- Thread starter
- #1
A fake online job can look like a genuine employment opportunity until you’re asked to put your own money into the work.
You may have been contacted about remote employment, completed online tasks, received supposed commissions, and watched your earnings increase inside an app or website.
Then the platform required you to deposit cryptocurrency to continue.
Maybe the amount became larger after each round of tasks.
Maybe a “negative balance” appeared.
Maybe you were told that one final payment would unlock your earnings.
Then you sent the crypto and still couldn’t withdraw.
Stop sending additional cryptocurrency.
The FBI specifically describes cryptocurrency job scams in which fake employers recruit people for online work, require them to deposit their own cryptocurrency to perform tasks, display supposed earnings, and eventually demand increasingly large deposits before freezing the account.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP SENDING MORE CRYPTO
If the “employer” says another payment is required before you can receive your earnings, stop.
You may be told:
“Your account has a negative balance.”
“You need to complete one more task.”
“Pay a security deposit.”
“Your earnings are frozen.”
“Pay a withdrawal fee.”
“Deposit more to unlock your salary.”
“Complete this final order.”
The FBI says legitimate employment does not require workers to deposit their own cryptocurrency to complete assigned tasks.
Do not borrow money or use another account to satisfy a new deposit request.
FIND EVERY CRYPTO PAYMENT YOU MADE
Start with the wallet or legitimate cryptocurrency service you used to send the funds.
Find every transaction connected to the supposed employer or job platform.
Record:
Cryptocurrency
Amount
Network
Sending address
Receiving address
Transaction hash
Date
Time
The FBI specifically identifies cryptocurrency addresses, amounts, transaction times, and transaction hashes as important evidence in cryptocurrency job-scam reports.
If you made five separate deposits, preserve all five transaction hashes.
Don’t combine everything into one unexplained total.
CALCULATE YOUR ACTUAL LOSS
Separate the payments into categories.
Initial job deposit, 1,000 USDT
Task deposit, 2,000 USDT
Negative-balance payment, 3,500 USDT
Withdrawal-related payment, 1,500 USDT
Total sent, 8,000 USDT
Then separately record:
Amount successfully withdrawn
Amount still held in your legitimate wallet
Amount shown as earnings on the fake platform
This distinction matters because the “earnings” displayed inside a task platform may be fictitious.
The FTC describes task scams where fake earnings are displayed inside an app and victims are then told to deposit their own cryptocurrency to unlock supposed earnings.
SAVE THE JOB PLATFORM BEFORE IT DISAPPEARS
If you can safely access the platform, capture:
Account dashboard
Displayed earnings
Task history
Deposit history
Withdrawal history
Negative balance
Payment instructions
Customer-support messages
Account number
Website address
Company information
Error messages
Don’t assume the website or app will remain available.
The FBI notes that cryptocurrency job scams commonly use websites provided by the scammers for completing supposedly paid tasks.
Preserve what the platform showed you while you still can.
DOCUMENT THE JOB OFFER
Save the original:
Job advertisement
Recruiter’s message
Email
WhatsApp conversation
Telegram conversation
Social-media message
Application page
Interview messages
Job description
Salary information
The FBI says cryptocurrency job scams commonly begin through social media, text messages, WhatsApp, Telegram, or other online channels.
Don’t delete the original recruitment conversation.
DOCUMENT WHO CLAIMED TO BE YOUR EMPLOYER
Record:
Name used
Company claimed
Job title
Email address
Phone number
Username
Profile URL
Website
Company address
Recruiter’s instructions
If the person claimed to work for a recognizable company, record exactly what they claimed rather than assuming the legitimate company was involved.
The FTC warns that scammers may impersonate legitimate companies when offering fake jobs.
VERIFY THE COMPANY INDEPENDENTLY
Don’t use the contact information supplied by the supposed recruiter to verify the employer.
Instead, locate the company’s legitimate website independently and compare:
Company name
Domain
Recruiter email
Phone number
Job listing
Office information
Careers page
A personal email address, unusual domain, or communication conducted entirely through messaging apps can be a warning sign in a job scam.
