How online earning scams work, and how to check before you pay

Scams that target people looking for online work are not improvised. They follow a small number of scripts, refined over years, and the script is usually recognisable within the first few messages — long before any money moves.

This guide describes the five patterns behind most losses, why the early stages are convincing, and the checks that take ten minutes and rule out nearly all of them.

Why “too good to be true” is useless advice

The instinct most people are given is to distrust offers that seem too generous. This fails for two reasons. First, real remote work often does look surprising to someone new — the rates can be higher than local wages, and the hiring is faster than they expect. Second, the better scams are not outlandish at all. They offer plausible money for plausible work, and the unusual part arrives later, after you have invested time and started to feel committed.

A more reliable approach is structural. Instead of judging how the offer feels, look at how the money moves and who is protected if something goes wrong.

Pattern 1: the advance fee

You are offered work. Before you can start, there is a charge: registration, “verification”, a background check, training materials, a software licence, or a starter kit.

The charge is always framed as small relative to the earnings, and often as refundable after your first week. It is the entire point of the operation. Once paid, either the work never appears, or a second fee does.

The variant that catches experienced people is a fee that arrives late: you have done the work, the payment is “held by the finance system”, and a release fee will unlock it. The sunk cost is what makes it work.

Pattern 2: task-and-deposit schemes

You are recruited to complete simple tasks — rating products, liking videos, “optimising” listings. The first tasks pay. The money is real and you can withdraw it. This is the recruitment stage, and it is deliberately genuine.

Then the tasks change. Some require a deposit to “unlock” a higher-value item, with the promise that the deposit returns along with a commission. The deposits escalate. At some point a task fails, your balance is frozen, and clearing it requires another payment.

The mechanism is the same as a confidence trick: the small verifiable wins early on establish that the system pays, so the later demands feel like a temporary problem in a working system rather than the system itself.

Pattern 3: fake recruitment

An offer arrives from a company you recognise, usually by direct message or an unsolicited email. The process is short and enthusiastic. Somewhere in it, one of three things happens: you are asked for identity documents beyond what a real employer needs at that stage, asked to buy your own equipment through a specified supplier, or sent a cheque or transfer to “purchase equipment” and forward the balance onward.

The third is money-laundering, and forwarding the funds can make you legally liable regardless of the fact that you were deceived.

Real companies hire through their own domains, publish the role on their own careers page, and interview before making an offer. Verify the role exists by going to the company’s own website directly, not through any link in the message.

Pattern 4: the off-platform move

You find genuine work on a real freelancing platform. Early in the conversation, the client suggests moving to a private messaging app, and paying directly, “to avoid the fees”.

The fee saving is real, which is what makes it persuasive. What you also lose is the escrow, the dispute process, the payment protection and any record the platform can act on. When the work is delivered and the payment does not arrive, there is nobody to appeal to.

Most platforms prohibit this in their terms, and being the one who agreed can put your own account at risk as well.

Pattern 5: the course that is the business

A programme sells a method for earning online. The method turns out to be selling the same programme to other people, or the results shown are from selling programmes rather than from the method itself.

The tell is where the money in the testimonials came from. If the successful students’ income comes from teaching the course, the course is the product and you are the market.

This is different from paid education, which can be excellent. The distinction is whether the skill has a market outside the programme.

The ten-minute check

Before paying anyone or sending documents, do all of this. It rules out the overwhelming majority of what is above.

1. Search the name plus the word “scam” or “review” — including the recruiter’s name, the domain and the app they contacted you on. Read results dated within the last year.
2. Check the domain’s age with any public WHOIS lookup. A company hiring at scale with a domain registered six weeks ago warrants an explanation.
3. Verify the company exists in the relevant public company register, and that the person contacting you actually works there — by contacting the company through its own published details, not the ones you were sent.
4. Reverse image search the profile photo of whoever contacted you. Stock and stolen photos are common and the result is immediate.
5. Ask where the money comes from. If nobody can name the paying customer and what they are buying, there is no revenue to pay you from.
6. Read what you are being asked to sign or install. Remote-access software on your own machine for a data-entry job is not a normal request.

If it has already happened

You are not stupid and you are not alone — these operations are professionally run and target people in exactly the situation you were in. What matters now is speed.

1. Stop paying immediately, including any fee presented as necessary to recover your money.
2. Contact your bank or payment provider today and ask about reversing the transaction.
3. Keep every message, receipt, username, screenshot and transaction reference.
4. Report it to your country’s cybercrime or consumer-protection authority.

Our guide on what to do in the first 24 hours sets out the steps and the official reporting channels in detail.

Questions readers ask