Fake recruitment interviews, from the October 2026 attack on Binance to the task scams, passive-income schemes and romance scams that reach ordinary inboxes: how they work, how they now run at scale, and ten checks for anyone who receives an unexpected offer, as at November 2026.
Billions of dollars were stolen from Binance, the cryptocurrency exchange, on 29 October 2026 because one software engineer believed he was being considered for a job. Binance put the digital assets impacted at about USD 6.34 billion. It published the account itself on 3 November.
In September the engineer was approached on a legitimate job-hunting platform by someone posing as a project director. The first interview was a live video call, in which the HR representative shared a social-media account of personal photos and videos to build trust. The second, in a chat app, was with the chief executive of a company that did not exist. Near the end, the engineer was asked to download an "assignment" onto his work computer. It installed malware. From that laptop, the attackers worked their way into Binance's wallet systems.
The usual picture of a scam victim is someone careless, taken in by a misspelt email or an implausible windfall. This was a software engineer at a cryptocurrency exchange, sitting what looked like a normal hiring process.
The same script arrives in ordinary inboxes every day. A chat message offers a TikTok Shop seller account, an invitation code and a friendly tip on choosing a store name. A stranger met online turns, after weeks of warmth, to an investment opportunity. Each offers the next step toward something the target already wants. The offer is the attack.
What has changed is the effort of running it. Generative AI now writes thousands of distinct conversations at once. Industrial scam centres supply the staff and the tools.
How a fake job interview reached Binance's wallets
Binance's report describes a campaign built over months, not a single trick. In June 2026 a wallet DevOps engineer installed a tampered copy of a developer tool after finding it through a search engine. Binance replaced the device and rotated the credentials, but the attacker had learned who worked on the wallet infrastructure.
The September approach targeted a different engineer, whose profile on the job platform mentioned his experience at Binance. Binance called the approach more advanced and deceptive than earlier ones it had seen. The "assignment" from the second round ran malicious code during set-up, replacing a legitimate development tool with a malicious version. The endpoint security tools in place at the time did not detect it.
On 20 October the attacker used that laptop and an internal AI tool to take control of two more engineers' machines, one of which held a deployment token. On 29 October the attacker deployed a container and triggered the script that moved the funds. About USD 2.85 billion had been frozen or intercepted when Binance reported. It said it would absorb the loss itself. It reported that the FBI's latest information attributes the attack to North Korea.
Binance said it had detected and prevented 57 suspected North Korea-linked cases across 2026, including fraudulent job interviews and malicious software disguised as popular developer tools. Video no longer settles who is on the other end. The FBI's Internet Crime Complaint Center (IC3) describes online job interviews using voice spoofing or possible voice deepfakes, in which lip movements do not match the audio. The decisive moment is the request at the end: run this code, install that tool, enable this content.
| When | What happened |
|---|---|
| June | A wallet DevOps engineer installs a tampered developer tool found through a search engine; the device is replaced and credentials rotated |
| September | A software engineer is approached on a legitimate job-hunting platform by a fake project director |
| September, round 1 | Live video interview with a purported HR representative, who shares personal photos and videos to build trust |
| September, round 2 | Interview in a chat app with a fake chief executive; the engineer downloads an "assignment" to his work computer, which runs malicious code |
| 20 October | From that laptop, the attacker uses an internal AI tool to reach two more engineers' machines, one holding a deployment token |
| 29 October | A container is deployed and a script triggered; about USD 6.34 billion in digital assets are impacted |
Note. Each interview step looked like a normal part of hiring until the request to download the assignment.
Five scams, ranked by how badly they bite
1. The recruiter who wants your laptop. Small in the statistics, larger than anything else in a single case. The IC3 sees little direct dollar loss from job scams that use voice spoofing or possible deepfakes in interviews, because their goal generally appears to be access to a computer network. At Binance, one fake interview opened the route to transfers of digital assets the exchange put at about USD 6.34 billion.
2. The investment that starts as a friendship. The largest losses in aggregate. Victims reported about USD 8.65 billion lost to investment fraud in 2025 to the IC3. Many of these schemes open as a friendship or a romance and only later introduce a trading platform. The US Treasury's Financial Crimes Enforcement Network (FinCEN) calls the pattern "pig butchering": the victim is fattened with trust before the slaughter.
3. The romance that turns to money. Losses reported to the IC3 as confidence and romance fraud rose from about USD 672 million in 2024 to about USD 929 million in 2025. In Singapore the police recorded 917 internet love scams in 2025, with an average loss of SGD 27,202 per case.
4. The official who demands payment. Fear works as well as hope. Government-impersonation fraud cost IC3 complainants about USD 798 million in 2025. In Singapore it carried the highest average loss of the ten most-reported scam types in 2025, at SGD 72,229 per case.
