Back News.Trendmicro

How replying to a recruiting text turns into a request for your money

News.Trendmicro •Trend Micro • October 7, 2026

This article discusses a scam that impersonates Amazon, Hays, and YouTube. Neither Amazon, Hays, YouTube, nor their services are involved in the scam. All brand names are trademarks of their respective owners. “Hi, this is Grace from Amazon Recruiting. We came across your profile and think you could be a great fit for a part-time remote role.” The text describes 60 to 90 minutes of work a day, pay of $250 to $500 daily, and free training with no experience needed. It sounds specific enough to be real and generous enough to be worth a . It’s neither. This is one script, repeated under a different name and a different brand, which TrendLife has seen spreading across multiple brands and regions over the past 12 months. Here’s how to recognize it no matter which company it claims to be from.

1. An unsolicited text names a real company and a fake recruiter

The message arrives from a name pulled from a small rotating pool of first names. “Grace” alone accounts for 42% of the messages TrendLife analyzed, claiming to represent Amazon, Hays, or YouTube. It says your profile was found in a talent database or reviewed by a hiring team.

2. Replying moves the conversation off SMS

Answering with the requested keyword, “yes” or “Interested,” confirms your number is active. The conversation quickly shifts to WhatsApp or Telegram, framed as the official recruitment channel. No legitimate employer runs hiring through a personal messaging app.

3. A small real payment makes the task look legitimate

You’re shown an earnings dashboard, given simple tasks like clicking product links, and paid a small amount of real money before anything is asked of you. That real payment is the setup for what comes , not proof the job is real.

4. The job asks you to pay to keep getting paid

Only after the small payment does the request come to deposit personal funds to “unlock” higher-paying tasks or release a withdrawal, described as refundable and temporary. Withdrawals then get “frozen” for a “system maintenance” or “audit check” that never resolves. In reports involving Hays, some recipients are instead asked to transfer money on behalf of a third party as a stated job duty.

You’ve got this. Once you know the pattern, it’s easy to spot no matter which brand or number sends it.

An unsolicited text from a recruiter using a first name: Real recruiters for major companies don’t cold-text candidates from personal-sounding numbers.

A vague task description: “Updating product listings” or “optimizing visibility” for 60 to 90 minutes a day is not a specific, real job duty.

Pay wildly out of proportion to the hours: 100 to 800 a day for 60 to 90 minutes of work is not a real wage.

Paid leave offered in the first message: No employer offers benefits to a stranger before an interview.

A countdown of available spots: “20 openings” or “25 spots” creates urgency that has nothing to do with real hiring.

An age cutoff framed as an eligibility rule: Requiring applicants to be 20 or 25 works as a filter for people likely to have an established bank account.

An instruction to with a specific word: The itself is what the scam is after.

Don’t to unsolicited job texts. A confirms your number is active and invites more .

Remember that no legitimate job asks you to pay first. If a “job” requires a deposit, fee, or purchase before you get paid, it isn’t one.

Watch for hiring or payroll moving to WhatsApp or Telegram. Real employers use company email and verified systems.

If you’ve already paid, stop immediately. The balance shown on any dashboard isn’t real money, and no further deposit will release it.

Report the message to the FTC at ReportFraud.ftc.gov (US) or Scamwatch (Australia).

Treat any offer to “recover” your lost funds as a second scam. No legitimate service ever asks you to pay to get your money back.

This scam is built to survive being recognized. Recruiter names, phone numbers, and even the impersonated brand all rotate, which is exactly why checking who sent the message doesn’t help. What doesn’t change is the script: the offer, the urgency, and eventually, the request to pay. Even careful, tech-savvy people can read past those details on a busy day. If an offer feels too easy or too generous, trust that instinct. Now that you know the pattern, you’re already ahead of it.

Was this article helpful?

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

YouTube Creators Targeted by Phishing Scams Posing as Sponsorship Offers Scammers are targeting YouTube creators with phishing campaigns that impersonate legitimate brands like Hollyland, Nike, and Spotify. The attackers send personalized emails offering sponsorship opportunities, leading creators to fake collaboration platforms designed to steal their Google account credentials. Victims are tricked into entering their login information on these sites, which appear legitimate due to tailored content and brand logos. Once compromised, attackers can access the creator's entire Google account, including Gmail and YouTube. The schemes have been reported under various names, including MATCHY and SCOUTY, with the domains frequently changing to evade detection. ESET researchers have identified this as a modular scheme, where components remain consistent while the brand identity varies. Creators are advised to be cautious of unsolicited sponsorship offers and verify the legitimacy of any collaboration requests. 3 sources 56

Extracted Entities

How replying to a recruiting text turns into a request for your money

The full story

Extracted Entities

Attack Types (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (3)