Save any differences you discover.
DOCUMENT HOW THE CRYPTOCURRENCY PAYMENT WAS REQUIRED
Write down why you were told to pay.
For example:
“Deposit 500 USDT to activate your account.”
“Send 1,000 USDT to complete this task.”
“Pay the negative balance before withdrawing.”
“Deposit more to receive your commission.”
“Send crypto to unlock your salary.”
The FTC states that legitimate employers do not require applicants to pay to get a job, and cryptocurrency payment demands connected to employment are a major warning sign.
Preserve the exact instruction rather than only describing it afterward.
MATCH EACH PAYMENT TO THE TASK OR DEMAND
Create a simple record:
Task 1 → 500 USDT
Task 2 → 1,000 USDT
Negative balance → 2,500 USDT
Withdrawal requirement → 1,500 USDT
Then attach the transaction hash to each payment.
This can show how the financial loss developed alongside the supposed employment.
Don’t treat every payment as one generic transfer.
CHECK WHETHER YOU EVER RECEIVED A REAL PAYMENT
Some job scams allow a small withdrawal or payment early on to create confidence.
If you received anything, record:
Amount
Cryptocurrency
Transaction hash
Receiving address
Date
Network
For example:
First withdrawal, 100 USDT
Later deposit, 5,000 USDT
Withdrawal of remaining balance, blocked
The FBI says scammers may initially allow victims to withdraw money before requiring larger deposits.
That early payment should be documented separately from the later loss.
DOCUMENT THE “NEGATIVE BALANCE”
A common variation involves a task that supposedly creates a large negative balance.
You may see:
Account balance, -8,000 USDT
Then customer support tells you:
“You must deposit 8,000 USDT to clear the balance.”
Save:
Screenshot
Task number
Negative amount
Message explaining it
Payment address
Transaction hash
Date and time
The FBI specifically identifies unexpected negative balances and demands for additional deposits as characteristics of cryptocurrency job scams.
Don’t pay simply because the platform says the negative balance is real.
SAVE THE TASK HISTORY
If the platform gave you individual tasks, record:
Task number
Task description
Amount required
Commission displayed
Balance afterward
Payment made
Transaction hash
This can reveal whether the supposed work was actually connected to any legitimate employer or compensation.
The FTC describes task scams as schemes where victims perform simple online actions while an app displays fake commissions and later demands cryptocurrency deposits.
CHECK THE CRYPTOCURRENCY RECEIVING ADDRESS
For every payment, record the destination address.
Then examine the blockchain record.
For example:
Your wallet
↓
Receiving address
↓
Address B
↓
Address C
Record each identifiable movement.
Don’t assume that an address belongs to a specific person simply because the supposed employer gave it to you.
Document the blockchain movement first.
CHECK WHETHER THE FUNDS MOVED AFTER RECEIPT
Look for:
Transfers to another wallet
Token swaps
Bridges
Consolidation addresses
Other receiving addresses
Transfers to cryptocurrency services
Record:
Amount
Asset
From
To
Transaction hash
Timestamp
This creates a factual transaction trail without requiring you to guess who controls each address.
PRESERVE THE PAYMENT INSTRUCTIONS
Save:
Wallet address
QR code
Network
Amount
Memo
Payment page
Message containing the address
Date and time
If different addresses were supplied for different tasks, preserve each one.
Do not assume all payment addresses belong to the same wallet or person without evidence.
CHECK WHETHER YOUR PERSONAL INFORMATION WAS ALSO TAKEN
A fake employer may have requested:
Full name
Address
Phone number
Email
Identification
Bank details
Tax information
Wallet information
Passwords
Social-media accounts
If you supplied passwords that you use elsewhere, change them from a trusted device.
If you provided identity or financial information, preserve evidence of exactly what you submitted.
Don’t send additional personal information simply because the fake employer claims your account needs verification.
SECURE YOUR LEGITIMATE ACCOUNTS
Review accounts you used during the supposed employment process.
