Identity theft and security risks: An analysis of the “Upwork Account Rental” scam.
Yesterday I received an email, supposedly from China. It proposes a collaboration:
Howdy? 😊😊😊
This is Cui from China, and I found your profile on GitHub. I have worked with so many companies so far.
But I recently decided to start freelancing with an European Upwork account.
Also, hope to collaborate with you on your projects.
So Cui wants to freelance and has a problem. He’s based in China, and most platforms are rather cautious there. Not long ago, developers infiltrating North Korea were exposed.
A few typical red flags
I would put some words to why I need your help on Upwork and how it would be going for you.
– Why I need to use the European Upwork account?
The crux of the matter is that a freelancer account is being set up in my name. The idea is that Company X thinks they’re hiring me, but in reality, a supposed Chinese national is working for the company. If things go wrong, that person spies on the company or installs a ransomware trojan—all under my name.
– How I can use your Upwork account?
Technically, the whole thing is supposed to run via TeamViewer or AnyDesk. To put it bluntly, I’m supposed to grant access to my computer. In the best-case scenario, the person is really just working for money; otherwise, my computer will be used for criminal activities.
Without proper security measures, the person would not only have access to my computer but also to other devices on my home network.
– How we can transfer money with each other?
Of course, none of this is for free; I get to keep 10% of the earnings. I’m supposed to forward the rest via PayPal or other services. This not only turns you into a financial agent and money launderer but could also get you in trouble with the tax authorities. I’d have to pay taxes on the entire amount, and I assume the Chinese person won’t issue me an invoice.
With a tax burden of, say, 20%, that’s a bad deal.
– You don’t have to worry about me stealing from your Upwork account. Why?
Also, Upwork requires video chat sometimes, and I can’t do it without your help.
But don’t worry, the account won’t be stolen from me. If push comes to shove, my European face will still be needed in case there is a potential customer behind it who requests a video chat.
Conclusion
Requests like this are highly dubious. You’re not only risking your reputation and your accounts on platforms like Upwork or GitHub, but you’re also putting yourself in a legal and security risk zone. If you receive emails like this: delete them unread and block the sender.
