Fake Remote Job Offer Scams, Equipment Check Fraud, and I-9 Identity Theft¶

Receiving a remote job offer after a text-based interview on Microsoft Teams, Telegram, Signal, or WhatsApp, followed by instructions to deposit a $3,500 "home office equipment check" via mobile banking app and wire or Zelle money to an "approved vendor" for a company MacBook and software licenses, or realizing right after uploading your Social Security card, driver's license, passport, and direct-deposit voided check to an onboarding portal that the recruiter is an impostor, is a dual financial and identity crisis. According to the US Federal Trade Commission (FTC) and the FBI Internet Crime Complaint Center (IC3), employment and task scams are among the fastest-growing financial frauds globally because they exploit two vulnerabilities at once: 1. federal banking laws (Regulation CC / Expedited Funds Availability Act) force your bank to make deposited check funds look "available" in your balance within 24 to 48 hours even though a counterfeit check takes 5 to 14 business days to bounce through the Federal Reserve clearinghouse, leaving you personally liable for every dollar you sent to the scammer's fake vendor; and 2. fake Form I-9 and Form W-4 onboarding packets give organized crime syndicates everything required to open bank accounts, file fraudulent tax returns, hijack unemployment benefits, and launder money in your name.

If the job scam involves physical threats, extortion, or someone arriving at your home to collect cash or packages, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or check our directory of international emergency numbers immediately. For all cases of fake equipment check deposits, cryptocurrency "task optimization" job scams, or compromised I-9 / W-4 onboarding documents, execute the damage-containment steps below immediately.

Do this now¶

1. DO NOT send, wire, Zelle, Venmo, buy gift cards, or transfer a single dollar from any "home office equipment check": No legitimate employer in the world will ever mail or email you a check to deposit into your personal bank account and tell you to transfer funds to a third-party equipment vendor via Zelle, Cash App, Venmo, wire transfer, Bitcoin ATM, or gift cards. Even if your banking app shows the $3,500 or $4,800 check as "Posted / Available Balance", the check is a counterfeit or altered check that will bounce in 5 to 14 days, wiping out your account into a negative balance.
2. If you already deposited a fake equipment check, call your bank's Fraud & Check-Hold Department in person TODAY before it bounces: Do not touch or spend the credited funds. Walk into a physical bank branch (or call the Fraud Department on the back of your debit card) and state clearly: "I am the victim of a fake remote job offer check scam. The check I deposited on [Date] for $[Amount] was provided by an employment scammer. Please flag it as a suspected counterfeit check immediately so my account is not closed for check fraud or reported negatively to ChexSystems and Early Warning Services (EWS)."
3. If you gave the scammer a "Voided Check" or your Bank Routing & Account Number for "Direct Deposit", close that bank account today: Scammers do not ask for your routing and account number on a fake direct-deposit form to pay you; they use those numbers to initiate fraudulent ACH debit pulls, print counterfeit paper checks drawn on your account, or use your checking account as a money-mule drop. Have your bank close the compromised account number and open a brand-new account number.
4. If you uploaded your Social Security Number (SSN), Driver's License, or Passport on a fake Form I-9 / W-4, freeze all 3 credit bureaus AND ChexSystems immediately: Place an immediate, free Security Freeze at Equifax, Experian, and TransUnion (and a banking freeze at ChexSystems) following our data breach response and password leaks guide so the scammers cannot open credit cards, auto loans, or fintech checking accounts using your driver's license selfie and SSN.
5. Lock your Social Security number at E-Verify (myE-Verify Self Lock) and get an IRS Identity Protection PIN (IP PIN): Because employment scammers resell stolen I-9 packages (SSN + Photo ID) on the dark web for unauthorized employment and tax refund fraud, log into myeverify.uscis.gov to activate Self Lock (blocking anyone from using your SSN to pass an E-Verify employment check) and go to irs.gov/ippin to obtain a 6-digit IRS Identity Protection PIN so no criminal can file a tax return in your name.
6. If the recruiter asked you to install "remote work monitoring software" (AnyDesk, TeamViewer, ScreenConnect, or a custom .exe/.dmg script), disconnect your computer from Wi-Fi immediately: Fake IT onboarding and fake coding tests frequently install Remote Access Trojans (RATs) or infostealer malware that steals your browser cookies and crypto wallets. Isolate the computer and follow our malware, ransomware, and spyware infection guide.

