been certified. And I was looking at the font, and I was like, “Well, why is this different?” And I was like, “If I was gonna reverse engineer this, how would I do it?” And so I looked at it, and then I remembered that there’s this website called WhatTheFont. And so basically, you take a screenshot of the font and paste it in there, and it approximates the match of or the closest approximation to that font. And so I was like, “Okay, that’s how he did it,” because what happened was his name was off-centered slightly on the certificate, and when I was looking at real certificates, there was a certain format, a certain color, and a certain layout that all of these certificates had that his didn’t. And so when I pieced it together, I was like, “That’s how he did it.” They doctored it using that website, and then they would copy it, take it into Microsoft Word, put a white text box over that area where the real person’s name was, and then put that font that they detected into that space with their name to make it look like they were certified.

Beau: You did the thing that all anti-scammer people do. What you described was noticing difference then verifying difference, right? You noticed something was a little bit off, and then you verified it.

Why are there Scammers

Beau: Spot the difference, verify it. That’s the whole job. But when you’re looking at these postings, these fake job postings, and something feels off, I mean, imagine it’s more than just font choice, right? What are you actually looking for?

Jay: I’m looking for common job titles that these scammers use that attract people. So data entry assistant, customer service representative, systems engineer, and a few others.

Beau: So these are like, entry level jobs, you know, at these like supposed like from the mail room to the boardroom, you know, we think of as an organization. So the mail room’s the entry level job, data entry might be that entry level job. We’re talking about jobs that pay somewhere between, I would imagine 15 and 25 or $30 an hour, right?

Jay: Correct. Yeah.

Beau: Why IT? Why, you know, entry-level IT, entry-level data entry? Why is that something that’s interesting?

Jay: The goal is getting the information from the targets who apply to these jobs, and then taking that information and applying to real US companies as those people as an impersonation tactic.

Beau: So this is actually two scams. Scam one, the fake job. You apply, you hand over your resume, your work history, maybe your Social Security number if you haven’t listened to this show for years. Otherwise, slap, slap, slap. Why would you do that? And now they have your identity, right? Scam number two, they then take your identity and apply for a real job at a real company as you. So talk about that second part, right? Say they get hired, say they’re sitting in a data entry job. Why? What do they do now? Why do they want that?

Jay: If they get hired in these US companies, then they have access to all of this data from these companies, and then they can then scale it, sell it to data brokers and whatnot. Because these roles, if you look at it, basically they look like boilerplate or like bottom of the rung type titles. But when you actually look at it from the perspective of the information that these roles are responsible for, then you begin to see why they target people in this manner. Because a data entry person, they have access to a ton of information. A customer service representative gets information from the people that they speak to. Most people focus on the salary and they want big salaries, but it’s the keys to the information that these jobs have. A data entry person, they get a spreadsheet of a bunch of information that they have to enter. It can contain account numbers, it can contain invoice numbers, it can contain the amounts that these invoices are for. And the goal of infiltrating US companies to be data entry specialists is to have access to all of this information and then learn how the companies that do business with the company they’ve infiltrated, how they invoice, how they communicate, who are the contacts for these actual companies that are doing business. And then once they get a handle on how the invoices are processed, who the point person is, how the invoices are sent and communicated, that’s when they’ll put in a fraudulent invoice that is impersonating the company that the one they’ve infiltrated already knows. And then by the time they realize that that hundred thousand dollars or more that they paid out was wrong, it’s too late. Like I had actually a gentleman I gave a ride a few weeks ago ’cause I was driving Uber, and he said that a friend of his in the manufacturing space actually got burned for a hundred thousand in that exact way, where they sent an invoice to someone they thought was the actual company they normally do business with. But then when the CEO is like, “Hey, what is this for?” That’s when they realized the nature of the problem.

Beau: You know, so you’re basically describing, remember Roger “Verbal” Kint from the Usual Suspects? Remember verbal?

Jay: Uh, barbershop quartet in Skokie, Illinois.