Check:
Email
Cryptocurrency exchange
Bank
Payment service
Social-media accounts
Password manager
Look for:
Unknown logins
Password changes
New withdrawal addresses
Unknown devices
New two-factor authentication settings
Unrecognized transactions
If you find unauthorized activity, contact the legitimate provider through its verified support channel.
CONTACT THE CRYPTOCURRENCY SERVICE YOU USED
If you sent the cryptocurrency through a legitimate exchange or other cryptocurrency service, contact that provider promptly.
Provide:
Transaction hash
Asset
Amount
Network
Receiving address
Date
Time
Explanation of the job scam
The FTC recommends contacting the company used to send the money, reporting the fraud, and asking whether the transaction can be reversed where possible.
A completed cryptocurrency transaction may not be reversible, so don’t assume the provider can recover it automatically.
Ask what options are available and preserve the response.
SAVE THE PROVIDER’S RESPONSE
Keep:
Case number
Support ticket
Email
Chat transcript
Fraud report
Transaction review
Date contacted
If the provider says the transaction cannot be reversed, save that response too.
It becomes part of the timeline.
BUILD THE COMPLETE JOB-SCAM TIMELINE
For example:
June 2, recruiter contacted me
↓
June 3, job explained
↓
June 4, account created
↓
June 5, first task completed
↓
June 5, 500 USDT deposited
↓
June 7, earnings displayed
↓
June 8, larger task assigned
↓
June 8, 2,000 USDT deposited
↓
June 9, negative balance appeared
↓
June 9, additional payment demanded
↓
June 10, withdrawal blocked
Your actual dates and amounts will differ.
The purpose is to connect the recruitment, tasks, payments, displayed earnings, and withdrawal problem.
DON’T DELETE THE CONVERSATION
Keep the messages with:
Recruiter
Supervisor
Customer support
Task manager
Payment contact
Group administrators
The FBI recommends preserving communications, identifying information, websites, applications, exchanges used, and the timeline when documenting cryptocurrency job scams.
Even messages that seem embarrassing or insignificant can establish how the scam developed.
DON’T CONFRONT THE FAKE EMPLOYER
You may want to demand your money back or tell them that you’ve discovered the fraud.
Instead, preserve the evidence and avoid giving them information about what you are doing next.
The FBI advises victims not to notify suspected criminals of investigative activity because it may compromise an investigation.
Your evidence is more useful than an argument with the scammer.
WATCH FOR A SECOND RECOVERY SCAM
After losing cryptocurrency through a fake job, you may be contacted by someone claiming they can recover it.
They may say:
“We found your funds.”
“We traced the wallet.”
“Your crypto is frozen.”
“We can reverse the transaction.”
“Pay a recovery fee.”
“Send crypto to activate the recovery.”
The FBI specifically warns cryptocurrency job-scam victims to be wary of people claiming they can recover lost funds.
Don’t send another payment simply because someone promises recovery.
ORGANIZE YOUR EVIDENCE
Create one folder containing:
Job advertisement
Recruiter messages
Company information
Platform screenshots
Task history
Payment instructions
Transaction hashes
Wallet addresses
Withdrawal attempts
Negative-balance messages
Customer-support conversations
Blockchain transactions
Exchange records
Timeline
This makes the incident much easier to reconstruct.
YOU DON’T NEED TO HAVE EVERYTHING
You may only have:
One job message
One website
One transaction hash
One wallet address
A screenshot of the task account
A blocked withdrawal
That’s enough to begin organizing what happened.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the movement of the cryptocurrency.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
How you found the job
↓
Who contacted you
↓
What employment was promised
↓
What tasks you were asked to complete
↓
Why you were instructed to send cryptocurrency
↓
How much cryptocurrency you sent
↓
Which addresses received it
↓
What earnings the platform displayed
↓
When additional deposits were demanded
↓
What happened when you attempted to withdraw
↓
Where the cryptocurrency moved afterward
The most useful question isn’t simply:
“How do I get my crypto back?”
It’s:
“Who recruited me, what was I told I was being paid to do, why was I required to send cryptocurrency, which addresses received my payments, and what happened to those funds afterward?”
Start there.
Stop sending additional cryptocurrency, preserve the job and blockchain evidence, secure any accounts that may have been exposed, and keep every payment and communication connected to the case.