5. The job that pays you first. Task-based job scams pay small commissions, then demand deposits to unlock bigger tasks. Employment-fraud losses reported to the IC3 rose from about USD 70 million in 2023 to about USD 363 million in 2025, more than fivefold. In Singapore, job scams caused about SGD 123.5 million in losses in 2025, the third-highest of any scam type.
Why a fake job offer works
A job offer answers a need before it asks for anything: income, standing and a plan.
Singapore's police describe the mechanics of the task scam precisely. Victims find "job opportunities" through Facebook, TikTok and Instagram, or through their own internet searches. Scammers also reach them on WhatsApp and Telegram, often adding them to chat groups. The tasks are simple: reviewing hotels or products, rating apps, liking posts. Small commissions arrive at first. Higher-paying tasks follow, each requiring the victim to transfer larger sums to bank accounts or crypto wallets the scammers control. Victims realise only when the commissions stop, withdrawals fail or the scammers disappear.
The US Federal Trade Commission (FTC) traced the rise of these task scams from nothing. Reports went from zero in 2020 to about 5,000 in 2023, then to about 20,000 in the first half of 2024 alone. Its advice fits on one line: never pay anyone to get paid.
Complaints keep climbing in the United States. Employment-fraud complaints to the IC3 rose from 15,443 in 2023 to 24,688 in 2025. In Singapore, job scams fell by 38.4 per cent in 2025, to 5,575 cases, yet still averaged SGD 22,163 per case. The largest group of Singapore's job-scam victims, 42.7 per cent, were aged 30 to 49.
Note. Employment-fraud losses reported to the FBI rose more than fivefold in two years.
The online shop that sells nothing
The TikTok Shop message refines the task scam. Instead of tasks, the target is offered a business of their own.
Singapore's police singled out this variant in their 2025 annual brief. Victims were persuaded to start online businesses and to register accounts on scam websites or apps. When orders arrived, victims had to buy the items with their own money, on the promise of commission once the orders were delivered. Commissions were paid at first. Over time the orders grew larger. Then came "issues" requiring further payment before any funds could be withdrawn. The police called the variant highly convincing, because victims watched their online balances grow.
The message links to what it calls the "International TikTok Shop sellers backend site", with an invitation code and a tip on choosing a store name. The tone is that of a helpful colleague.
The give-away sits in the web address. The link begins "ttsg-management", which reads like a TikTok team in Singapore. A web address is read from the right. The part that identifies the owner is the name immediately before the ".com": here, a string of random letters with no connection to TikTok. Everything to the left of it is a label that the owner of the random domain can set to any words at all, including a brand name.
The platform matters too. In Singapore, scams that reached victims through TikTok rose by 37.8 per cent in 2025, while cases through Facebook-related platforms fell by 39.6 per cent and through Instagram by 44.9 per cent.
Note. The brand name sits on the left of the address, where anyone can type it. The owner is the name before the .com.
Love, fear and the long con
Work is one need among several. The same machinery runs on love, on fear and on the wish for wealth. Only the opening changes.
Romance works slowly. FinCEN describes scammers using "fictitious identities" and "elaborate storylines" to build what victims believe are trusted partnerships, before steering them into supposedly legitimate cryptocurrency investments. The losses then land in the investment column. UNODC, the UN Office on Drugs and Crime, cites US figures attributing an estimated USD 4.4 billion of 2023 cryptocurrency-scam losses to pig-butchering schemes.
Fear works faster. A caller posing as a police officer or an official demands payment to settle an invented problem. Government impersonation caused the second-largest losses of any scam type in Singapore in 2025, at SGD 242.9 million.
Set side by side, the US figures show what each need is worth to the people exploiting it.
Note. Investment fraud is the largest column. Many investment schemes begin as a friendship or a romance.
What each scam takes per case in Singapore
Singapore's police publish the average loss per case. In 2025 investment scams took the largest total, about SGD 336.2 million. Government impersonation took the most per case.
| Scam type | Cases 2025 | Cases 2024 | Losses 2025 | Average loss per case 2025 |
|---|---|---|---|---|
| Government officials impersonation | 3,363 | 1,504 | SGD 242.9m | SGD 72,229 |
| Investment | 5,462 | 6,814 | SGD 336.2m | SGD 61,559 |
| Internet love | 917 | 852 | SGD 24.9m | SGD 27,202 |
| Job | 5,575 | 9,043 | SGD 123.5m | SGD 22,163 |
Note. Government impersonation and investment scams took the most per case in 2025.
A scam industry, not a lone con artist
UNODC counts hundreds of industrial-scale scam centres in South-East Asia. It has identified workers from more than 50 countries in them, many tricked into the compounds by fake job offers and then forced to work. The fake recruiter, in other words, staffs the centre that sends the fake recruiter's messages.