Beau: Yeah, Verbal. I mean, Verbal’s sitting there like blobbity bloing through like everybody who it could’ve been and what did happen and what might not have happened. However, he’s actually Keyser Söze.

Jay: Is one of the greatest plot twists in movie history.

Beau: With the Keyser Söze plot twist, like this is… We’re talking about the moment before the big reveal in The Sixth Sense. We’re talking about the person that wants to be there or the group of people that an organization wants in place so they can get the data that they can use to perform other things that do figure on the level of crime, big crime. Talk about that.

Jay: So they play dumb, and the goal, like I said, is to always infiltrate the business that they’re targeting. And, you know, when you see these job postings, ’cause that’s the other thing you touched on, you know, the playing dumb from the verbal chem perspective, because I’ve seen profiles where they’ll post things on LinkedIn that are blatantly political to draw a reaction out of people. They’ll post things that are ridiculous to cause an incendiary response from people. And I tell people, “Don’t even respond to that post,” because even if they never reach out to you with a fake job or even if they never try to scam you in some other way, just the fact that they got a response from you, it lets them know where to map you, like from a political standpoint or for a psychological standpoint based upon what you respond to, what triggers you, and then they can either show you more of that or less of that. And so for example, let’s say they put up a political post and it’s right-leaning, but you’re left-leaning, and then you say, “This is ridiculous. I believe we should do things like this, this, and this.” That can actually lead to, like, voting fraud emails that come to you where it’s like, “This candidate is about the exact same thing you’re about, and if you send money to this person’s campaign, then you’ll be helping change the tide in your favor,” or whatnot. Like, these are the things that they’re all trying to get. It’s the data that’s the most valuable thing. Like, money still has value, obviously, but data is exponentially more valuable, and that’s what they try to extract from people by getting them to respond emotionally, getting them to share as much information as possible in the hopes that they look legitimate, ’cause that’s what I tell people as well.

Beau: Now, who are they? Quote unquote they.

Jay: There are bad operators, threat actors out of India, Pakistan, North Korea, Nigeria, the Philippines, Cambodia, and these are massive operations where they have dedicated floors, dedicated teams, and their whole business model, quote-unquote, is “scamming.” It’s a way of life, and that’s how they fuel the economy. It’s how they live this extravagant lifestyle that some of them do, and those are the primary ones that do this.

How the Job Scam Works

Beau: Okay, so it’s not just one random bad actor like I don’t know, Pauly Shore. Can I say Hulk Hogan? Was he even an actor? Ugh, I don’t know. I feel bad now. They’re all fine. Anyway, this is a team. This is an operation. So what do they do? Like, what’s the move? How do they actually get you on the hook?

Jay: So the scammers come in and they say, “You’re a wonderful candidate. They can’t believe that someone like you is in the market and this position is a perfect match for you.” And because your brain is used to hearing the negative, you’ll gravitate to this new sensation or this feeling that this message gives you. And so it’s love bombing because they’re praising you, they’re overly complimentary, overly flattering, and you’re thinking like, “Yeah, this is me. This is what I need to hear.”

Beau: I do belong at Anthropic. I do want that $300,000 a year.

Jay: Yeah, of course, yeah. Yeah, just sign on the dotted line. Yeah. That’s what they do.

Beau: And it’s as exactly as it sounds, just like you’re perfect for this. It sounds like they’re making sure you don’t slip through their fingers.

Jay: Yeah, that’s another thing too that these scammers do. Like, when they get you on the line, and then let’s say like you step away for coffee or you step away to get lunch or something, you’ll see nine times out of ten they’ll say in the message like, “Are you still there?” Because they’re trying to make sure you’re still on the line, still active and engaged. Because they have a small window of time to like close you and get your money as quick as possible. And so any type of deviation or any break in the conversation gets them off script, and then that’s when they start to falter. So scammers thrive when it’s A, B, C, D, E, F, G, close and disappear. But when you go A, B, C, D, “Hey, I have a question about this,” or, “Hey, can you tell me about this feature or this role?” And, “How did you get into this company and whatnot?” They have to then think on the fly, which they can’t, because they operate best when they have a template, and they follow that template all the way to getting your information and money.