You may have been contacted about remote employment, completed online tasks, received supposed commissions, and watched your earnings increase inside an app or website.
Then the platform required you to deposit cryptocurrency to continue.
Maybe the amount became larger after each round of tasks.
Maybe a “negative balance” appeared.
Maybe you were told that one final payment would unlock your earnings.
Then you sent the crypto and still couldn’t withdraw.
Stop sending additional cryptocurrency.
The FBI specifically describes cryptocurrency job scams in which fake employers recruit people for online work, require them to deposit their own cryptocurrency to perform tasks, display supposed earnings, and eventually demand increasingly large deposits before freezing the account.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP SENDING MORE CRYPTO
If the “employer” says another payment is required before you can receive your earnings, stop.
You may be told:
“Your account has a negative balance.”
“You need to complete one more task.”
“Pay a security deposit.”
“Your earnings are frozen.”
“Pay a withdrawal fee.”
“Deposit more to unlock your salary.”
“Complete this final order.”
The FBI says legitimate employment does not require workers to deposit their own cryptocurrency to complete assigned tasks.
Do not borrow money or use another account to satisfy a new deposit request.
FIND EVERY CRYPTO PAYMENT YOU MADE
Start with the wallet or legitimate cryptocurrency service you used to send the funds.
Find every transaction connected to the supposed employer or job platform.
Record:
Cryptocurrency
Amount
Network
Sending address
Receiving address
Transaction hash
Date
Time
The FBI specifically identifies cryptocurrency addresses, amounts, transaction times, and transaction hashes as important evidence in cryptocurrency job-scam reports.
If you made five separate deposits, preserve all five transaction hashes.
Don’t combine everything into one unexplained total.
CALCULATE YOUR ACTUAL LOSS
Separate the payments into categories.
Initial job deposit, 1,000 USDT
Task deposit, 2,000 USDT
Negative-balance payment, 3,500 USDT
Withdrawal-related payment, 1,500 USDT
Total sent, 8,000 USDT
Then separately record:
Amount successfully withdrawn
Amount still held in your legitimate wallet
Amount shown as earnings on the fake platform
This distinction matters because the “earnings” displayed inside a task platform may be fictitious.
The FTC describes task scams where fake earnings are displayed inside an app and victims are then told to deposit their own cryptocurrency to unlock supposed earnings.
SAVE THE JOB PLATFORM BEFORE IT DISAPPEARS
If you can safely access the platform, capture:
Account dashboard
Displayed earnings
Task history
Deposit history
Withdrawal history
Negative balance
Payment instructions
Customer-support messages
Account number
Website address
Company information
Error messages
Don’t assume the website or app will remain available.
The FBI notes that cryptocurrency job scams commonly use websites provided by the scammers for completing supposedly paid tasks.
Preserve what the platform showed you while you still can.
DOCUMENT THE JOB OFFER
Save the original:
Job advertisement
Recruiter’s message
WhatsApp conversation
Telegram conversation
Social-media message
Application page
Interview messages
Job description
Salary information
The FBI says cryptocurrency job scams commonly begin through social media, text messages, WhatsApp, Telegram, or other online channels.
Don’t delete the original recruitment conversation.
DOCUMENT WHO CLAIMED TO BE YOUR EMPLOYER
Record:
Name used
Company claimed
Job title
Email address
Phone number
Username
Profile URL
Website
Company address
Recruiter’s instructions
If the person claimed to work for a recognizable company, record exactly what they claimed rather than assuming the legitimate company was involved.
The FTC warns that scammers may impersonate legitimate companies when offering fake jobs.
VERIFY THE COMPANY INDEPENDENTLY
Don’t use the contact information supplied by the supposed recruiter to verify the employer.
Instead, locate the company’s legitimate website independently and compare:
Company name
Domain
Recruiter email
Phone number
Job listing
Office information
Careers page
A personal email address, unusual domain, or communication conducted entirely through messaging apps can be a warning sign in a job scam.
Save any differences you discover.