Decision tree: triage by which stage of the job scam occurred¶

Fake employment schemes operate across four primary attack vectors. Follow this triage flowchart based on what you shared or deposited:

flowchart TD
    Start["Realized Remote Job Offer or Recruiter Is a Scam"] --> Vector{"Which actions took place during the interview or onboarding?"}
    Vector -->|"1. Deposited an 'Equipment / Stipend Check' (or Sent Money to Vendor)"| Check["URGENT BANKING CRISIS: Do Not Spend Funds. Visit Bank Branch Today to Self-Report Counterfeit Check"]
    Check --> Recall["If You Sent Zelle / Wire / Card Payment: Request Immediate Fraud Recall & File Police + IC3 Report"]
    Recall --> Chex["Prevent ChexSystems / EWS Account Closure Blacklisting by Presenting Police & FTC Reports to Bank Manager"]
    Vector -->|"2. Submitted SSN, Driver's License, Passport, or W-4 / I-9 Forms"| ID["IDENTITY & TAX CRISIS: Freeze Equifax, Experian, TransUnion, ChexSystems & NCTUE Immediately"]
    ID --> Gov["Lock SSN on USCIS myE-Verify + Get IRS IP PIN (irs.gov/ippin) + Monitor State Unemployment Portal"]
    Vector -->|"3. Gave Bank Routing & Account Number (Voided Check) or Logged Into Bank via Link"| Bank["ACCOUNT TAKEOVER CRISIS: Close Compromised Bank Account Number & Open New Account Number"]
    Vector -->|"4. Paid Crypto / USDT to 'Optimize Tasks' or Installed 'Work Software'"| Tech["TECH & CRYPTO CRISIS: Stop Paying 'Withdrawal Taxes' (Pig Butchering) & Wipe AnyDesk / Infostealer Malware"]

Anatomy of the 4 major remote job scams (and why victims fall for them)¶

Modern job scammers do not send poorly spelled emails from free webmail addresses. They scrape real job descriptions from Fortune 500 companies and legitimate startups, spoof executive LinkedIn profiles, register lookalike domains (careers-at-company.com), and conduct multi-hour interviews before springing the trap.

Phase 1: Emergency banking rescue if you deposited a fake equipment check¶

Understanding how banks treat a bounced fake check is critical to saving your money and your ability to hold a bank account in the future.

Why "Available Balance" Does Not Mean a Check Has Cleared¶

Under the US Expedited Funds Availability Act and Federal Reserve Regulation CC (12 CFR § 229.10 - § 229.12), consumer banks are legally required to make the first $225 to $275 of a check deposit available the next business day, and the remainder of most domestic checks (especially fake cashier's checks or corporate checks) available within 2 to 5 business days. - Scammers print counterfeit checks using a real corporation's routing and account numbers stolen from public filings (so the routing number passes initial electronic validation), or they alter a washed check. - When the check finally reaches the issuing corporation's bank or is audited by corporate Positive Pay 5 to 14 business days later, it is dishonored and returned as "Counterfeit / Altered / Refer to Maker". - Under the Uniform Commercial Code (UCC § 4-214, Right of Charge-Back), your bank has the absolute legal right to deduct the full $3,500 or $4,800 back out of your checking account the instant the check bounces, even if a bank teller told you on Day 2 that the check "looked good and cleared."

Step-by-Step Protocol Based on Where You Are in the Check Scam¶

Scenario A: You Deposited the Fake Check, But Have NOT Sent Any Money Yet¶

You have avoided financial loss, but your bank account is in immediate danger of being closed and blacklisted for check fraud. When a $3,500 counterfeit check bounces, automated bank risk engines (Early Warning Services / ChexSystems) cannot tell whether you printed the fake check to defraud the bank or were tricked by a job scammer. Without proactive notification, many banks automatically freeze and close the customer's account and file a negative EWS / ChexSystems fraud entry that blocks you from opening a checking account at any major bank for 5 to 7 years. 1. Leave 100% of the check amount untouched in your account so the bank can smoothly claw it back when it bounces. 2. Walk into a physical branch or call your bank's Fraud Department immediately (before the check bounces). 3. Ask the branch manager or fraud specialist to place a Voluntary Victim Self-Report Note on the pending check deposit: "I was targeted by an employment check scam. After depositing check #[Number] for $[Amount], the scammer asked me to wire/Zelle the funds to a fake hardware vendor. I realized it is a scam, I have NOT touched the funds, and I want the bank to place a hold on those funds so they can be returned when the check bounces without penalizing my account standing or charging me a returned-item fraud closure." 4. Save the name and employee ID of the bank representative and the case reference number.