Beau: They have a script, and if you ask them a question that throws them off script, I mean, they’ll even just discontinue conversations, won’t they?

Jay: Yeah, because the goal is to keep the fake profile alive as long as possible. So what I tell job seekers is, when you see a conversation that is progressing like it’s gonna be a job offer or an interview, but then suddenly you either stop talking to them or you ask questions that they don’t have the answer to, in the inbox on LinkedIn, their profile will turn into LinkedIn member because it means one of two things. They’ve blocked you, so you can’t expose that profile to your network and say, “Hey, this is what they’re doing. This is how they’re targeting people,” or they abandon the profile entirely and start with another one.

Beau: And these scammers, if you’re wondering, we are talking about if you missed the episodes about scam compounds that we did earlier in the year, I recommend you listen to them because a lot of this kind of communication, these aren’t calls, are coming out of scam compounds. But they’re not only coming out of scam compounds. Scam compounds, at least in Southeast Asia, ’cause most of those are calls. They’re trying to get you on the phone. Okay, but here we’re dealing with the scammer profile, which is, in this case, what we’re talking about is resume writing. They just wanna get the amount of money that they have coming to them for writing a resume, and they may or may not give you an AI resume that, you know. But, what kind of money are we talking about with these resumes?

Jay: So a typical resume costs like three to five hundred dollars when it’s done professionally, and they’ll go with that offer at first. But then if you’re like a C-suite or executive person, those resumes are more expensive between eight hundred to a thousand dollars because if you land a job as an executive, you’re looking at easy two hundred thousand plus a year. So that investment is nominal, and that’s what they charge people. And so they get them into the scammer pipeline, what I call it. And so it can either stop there where they get your money and either give you a subpar resume, or they get the money and block you and disappear. But the way that they get the information from you as much as they can is they then turn around and say– ’cause preceding the resume offer, they say they have an expert that can help you, and they’re pretending to be someone else. The expert is actually them. And so they get you to work with their expert, you pay that money, and then what they can do is either block you, like I said before, or walk it further and say, “Now you qualify for this position. You’re ready.” The offer comes, the onboarding process is set for you. But before that is the background check, and then that’s how they get the Social Security number and the driver’s license out of you. And they get your identity to do identity theft. And actually, there was this woman back in December. On December second, twenty twenty-five, she reached out to me because she saw one of my cases about Inphynx Health because there was this one job posting that was called Infinix Health, and it was pretending to be Inphynx Health, which is a real healthcare organization. And now this job posting was designed to draw people in, and it was part of a home desktop scam where they say, once you’re onboarded and once you get the offer, you get a check in the mail, you buy the equipment through their approved vendor, which is them pretending to be someone else, and then you deposit the check, and you keep the difference. But she saw my case and asked me what was actually going on with this, and I told her, “Hey, they’re impersonating this company.” They actually went as far as taking a screenshot of a real recruiter’s profile on LinkedIn who was dormant and then putting that in the signature of the email that they sent her to make her think it was real. So an untrained job seeker will see an official profile that has premium on LinkedIn, no activity, so it just looks like she’s just randomly messaging people for job opportunities and is intentional with the profile. But really, it was a way to multilayer the deception. So this woman, she had a check for three thousand four hundred and fifty dollars, and I’m like, “Send me a screenshot of it.” And I’m like, “No, this is fraudulent. Do not deposit it.” Because in the upper left-hand corner, it had Prisma Health. In the middle, it had Bank of America, but it didn’t have the official Bank of America logo. And then in the bottom left, it had Ivory Systems, which is another company they were impersonating. So they were impersonating two different companies, one recruiter, and impersonating the Bank of America. So yeah.

Beau: Coming up, ever gotten a rejection letter for a job you never applied for? Did you just think it was spam? Did you just think it was a mistake? Yeah, might not have been.