DOCUMENT HOW THE CRYPTOCURRENCY PAYMENT WAS REQUIRED
Write down why you were told to pay.
For example:
“Deposit 500 USDT to activate your account.”
“Send 1,000 USDT to complete this task.”
“Pay the negative balance before withdrawing.”
“Deposit more to receive your commission.”
“Send crypto to unlock your salary.”
The FTC states that legitimate employers do not require applicants to pay to get a job, and cryptocurrency payment demands connected to employment are a major warning sign.
Preserve the exact instruction rather than only describing it afterward.
MATCH EACH PAYMENT TO THE TASK OR DEMAND
Create a simple record:
Task 1 → 500 USDT
Task 2 → 1,000 USDT
Negative balance → 2,500 USDT
Withdrawal requirement → 1,500 USDT
Then attach the transaction hash to each payment.
This can show how the financial loss developed alongside the supposed employment.
Don’t treat every payment as one generic transfer.
CHECK WHETHER YOU EVER RECEIVED A REAL PAYMENT
Some job scams allow a small withdrawal or payment early on to create confidence.
If you received anything, record:
Amount
Cryptocurrency
Transaction hash
Receiving address
Date
Network
For example:
First withdrawal, 100 USDT
Later deposit, 5,000 USDT
Withdrawal of remaining balance, blocked
The FBI says scammers may initially allow victims to withdraw money before requiring larger deposits.
That early payment should be documented separately from the later loss.
DOCUMENT THE “NEGATIVE BALANCE”
A common variation involves a task that supposedly creates a large negative balance.
You may see:
Account balance, -8,000 USDT
Then customer support tells you:
“You must deposit 8,000 USDT to clear the balance.”
Save:
Screenshot
Task number
Negative amount
Message explaining it
Payment address
Transaction hash
Date and time
The FBI specifically identifies unexpected negative balances and demands for additional deposits as characteristics of cryptocurrency job scams.
Don’t pay simply because the platform says the negative balance is real.
SAVE THE TASK HISTORY
If the platform gave you individual tasks, record:
Task number
Task description
Amount required
Commission displayed
Balance afterward
Payment made
Transaction hash
This can reveal whether the supposed work was actually connected to any legitimate employer or compensation.
The FTC describes task scams as schemes where victims perform simple online actions while an app displays fake commissions and later demands cryptocurrency deposits.
CHECK THE CRYPTOCURRENCY RECEIVING ADDRESS
For every payment, record the destination address.
Then examine the blockchain record.
For example:
Your wallet
↓
Receiving address
↓
Address B
↓
Address C
Record each identifiable movement.
Don’t assume that an address belongs to a specific person simply because the supposed employer gave it to you.
Document the blockchain movement first.
CHECK WHETHER THE FUNDS MOVED AFTER RECEIPT
Look for:
Transfers to another wallet
Token swaps
Bridges
Consolidation addresses
Other receiving addresses
Transfers to cryptocurrency services
Record:
Amount
Asset
From
To
Transaction hash
Timestamp
This creates a factual transaction trail without requiring you to guess who controls each address.
PRESERVE THE PAYMENT INSTRUCTIONS
Save:
Wallet address
QR code
Network
Amount
Memo
Payment page
Message containing the address
Date and time
If different addresses were supplied for different tasks, preserve each one.
Do not assume all payment addresses belong to the same wallet or person without evidence.
CHECK WHETHER YOUR PERSONAL INFORMATION WAS ALSO TAKEN
A fake employer may have requested:
Full name
Address
Phone number
Identification
Bank details
Tax information
Wallet information
Passwords
Social-media accounts
If you supplied passwords that you use elsewhere, change them from a trusted device.
If you provided identity or financial information, preserve evidence of exactly what you submitted.
Don’t send additional personal information simply because the fake employer claims your account needs verification.
SECURE YOUR LEGITIMATE ACCOUNTS
Review accounts you used during the supposed employment process.
Check:
Cryptocurrency exchange
Bank
Payment service
Social-media accounts
Password manager
Look for:
Unknown logins
Password changes
New withdrawal addresses
Unknown devices
New two-factor authentication settings
Unrecognized transactions
If you find unauthorized activity, contact the legitimate provider through its verified support channel.