Scenario B: You Already Sent Money (via Zelle, Wire, Cash App, Gift Cards, or Crypto) Before the Check Bounced¶

Your account balance is about to drop by the full amount of the counterfeit check, which will likely push your checking account thousands of dollars into a negative overdrawn balance. 1. Call your bank's Fraud & Loss Prevention Department within the hour: - Report both the incoming counterfeit check and the outgoing fraudulent transfer (Zelle, wire, ACH, or debit card transaction). - If you sent a Domestic or International Wire Transfer within the last 24 to 72 hours, demand an immediate Emergency Wire Recall (SWIFT gpi Stop and Recall or Fedwire Fraud Recall) and file an urgent complaint at ic3.gov following our corporate business email compromise and wire fraud recall guide. - If you sent money via Zelle, Venmo, or Cash App, report the recipient handle/phone number to both your bank and the payment app's Fraud Department as an Authorized Push Payment (APP) Employment Scam / Impostor Fraud so the receiving mule account can be frozen before the scammer cashes out. 2. File an FTC Identity Theft / Fraud Report (IdentityTheft.gov & ReportFraud.ftc.gov) and a Local Police Report: - Bring printed screenshots of the fake job offer letter, the recruiter's messages, the image of the fake check (Never mail an image of a fake check via Mobile Deposit if you still have it), and the vendor transfer instructions to your local police station to obtain a Police Incident Report Number. 3. Prevent ChexSystems / Early Warning Services (EWS) Blacklisting & Negotiate a Hardship Repayment Plan: - Present your Police Report and FTC Report to a branch manager at your bank. - Ask the bank in writing: 1. Not to report your account to ChexSystems or Early Warning Services under a "Suspected Fraud / Account Abuse" code (since you are a documented crime victim); 2. To waive overdraft and returned-check fees; and 3. To convert any negative balance resulting from the charge-back into an interest-free 0% APR Hardship Repayment Plan over 6 to 12 months rather than closing your account and sending it to collections.

Phase 2: What to do if you gave scammers your Form I-9, W-4, SSN, Passport, Driver's License, or Bank Account Number¶

In many fake remote job scams, there is no fake check at all: the entire purpose of the fake interview and "Offer Letter" is to trick you into filling out an "HR Onboarding Packet" containing your Social Security Number (SSN), Date of Birth, Mother's Maiden Name, Driver's License / Passport scans, and Direct Deposit Routing & Account Numbers. Execute this 7-point containment checklist immediately:

1. Close Your Compromised Bank Account (If You Provided a Voided Check or Direct Deposit Form)¶

A standard US Direct Deposit Authorization Form or Voided Check exposes your 9-digit ABA Routing Number, your full Checking Account Number, and your signature. - Unlike debit cards, the US Automated Clearing House (ACH) network allows any merchant, payroll processor, or biller with your routing and account number to initiate an ACH Debit Pull out of your account, or allows criminals to print counterfeit paper checks with magnetic MICR ink drawn directly on your account. - Do not merely ask your bank to "watch" the account: Instruct your bank to permanently close the compromised checking/savings account number and open a brand-new account number (transferring your legitimate balance over and disabling "automatic forwarding of ACH debits" from the old closed account number).

2. Freeze All 3 Nationwide Credit Bureaus AND Specialty Banking Bureaus¶

With your SSN, Date of Birth, and a high-resolution scan of your Driver's License or Passport, criminals can pass almost any online bank or lender KYC (Know Your Customer) check. Freeze all five of these bureaus today (100% free by federal law under 15 U.S.C. § 1681c-1): 1. Equifax: equifax.com/personal/credit-report-services/credit-freeze/ (1-888-298-0045) 2. Experian: experian.com/freeze/center.html (1-888-397-3742) 3. TransUnion: transunion.com/credit-freeze (1-800-916-8800) 4. ChexSystems (Checking & Savings Account Opening Freeze): chexsystems.com -> Place a Security Freeze (1-800-428-9623). Freezing ChexSystems prevents criminals from using your stolen Driver's License photo and SSN to open fraudulent online checking accounts (such as Chime, SoFi, Ally, or Chase accounts) in your name to launder money. 5. NCTUE (National Consumer Telecom & Utilities Exchange): nctue.com (1-866-349-5355) to stop scammers from financing iPhones and cellular lines under your SSN.