C Break 1

Beau: It’s crazy that there’s that much information that I did not even know existed. And I think that’s true for a lot of people. Now, so if you’re listening to this and you’re thinking, “Resume writer? Certified resume writer? 800 bucks?” And you’re like, “No wonder I’m still in the mail room,” it might be why, and you might wanna find a good resume writer. But beware, because there’s a lot of fakes out there. Yeah, so how does one find the real McCoy?

Jay: You can go to parwcc.com, I believe, but it’s the Professional Association of Resume Writers. A few that come to mind are like Ashley Watkins Thomas, she’s one that’s helped me in the past. And then Margaret Fair, she’s actually the chair of the whole organization, so they’re all legitimate. And, you know, when I started this work and I saw what they were doing, the scammers, to the real resume writers, that’s what bothered me the most, is because these are real people that dedicated their lives to helping people get in the best position to find another job, and then meanwhile, their content is being stolen. These fake resume writers, they would actually take templates from the real resume writers and pass those templates off as their own creations. They do that routinely on Fiverr and Upwork. And so it’s like you’re literally taking food off of people’s plates and money out of their family’s ability to survive and support themselves. And the resume is literally the thing that opens the door for you nine times out of ten. Like, when you get into the executive spaces of job searching, that is due to like headhunting and stuff. So the application part, that really kind of goes away when you get to those levels of work. But for the masses, it’s a resume, it’s applying, it’s doing outreach and trying to get into the door that way. And so when they intercept, the scammers, the people who need this help the most at the very first step, that can cripple your chances because it leaves you guessing. Because what I tell people is like, if your resume is getting you interviews, don’t focus on changing the resume. Change how you interview and improve that. But what happens is the scammers come in with misinformation, and so a job seeker’s looking for work, they’re getting interviews, but they’re not landing the job, and then here come the scammers with this credible built profile and reputation, quote-unquote, and they say, “Oh, you need to have your resume rewritten.” But again, if your resume is getting you interviews, leave that alone. But if you listen to this credible profile and you change your resume, and then now with that resume you’re not getting interviews, then you’ve just taken two steps back.

What Happens Next

Beau: Jay, do you work for those people?

Jay: No, no.

Beau: All right. So since you don’t work for those people, you’re not a scammer, we’re gonna trust you today. What is the next thing that happens in this ecosystem? ‘Cause I assume that, like, fake resume writing… I would be really angry if I spent $300 or $800 or whatever on getting a resume and it either didn’t come or it was bad. But you said they’re also getting your Social Security information and other stuff, which I would imagine, as you said, is being used for identity theft. But is all of that information being used to a different purpose? Because the first thing I think of is North Korean IT worker scams where then they turn around and apply as Jay Jones for a job that you’re qualified for, having stolen your identity, and they get that job. Is that happening?

Jay: Absolutely, it’s happening. It’s been happening for at least over a year and a half when I saw it, because I started to see posts on LinkedIn from job seekers, and as the longer this job search goes for people, the more bitter they tend to become, which is natural to see because you’re putting in all this effort and you’re not getting any results, so it leads to this cynicism and this bitterness. And I saw more and more people making posts on LinkedIn saying, “Hey, this company is stupid,” blah, blah, blah, “because they sent me a rejection letter for a job I never applied for. This is how broken the system is.” And that was the angle of the post. It was to bash this company that was so incompetent, quote-unquote, that they didn’t know that you didn’t apply. And I look at it and I’m like, “Well, somebody did apply because you got that email.” And when I started to think about it, I started to see people from different walks of life, men, women, different races, different ages, and they’re all saying the same thing. And I’m like, “Somebody applied to that job as you,” because there’s no other reason. And so going to the North Korea thing, I mean, it’s happening every single day. I’ve talked to universities where they were nearly infiltrated by a candidate that was fake. A pharmaceutical company had seventy percent of their talent pipeline was fraudulent. There’s a gentleman, it was a story The Wall Street Journal where this gentleman is on camera showing 401k documentation in his name for a company he never applied to. So they’re taking out 401ks in people’s names and getting that money. So it’s a massive problem.