CONTACT THE CRYPTOCURRENCY SERVICE YOU USED
If you sent the cryptocurrency through a legitimate exchange or other cryptocurrency service, contact that provider promptly.
Provide:
Transaction hash
Asset
Amount
Network
Receiving address
Date
Time
Explanation of the job scam
The FTC recommends contacting the company used to send the money, reporting the fraud, and asking whether the transaction can be reversed where possible.
A completed cryptocurrency transaction may not be reversible, so don’t assume the provider can recover it automatically.
Ask what options are available and preserve the response.
SAVE THE PROVIDER’S RESPONSE
Keep:
Case number
Support ticket
Chat transcript
Fraud report
Transaction review
Date contacted
If the provider says the transaction cannot be reversed, save that response too.
It becomes part of the timeline.
BUILD THE COMPLETE JOB-SCAM TIMELINE
For example:
June 2, recruiter contacted me
↓
June 3, job explained
↓
June 4, account created
↓
June 5, first task completed
↓
June 5, 500 USDT deposited
↓
June 7, earnings displayed
↓
June 8, larger task assigned
↓
June 8, 2,000 USDT deposited
↓
June 9, negative balance appeared
↓
June 9, additional payment demanded
↓
June 10, withdrawal blocked
Your actual dates and amounts will differ.
The purpose is to connect the recruitment, tasks, payments, displayed earnings, and withdrawal problem.
DON’T DELETE THE CONVERSATION
Keep the messages with:
Recruiter
Supervisor
Customer support
Task manager
Payment contact
Group administrators
The FBI recommends preserving communications, identifying information, websites, applications, exchanges used, and the timeline when documenting cryptocurrency job scams.
Even messages that seem embarrassing or insignificant can establish how the scam developed.
DON’T CONFRONT THE FAKE EMPLOYER
You may want to demand your money back or tell them that you’ve discovered the fraud.
Instead, preserve the evidence and avoid giving them information about what you are doing next.
The FBI advises victims not to notify suspected criminals of investigative activity because it may compromise an investigation.
Your evidence is more useful than an argument with the scammer.
WATCH FOR A SECOND RECOVERY SCAM
After losing cryptocurrency through a fake job, you may be contacted by someone claiming they can recover it.
They may say:
“We found your funds.”
“We traced the wallet.”
“Your crypto is frozen.”
“We can reverse the transaction.”
“Pay a recovery fee.”
“Send crypto to activate the recovery.”
The FBI specifically warns cryptocurrency job-scam victims to be wary of people claiming they can recover lost funds.
Don’t send another payment simply because someone promises recovery.
ORGANIZE YOUR EVIDENCE
Create one folder containing:
Job advertisement
Recruiter messages
Company information
Platform screenshots
Task history
Payment instructions
Transaction hashes
Wallet addresses
Withdrawal attempts
Negative-balance messages
Customer-support conversations
Blockchain transactions
Exchange records
Timeline
This makes the incident much easier to reconstruct.
YOU DON’T NEED TO HAVE EVERYTHING
You may only have:
One job message
One website
One transaction hash
One wallet address
A screenshot of the task account
A blocked withdrawal
That’s enough to begin organizing what happened.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the movement of the cryptocurrency.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
How you found the job
↓
Who contacted you
↓
What employment was promised
↓
What tasks you were asked to complete
↓
Why you were instructed to send cryptocurrency
↓
How much cryptocurrency you sent
↓
Which addresses received it
↓
What earnings the platform displayed
↓
When additional deposits were demanded
↓
What happened when you attempted to withdraw
↓
Where the cryptocurrency moved afterward
The most useful question isn’t simply:
“How do I get my crypto back?”
It’s:
“Who recruited me, what was I told I was being paid to do, why was I required to send cryptocurrency, which addresses received my payments, and what happened to those funds afterward?”
Start there.
Stop sending additional cryptocurrency, preserve the job and blockchain evidence, secure any accounts that may have been exposed, and keep every payment and communication connected to the case.