3. Activate myE-Verify Self Lock to Block Unauthorized Employment Under Your SSN¶

When you hand over a completed USCIS Form I-9 (Employment Eligibility Verification) along with photos of your List A (US Passport) or List B + List C (Driver's License + unrestricted Social Security Card) documents, dark-web brokers sell that exact "verified I-9 bundle" to individuals who cannot legally work under their own identity. If someone uses your I-9 bundle to get a job, their employer will report tens of thousands of dollars in W-2 or 1099 wages to the IRS under your Social Security Number, triggering IRS tax audits and back-tax bills against you. - Go to the official US Department of Homeland Security / USCIS portal at myeverify.uscis.gov. - Create your personal account, pass identity verification, and turn on Self Lock. - Once Self Lock is active, if anyone attempts to use your Social Security Number to pass an E-Verify employment check at any participating US employer, the system immediately blocks the match with a Tentative Nonconfirmation (Mismatch) and alerts you. (Whenever you start a real job yourself, you can temporarily unlock Self Lock in 30 seconds).

4. Obtain an IRS Identity Protection PIN (IP PIN) and File Form 14039¶

A stolen Form W-4 + SSN allows criminals to file a fake early federal tax return in January to steal your tax refund, or stick you with unpaid taxes on phantom W-2 / 1099-NEC income. 1. Go to irs.gov/ippin and enroll in the IRS Identity Protection PIN (IP PIN) program. 2. The IRS will immediately generate a secret 6-digit IP PIN. Once enrolled, the IRS computers will reject any electronic or paper Form 1040 tax return filed under your Social Security Number that does not include your secret 6-digit PIN. 3. If you discover unauthorized wages reported under your SSN, check your Social Security Earnings Record at ssa.gov/myaccount and submit IRS Form 14039 (Identity Theft Affidavit) online via IdentityTheft.gov.

5. Check and Lock Your State Unemployment Insurance (UI) Portal¶

Stolen I-9 and W-4 packets are the #1 fuel for State Unemployment Insurance (UI) Impostor Fraud (where scammers file for weekly unemployment benefits in your name using your SSN, date of birth, and prior employer history from your resume). - Go to your State Department of Labor / Workforce Agency website TODAY. - Register your own legitimate online Unemployment Insurance claimant profile (even if you have no intention of claiming benefits) using strong Multi-Factor Authentication (MFA) so an impostor cannot register an account under your SSN first. - If the state portal says "An account already exists for this Social Security Number", file an immediate State Unemployment Identity Theft Report on the state agency's fraud portal so you do not receive a fraudulent IRS Form 1099-G for benefits you never collected.

6. Flag or Replace Your Compromised Driver's License and Passport¶

Because you uploaded a clear color scan of your Driver's License or Passport (and possibly a "liveness selfie"), criminals can use those images to pass remote identity checks or print high-grade physical counterfeit IDs: - Driver's License: File your local Police Report listing the compromise of your Driver's License number, and contact your state Department of Motor Vehicles (DMV) Fraud Unit to place a fraud flag on your license record (or request a replacement license with a new audit/document discriminator number DD). - Passport: If you only sent a photocopy/photo of your passport information page (and still hold your physical passport book in your hand), you do not necessarily have to cancel your physical passport unless instructed by law enforcement, but if your physical passport was mailed away or you want to invalidate the passport number on your I-9 scan so it fails automated DHS document-number checks, you can report the passport compromised and apply for a replacement book with a brand-new passport number via travel.state.gov (United States), HM Passport Office (United Kingdom), or Passport Canada.

How to verify whether a remote job offer is real or a scam in under 3 minutes¶

Before you ever upload an ID or accept an offer letter, test the recruiter against these 7 Non-Negotiable Rules of Legitimate Hiring:

Copy-and-Paste Script: Written Notice to Your Bank After a Fake Job Check Deposit¶

If a fake equipment check has bounced (or is about to bounce) and you want to protect your checking account from being closed and reported negatively to ChexSystems or Early Warning Services (EWS), hand-deliver a copy of this signed statement (with your Police Report and FTC Report attached) to your bank branch manager and upload it to your bank's fraud claim portal:

[Your Full Name]
[Your Address & Phone Number]
Account Number: [Last 4 Digits of Compromised Account]
Date: [Date]

TO: Branch Manager & Fraud / Loss Prevention Department, [Name of Bank]

RE: VICTIM SELF-REPORT OF EMPLOYMENT CHECK SCAM & REQUEST TO PREVENT ADVERSE CHEXSYSTEMS / EARLY WARNING SERVICES (EWS) REPORTING
FTC Fraud / Identity Theft Report #: [Insert Number]
Local Police Incident Report #: [Insert Number]

To Whom It May Concern:

I am writing to document that I was targeted and deceived by a criminal employment fraud syndicate impersonating [Name of Impersonated Company]. After a fraudulent remote hiring process, the scammers provided me with Check #[Check Number] dated [Date] in the amount of $[Amount], purportedly as a home-office equipment stipend, and instructed me to transfer funds to an external hardware vendor.