WSJ Clip: It affects your livelihood. Applying for jobs, applying for loans, applying for house, a car. Anything that requires my Social is pretty much gonna be an issue for me.

Beau: This is Michael Brown talking with The Wall Street Journal about his experience.

WSJ Clip: So this is Voya Financial, Aditi Consulting 401plan, summary plan description. Girl, they opened up a 401 in my name and all. Like, bro, that is wild. It turns out, while fake Michael Brown was working for Aditi Consulting, he was contracted out to another company, Amazon. Amazon told us more than 2,900 suspected North Korean operatives have been blocked from joining the company since April 2024. The company said it has never directly hired a North Korean IT worker. In rare cases where a third-party contractor’s employee used a fraudulent identity, Amazon said it worked with the agency to remove them. It is mind-blowing. Have you seen this man resume? Oh, my God, have you seen the jobs that I’ve supposedly worked, and the little amount of time they working, how much money they have made? But yet, here I am. Whole life is just took. Somebody else is living like me right now

Jay: And they talked at length about his experience with his identity being stolen. He showed the paperwork on camera of the 401, in his name, that he didn’t take, and they used his credentials to apply to a job and got hired as him. And then they took it from there. Got the whole onboarding process done. There was one story I saw from maybe, like, two years ago. This lady, she found out she was working at a company for two years and she never actually applied. And how the scammers pulled it off was they claimed that they couldn’t appear on camera, and the company didn’t want to run the risk of violating HIPAA or having some sort of lawsuit on their hands, so they just went with the reasoning as to why this person couldn’t appear on camera. But yeah, it’s a massive problem.

Beau: After the break, why this keeps happening and what you can do about it.

C Break 2

Beau: Is the resume writing the beginning of a whole ecosystem of crimes?

Jay: Correct. That’s the origin point. Like I tell people not to post it publicly online. I say vet the recruiter, send the resume directly to that recruiter, or apply directly on the company’s official website, because that way it’s at least in their system only and not spread out to everybody. Because when you post it publicly, it can be scraped by anybody who is pretending to hire or who is hiring, but you don’t know their safety measures and their data protection protocols or whatnot. So I say never share it publicly, only target the company you’re trying to reach and then apply directly on their website. And then if you cross-reference it, ’cause I say treat it like it’s a light credit card application. So for example, whitepages.com, if they just put your name and your state in, they can find you from there, and then they look at the resume. Let’s say you worked in Texas and then you worked in Idaho, and you see on Whitepages this is your name, you lived in Texas, you lived in Idaho. They know you’re the same person, and so they can cross-reference your address history. Whitepages also shows your relatives, so then they can see where your relatives stay, what their information is, and then they can actually tailor their scams to target your relatives pretending to be you in that way. There was one case I had where I saw this lady’s Facebook account was compromised, and they took it over and were pretending to sell Taylor Swift tickets in her name. So like, yeah, it all starts with your resume. It starts with you sharing information that shouldn’t be seen by everyone.

Beau: So LinkedIn is a platform where people go to get jobs and/or to further their career, to leapfrog to better jobs. And part of that, a big part of it is here’s where I’ve been, here’s where I’m going or hope to go. Where I’ve been, those LinkedIn data points that people enter, that is a resume.

Jay: Mm-hmm.

Beau: Should people not be posting their job history on LinkedIn? Because it sounds to me like it would be easy enough to go in, look at– this is not an invitation scammers. My LinkedIn profile has all the jobs that I’ve had, has my education, what languages I can work in, all that. Be easy enough to turn that into a resume. They don’t need my help. They don’t need anything.