Technology now does much of the writing. UNODC reports that scam operations use large language models for translation and deepfake filters for video calls. Telegram-based marketplaces sell stolen data, hacking tools, malware and money-laundering services, with automation by bots that makes them more convenient and scalable than the dark web. The IC3 says investment scammers use AI to "quickly generate thousands of conversations that appear different to each prospective victim".
The IC3 received 22,364 complaints with an AI element in 2025, reporting losses of about USD 893 million. That figure counts only what victims noticed: the IC3 notes that many do not realise how far AI was involved.
| Scam type | How AI is used | Reported losses |
|---|---|---|
| Investment | Thousands of conversations that each look different; deepfaked endorsements | More than USD 632m |
| Business email compromise | Emails and cloned voices mimicking executives | More than USD 30m |
| Confidence/romance | Fake profiles and scripts written by chat generators | More than USD 19m |
| Employment | Voice spoofing and possible deepfakes in online interviews | Almost USD 13m |
| Distress calls | Cloned voice of a loved one in trouble | More than USD 5m |
| All AI-related complaints | 22,364 complaints | USD 893.3m |
Note. These are the losses victims knew to attribute to AI. The IC3 notes many victims do not realise how far AI was involved.
Ten checks before replying to a job offer or a stranger
These ten checks catch the fake recruiter, the task scam, the shop that sells nothing and the romance that turns to money. None needs technical skill.
1. Check the email address, not the name. A recruiter at a real firm writes from the firm's own email domain. A real recruiter's LinkedIn profile, sent from a Gmail address with the company's name in it, is an impersonation until proved otherwise.
2. Read every link from the right. The owner of a web address is the name directly before the .com, .sg or .co.uk. A brand name further left, such as "ttsg-management", is a label anyone can type.
3. Make the second contact yourself. Find the firm's switchboard or careers page independently and ask whether the person and the role exist. Never use the number or link in the message.
4. Never pay to get paid. A deposit, a fee to unlock tasks, stock bought for your own shop's orders: each is a payment to get paid, which the FTC warns never to make.
5. Treat a balance you cannot withdraw as money already gone. A growing balance on a site that blocks withdrawals is the scam working as designed.
6. Distrust the unsolicited offer. Vague, well-paid remote work arriving by text, WhatsApp or Telegram is the opening move the FTC and Singapore's police both describe.
7. Read what a recruiter sends; never run or install it. Job descriptions and CVs arrive as attachments. Reading one from a sender you have checked is ordinary recruiting. The danger is a request to go further: install a tool, run code, download a repository for a test or enable macros in a document. Binance's engineer downloaded an "assignment" that ran malicious code during set-up.
8. Do not treat a video call as proof. Scam operations use deepfake filters for video calls. A shared social-media account full of personal photos proves only that someone has the photos.
9. Stop when love meets money. Someone met online, never met in person, who introduces an investment or asks for money fits the pattern FinCEN calls pig butchering.
10. Pause, tell someone and report it. Pressure to act now, or to keep the offer secret, is part of the script. In Singapore, the ScamShield Helpline is 1799. In the United States, the FBI takes reports at ic3.gov.
Singapore: who to contact if you think you have been scammed
Your bank, first. The Singapore Police Force advises anyone who has been scammed to contact their bank immediately to report and block any fraudulent transactions.
ScamShield Helpline: 1799. Open 24 hours. Call it to check whether something is a scam, or for advice from National Crime Prevention Council officers after one.
Police report, online. The Singapore Police Force's Lodge Police Report e-service at police.gov.sg takes reports of crimes that do not need immediate police action, such as a scam.
Police Hotline: 1800 255 0000. To give the police information about a crime.
Police emergency: 999. For immediate help. Emergency SMS 70999 if it is not safe to talk.
Police calls come from 6000 0999. From 2 November 2026, every call from the Singapore Police Force uses this caller ID. The police will never ask by phone for money, gold or cryptocurrency, for banking log-in details, to install an app from an unofficial store, or to transfer your call to the police.
The defence is a habit, not a hunch
Every scam in this briefing offers the next step toward something the target already wants. Each earns trust one small, reasonable step at a time.
Intelligence therefore offers little protection. Billions left Binance because one engineer believed he was being considered for a job. He followed the same path as a job seeker opening an online store. Judgement in the moment failed both. The protection lies in habits applied before the moment: check the domain, make the second contact yourself, pay nothing, install nothing.
The question to put to any offer that arrives unasked is the same in every case. Who gains if you take the next step, and how would you know?
A TheRiskAgent briefing on recruitment, passive-income and romance fraud (November 2026). Figures from Binance's Initial Findings and Response Update of 3 November 2026, the FBI's 2025 Internet Crime Report, the US Federal Trade Commission, the Singapore Police Force's Annual Scam and Cybercrime Brief 2025 and its public advisories, ScamShield, UNODC and FinCEN. Reference material, not advice.