Upon discovering that the job offer and check were fraudulent, I ceased all communication with the scammers, filed Official FTC Report #[Number] and Local Police Report #[Number] (attached), and notified [Name of Bank].

Because I am a documented crime victim who acted in good faith and had no knowledge that Check #[Check Number] was counterfeit, I respectfully request that [Name of Bank]:
1. Flag Check #[Check Number] as the instrument of third-party employment fraud against a victim, and NOT attribute any fraudulent intent or account abuse to me personally;
2. Refrain from reporting any negative Suspected Fraud or involuntary account-closure code under my name or Social Security Number to ChexSystems, Early Warning Services (EWS), or TeleCheck;
3. Transition my remaining legitimate funds to a newly numbered checking account to prevent unauthorized ACH debits by the scammers; and
4. Waive returned-item fees and, if a negative balance resulted from this scam, allow me to resolve the balance via a structured hardship repayment plan.

Sincerely,

[Your Signature & Printed Name]
Enclosures: FTC Identity Theft Report, Local Police Report, Copies of Fraudulent Job Offer & Check Instructions

Frequently asked questions¶

Why did my bank tell me the job check "cleared" if it was actually a fake check?¶

When a bank teller or mobile banking app shows that a deposited check's funds are Available after 1 to 2 business days, that does not mean the check has cleared the issuing bank or been verified as authentic. Under the US Expedited Funds Availability Act (Federal Reserve Regulation CC, 12 CFR Part 229), banks are required by federal law to release provisional funds to customers within 1 to 2 business days, long before the check completes the 5-to-14-day interbank clearinghouse cycle. Employment scammers exploit this multi-day float gap to trick you into wiring or sending real cash out of your account before the counterfeit check bounces and your bank claws back the provisional credit under Uniform Commercial Code Section 4-214.

Can I go to jail or be sued if I deposited a fake check from a job scammer?¶

If you were tricked by a job scammer, cooperated immediately with your bank, and filed a Police Report and FTC Identity Theft Report, you are a crime victim rather than a perpetrator and will not face criminal prosecution simply for being deceived into depositing a single fake check. However, under Uniform Commercial Code banking rules, you remain civilly and financially responsible to your bank for repaying any money you withdrew or transferred out before the fake check bounced, and you must stop accepting or forwarding any further checks, transfers, or packages so you do not act as a money mule.

How do I lock my Social Security Number so no one can use my stolen Form I-9 to get a job?¶

Create a free personal account on the US Department of Homeland Security and USCIS myE-Verify portal (myeverify.uscis.gov) and enable the feature called Self Lock. Once Self Lock is turned on, if any impostor attempts to use your Social Security Number on a Form I-9 at an E-Verify employer, the system blocks the employment authorization check and notifies you; you should also obtain a 6-digit IRS Identity Protection PIN at irs.gov/ippin and freeze your credit files at Equifax, Experian, TransUnion, and ChexSystems.

Sources checked¶

• Federal Trade Commission (FTC, United States): Job Scams, Fake Check Overpayment Scams, and IdentityTheft.gov Employment Identity Theft Recovery Protocols.
• Board of Governors of the Federal Reserve System & Office of the Comptroller of the Currency (OCC): Regulation CC (12 CFR Part 229, Availability of Funds and Collection of Checks) and Uniform Commercial Code (UCC § 4-214) Provisional Credit Charge-Back Rules.
• Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3): PSA Alerts on Work-From-Home Equipment Check Fraud, Cryptocurrency Task Optimization Employment Scams, and Money Mule Recruitment.
• US Citizenship and Immigration Services (USCIS / Department of Homeland Security): myE-Verify Self Lock Program for Protecting Social Security Numbers Against Unauthorized Form I-9 Employment Fraud.
• Internal Revenue Service (IRS, United States): Identity Protection PIN (IP PIN) Enrollment (irs.gov/ippin) and Employment-Related Identity Theft (Form 14039) Remediation.

Related guides¶

• Data breach response, leaked passwords, and credit freezes
• Corporate business email compromise (BEC) and wire fraud recall
• Cryptocurrency wallet drain, seed phrase compromise, and revoking approvals
• Malware, ransomware, and spyware infection removal
• Emergency numbers by country