Jay: And then there’s this feature on LinkedIn, I don’t know if it’s been sunsetted or not, but you can download a profile as a PDF or a CV, and it basically turns your whole profile into a resume for you by a few clicks. And the problem with this is, with scammers making the information age so murky, and they look real while the real people are trying to look more real, their response to that is by sharing more information because, hey, this is my detailed history. I didn’t make this up. I couldn’t make it up because it’s so detailed. But when you’re oversharing to try to look real, you’re giving more information to these bad actors. How you protect yourself is, I tell people to constantly have a lock on all three of their credit bureau reports, not share any information or something that you think is untoward because anytime they’re trying to quickly get money out of you, that is something that’s fraudulent. But I don’t want to denigrate real businesses doing transactions with people because in order to actually do work as a resume writer, so to speak, you have to get paid to do that work, so that is a legitimate transaction. But when you have the red flags of this content is stolen or you’re claiming your certificate is yours when it isn’t, you don’t have any social media footprint outside of LinkedIn, like you say you’re a resume writer for ten plus years, but you have no reviews, but you claim to like have such excellent abilities, then why is no one speaking to that? Why is no one actually leaving you a recommendation? Why is there no footprint of you anywhere? Those are some things to watch out for.

Beau: But also, if you do have a LinkedIn, like I have a LinkedIn profile, I have an Instagram that you can follow because I do use it to promote things. Go ahead. It’s @simnyc. Simnic is spelled S-I-M-N-Y-C. And if you really wanna know a little bit of deep, deep cybersecurity history, in 1995, when I set up that account, S-I-M-N-Y-C it stood for Simulacrum New York City. Simulacrum means a version of reality that isn’t real.

Jay: Yeah, it was in The Matrix, yeah

Beau: I set it up because I thought email was, oh, come on, this is never gonna last. This is… And I was at a little company called Interport.net, which has been purchased, like, 18 times since then.

Paranoia vs Vigilance

Beau: The reason I’m telling you all of this is because there’s a whole rich history of Simnic online, and all of that is findable, whether it’s my Instagram account or my Facebook account or my LinkedIn account. Or, I did sunset my Twitter account, but you know, the thing is I’ve posted a lot of information online. All of that can be used to scam me, and I did it. I volunteered for the scam over the years. You can tell who my family is. You can tell who my friends are. And the only thing that saves me is my family and friends know that I get targeted all the time for scams, and they’re just as paranoid as I am. What do you tell people who are not paranoid, Jay? How do you get people to understand that they are absolutely putting themselves in danger all the time just by posting what they’re having for lunch?

Jay: One of my slogans is stay vigilant. Because the difference between paranoia and vigilance is paranoia is, “They’re out to get me, what do I do?” And vigilance is, “Yes, there are people out to get me, here’s what I do.” And, you know, it’s this era of the emotional connection to the stuff that you’re sharing. Because when you post these pictures, you get this emotional connection from the likes and the feedback, and people keep track with their old college friends and their old high school friends to watch their life, and it makes you feel close to people you’re actually distant to because I often say we’re more connected than we’ve ever been, but we’re more disconnected because you feel like you know who these people are because you’re watching them. But I mean, it’s voyeurism, to be honest. It’s just like you’re looking at people’s lives, they’re sharing all this information, but you don’t really know them. And that human connection, the ability to see what someone’s idiosyncrasies are, you miss that. And what you’re looking at online, you’re seeing the best of people. They’re not gonna share their struggles because it’s thought unprofessional. And I’ve seen it too many times where people are suffering and they take their lives because they were scammed. But on the outside, everything was fine, and it’s because they’re being professional. And it’s like, if you post what you’re eating, I mean, people know how to target you. I mean, remember the old movie, Kiss the Girls, where Casanova, quote-unquote, he would literally dig in the trash of these women to see what they were eating. Like, it was really sick. But he was using all of this information to profile them, to place them, to know where they would be. And then when it was time for him to kidnap them, he knew exactly how to do it. And so that’s what I tell people is don’t overshare things. Like, to a certain point you have to share things so people know you’re legitimate. But again, it’s this conundrum of you share to show you’re legitimate, but then also what you’re sharing is being used to empower those that are illegitimate. So it’s this balancing act.

Beau: No, but Jay, here’s the deal. I’m gonna do it to you right now. Jay and I are not long-term friends. We just met. But let’s just pretend for a moment that we are. And so Jay knows that I like to go in the woods and find mushrooms and eat them. He just knows that ’cause he follows me on… It’s true. I do. I go, I forage. So I do do that. Now, Jay knows all about it. Now a scammer also knows that, and it would be very easy for a scammer to reach out to Jay, as me, with a spoofed email address and say, “Jay, I don’t know if you heard the news, but I got really sick from a batch of mushrooms that I ate, and I’m struggling right now, and I have a GoFundMe and it’s, I’m just looking for people to send $25, whatever you can afford, but I can’t pay my medical bills.” It’s just a scam that came out of my head right now, but there’s a million ways to weaponize the stuff that we post.

Jay: Mm-hmm.

Beau: And it can be as simple as that because remember, a scammer does not have to get your crypto wallet. All they have to do is get $10 from you, and just do it over and over

Jay: Yeah, and repeat it. Yeah.

Beat/Music

Jay: When I saw the scammers targeting me in the beginning when I first was laid off, I started to think about if they’re targeting me, they’re targeting millions of other people, and if I don’t do something about it, then it would be much worse. I had those negative thoughts of what kind of effect are you gonna make? And my day job before this was being a copywriter, so it’s like that whole going back to being professional. What is a copywriter doing talking about fraud? Like this doesn’t match. But at the same time, it’s like I’ve struggled with how do I actually do this purposefully while still trying to find work as a copywriter. And then I was like, “Well, I need to marry the two.” I need to build these narratives about this fraud and tell it in a way that is compelling and gets attention so that they can see the importance of it, because it’s not just general scam awareness. Like no, this is economic terrorism. These people are wanting to destroy the lives of US citizens. They’ll do it to their own people, but primarily they’re targeting US citizens. They’re targeting US companies to infiltrate, extract data, extract money. Then when you look at it from an economy perspective, it’s like if people can’t get jobs because most of the jobs they’re applying to are fake or ghost jobs and they can’t put money back into the economy because they don’t have it, and they’re relying on a system that has more and more depleted resources, eventually what’s gonna happen is you’re gonna get a lot of mitigating crime happening. Where people are going to get to their wit’s end and just start doing things that are fraudulent themselves because they can’t find anything legitimate. And that’s what I’m working to prevent. Everything that I’ve endured, it’s for this, and like I said, it didn’t feel good at the time, but seeing the results that it’s generated now, it’s encouraging. But I’m an introvert naturally, I’m more comfortable just sitting down off to myself, so to speak. But doing this work, it required more of me. It required me to step into this uncomfortable situation because you can’t protect people and be somebody advocating for them, but never interact with them, never talk to them, never show yourself. And so that’s been an uncomfortable part of the process. But I welcome it.

Beau: Well, I will say that being a copywriter is a perfect qualification for the work you’re doing because most of the scammers you’re taking on are using scripts, and who better to spot a script.

Music

Beau: So if you’ve applied for a job and you didn’t hear back, one, it might be that your resume sucked and you need a professional resume writer, but it might also be that the place you applied got 10,000 applications and most of them were generated by scammers. Is that right?

Jay: Correct. And then the other thing, and this is why the ecosystem is such a mess, is because of the speed that job seekers need to have in order to be part of the first twenty to forty applicants. And so there are these AI apply companies, like these auto-apply companies that sprung up to basically give job seekers an edge. And so basically what they do is you give them your resume, and they automatically apply it to jobs that are deemed a fit for you nonstop. So you’re basically– It’s similar to investing in the stock market. You have your money working for you constantly, so your resume is the thing– the thought is it’s working for you constantly as well. But the problem is an AI resume looks like an AI resume. The tailoring aspect of it for each of these jobs, it’s not possible to keep up and be individually matching each of these roles that it’s targeting because it’s mass spraying it. So what the recruiters and the companies do is they use AI to filter out the resumes that don’t sound legitimate. So you have AI talking to AI and rejecting AI. In the meantime, the humans are on both sides not talking to each other like they should be, and the scammers come in and insert themselves into the process with the solution to the problem they created and say, “Your resume needs work. Pay me.” And then they’ll say things like, “ATS-friendly,” or, “Beat the ATS,” but there’s no ATS-friendly, there’s no beating the ATS. It’s just if you’re a great fit for this role, they’ll call you. And that starts the great fits expression happens by how you write out your experience in the resume. But if they’re talking about beat the ATS or it didn’t score this amount on the ATS parsing system, this is the type of jargon that they use to sound official, that’s a scam.

Beau: Now for us dummies, what is ATS?

Jay: It’s the applicant tracking system, so it’s a digital filing cabinet. Every time someone submits a resume to a job, it goes into the applicant tracking system to track that applicant to whether they’re either chosen to move forward in the process, to make an offer, or to be rejected.

Beau: Ugh. It sounds like such a mess. Glad I’m so old that it’s not a mess I need to deal with at the moment. But it sounds like an incredible clusterfk.

Ending

PICKUPS: Jay, for people who wanna see some of your work, who wanna learn more about how to spot these fake job postings, whether they’re applying for a job or if they run a business and can spot fake applicants, where should people go?

Jay: My website is theprofiler.org. There I have the services that I offer because I desire to work with universities, businesses to be in the front of their talent pipelines to help them field these fake applicants and stop that from actually happening. So by the time they go through me and then I give them the applicants that are real, it streamlines their process, so they’re actually hiring real people and not wasting time on fake applicants. For the universities, the college students are the ones that are most targeted because they’re entering the job market for the first time and have no idea how bad it is. Then also outplacement services for companies that are laying people off. Like, unfortunately, that’s a reality of this system. But if you bring me in to help educate these people that are being laid off, at least they don’t get conned out of their severance. They don’t lose their 401. They’re actually able to know what’s out here and navigate it safely until they get to their next opportunity.

Beau: Jay Jones, the profiler. Thank you so much for joining me on “What the Hack?” It was really nice to have you here. Thanks again.

Jay: Likewise. Thank you.

TFS

Beau: Now it’s time for the tinfoil swan, our paranoid takeaway to keep you safe on and offline. What is it this week? TikTok, TikTok. Hmm. Come on. It’s simple. If your LinkedIn profile looks anything like my LinkedIn profile, it’s just a matter of time before somebody uses all that information to create a resume and apply for a job in your name. Bro, if it’s you thinking about me right now, I can feel you coming through the universe right now. I can feel it. I can feel your malfeasance. Go for it. Go ahead. Make my day. You feel lucky? Anyway, but, you know, please don’t also. But do think about what you have out there, and think about how it could be used by a fake recruiter or a fake job applicant looking to apply for a job in your name, possibly in the service of state-sponsored terrorism or state-sponsored whatever, you know, North Korea shenanigans. You don’t know. If this were really wartime, and it might be, it kind of is. Who knows? You know, the reveal’s always so interesting. Your patriotic duty could very well be just to make yourself as hard to get as possible, and to be vigilant, and to look at your emails to know, like, someone did apply for a job in my name, and maybe reach out and let that company know it wasn’t you, and they might want to bolster their defenses against fake job applicants. Look, does that sound like a lot? It is a lot. But if you’re listening to this show, you care about stuff. You might be the kind of person who gets junk mail and calls the company and says, “Stop sending me the junk mail.” I live in a house like that. It’s a real thing. People do it. You might be a person who cares about your data hygiene, right? About what’s out there. And if you are, do something about it. And don’t do something next week. Do it now. Just one thing. One thing, and then tomorrow or next week, do another thing. And by the end of the year, you will have done many things to make yourself more secure. And that is the goal of this show and at least my tenure here as host. So, that’s it. Stay safe. Come back next week. Can’t wait to tell you another story about, oh my gosh, the internet.

Learn More:

• Find out more about fake job offers from one of our team members at DeleteMe.
• Read the FTC’s advice for avoiding job scams.
• Find out how to remove your personal information from the internet