Fraudsters create fake Canadian company, steal foreign website to victimize job seekers

When Ashley lost her position as a French program co-ordinator due to the COVID-19 pandemic, she threw herself into an aggressive search for another job.  

With experience in sales, marketing and co-ordination, the 25-year-old sent her resume out widely and posted it on Indeed, Linked-in and other reputable career sites. 

So when a Vancouver-based technology company called Gux-IT contacted her in June and invited her to apply for a full-time "general assistant" position she would work remotely from her Toronto home, she was excited — but also cautious. 

Although working from home has become the norm, especially over the past several months of the pandemic, Ashley was also conscious that employment scams — where people desperate for work are "hired" into jobs that don't exist and tricked into using their own money for things — have been on the rise. 

Her first step was to make sure there was a job posted on Gux-IT's website and thoroughly examine the rest of it.  

"I also always check, too, when I do go on websites, the red flags," Ashley said. "That means the 'about us' page, that means a number, an address, all the different links that are able to be clicked. I did check all of those things." 

The people she was communicating with used Gux-IT email addresses. In her job interview, she spoke with someone on the phone who appeared to be calling from a B.C. area code. Ashley even looked up the company's headquarters with Google Street View.

She thought she had checked all the right boxes. But what she didn't realize was that Gux-IT itself is a fake organization — nothing more than fraudsters hidden behind a duplicated website and an incorporated company that doesn't belong to them.  

Job scams on the rise

Job scams are on the rise and becoming more sophisticated, said Jeff Thomson, senior RCMP intelligence analyst at the Canadian Anti-Fraud Centre.

In 2019, the centre received more than 2,400 job-related fraud reports, he said. The number of reports counted in 2020 is already more than 2,300 — and that's only up to July.    

With more people losing their jobs during the COVID-19 pandemic and seeking work, as well as shifting to doing business primarily online, "it's sort of ripe for job scams right now," Thomson said. 

Ashley's first day of work at Gux-IT on July 6 started normally enough. She gave the company a copy of her driver's licence, but not her social insurance number. She didn't supply any banking information; she was told she'd be paid via e-transfers biweekly.

The person introduced as Ashley's HR manager communicated with her using the Telegram messaging app — something that didn't seem strange in an era of teleworking.  Her manager used the name Nancy Garapick. After the fact, Ashley realized it was a fake identity — the stolen name of a Canadian Olympic swimmer.  

CBC News has agreed to use only Ashley's first name because it's not known who or where the people behind Gux-IT are. She fears for her safety after sharing her experience publicly. 

For the first part of the day, Nancy had Ashley watch training and orientation videos. She urged Ashley to contact her with any questions or concerns.

Later in the day, Nancy messaged Ashley with her first task: to help the IT department, which she was told advised clients on what software and website hosting tools they needed and also bought them on clients' behalf.

Cryptocurrency transactions

"It is quite simple: you will need to buy domains, hosting for websites, pay for various tools that they need in their work," Nancy wrote in a message Ashley screengrabbed and provided to CBC News.

To do that, Nancy wrote, "we will carry out the task of replenishing your work wallet" using Ethereum, or "Ether" — a cryptocurrency much like bitcoin.

There are bitcoin and Ethereum ATMs — just like regular ATMs — in convenience stores across Toronto, and several in other Canadian cities, such as Calgary, Montreal and Vancouver.  Ashley was told she would receive an e-transfer of $2,000 from the company and then go deposit it into a cryptocurrency ATM located in a convenience store on Gerrard Street in Toronto to start her "work wallet."

Wanting to be extra cautious, Ashley contacted her Scotiabank branch and told them an e-transfer was coming from a new employer, and to alert her if anything looked suspicious. When the transfer arrived within a couple of hours, the bank didn't raise any alarms, so Ashley withdrew the $2,000 as instructed and made the deposit.

She had just deposited the money into the Ether wallet when her phone rang with devastating news. The Google Street View she had previously seen had shown a building with several businesses in it, so her boyfriend had contacted a bar on the ground floor and asked an employee there if he would check the office directory after his shift.

'My heart and my stomach just sank'

Still standing beside the ATM, Ashley listened as this "kind soul" returned their call. 

"He's like, 'Hey guys, I looked into it for you ... and this company doesn't exist. Like, it's nowhere in the building,'" she said. "My heart and my stomach just sank." 

Thomson at the anti-fraud centre said they've received another similar, anonymous report from someone else who was "hired" by Gux-IT and asked to do the same thing. 

The goal of "cash-out scams" like this, he said, is to move dirty money using "employees."

"What we see is the fraudsters take time to set up fraudulent websites that may spoof real companies or seem legitimate," Thomson said. 

Then, they take money from "compromised accounts" and have unsuspecting people who think they're doing legitimate work convert it into cryptocurrencies that are hard for law enforcement to track, he explained.

"They're implicating you in a money laundering scheme, a cash-out scheme."

Stolen website and parent company

CBC News investigated Gux-IT and found its website had been stolen — copied almost word for word, including the design, the description of the company's services  and even employee photos — from a company called Synebo based in Odessa, Ukraine.  

The fraudsters substituted the name Gux-IT, or just "Gux, " wherever Synebo is mentioned.

When reached by CBC News in Ukraine on Thursday, the founder and head of Synebo, Shimshon Korits, confirmed he had never heard of Gux-IT.  Synebo had recently received a couple of messages through its "contact us" email, which Korits wasn't sure what to make of, alerting him that Gux-IT appeared to be stealing his company's identity.

CBC News reviewed the emails: one was from someone who had been checking out Gux-IT for a friend who had been offered a job there and found the same photos were on both websites through a reverse image search. The other was from a woman who said she had clicked on the phone number listed on Gux-IT's website and Synebo's number came up.

When CBC News called the number at the bottom of Gux-IT's website, it was out of service. 

With everyone associated with Gux-IT using fake names, no one knows who to contact. After "Nancy" tried to get Ashley to move another $3,000, Ashley blocked her.  Nancy then erased all the messages they had exchanged on Telegram, Ashley said. 

Even the "parent company" listed on Gux-IT's website — Gux Enterprises Ltd. — is stolen. 

Ken Ellis, a steamfitter in rural Bonnington, B.C., registered Gux Enterprises Ltd. as a corporation last October when he was considering starting an equipment rental business. CBC News found him through the incorporation certificate filed with Industry Canada. 

Reached by phone on Thursday, Ellis was stunned.

"They're just stealing my name and putting it on their website," he said after checking the Gux-IT site himself.

'This is a new digital world'

Ellis reported it to his local police force immediately after speaking to CBC News.

"Unfortunately the local police have informed me that they have no resources to take down the website or even do anything but open a file," he wrote in an email. "I find it sickening that criminals keep finding more complex ways to fool and fraud people with relative impunity."

Ashley felt the same way. She's reported Gux-IT to the Toronto Police Service and to Scotiabank. Both told CBC News they are investigating. 

So far, there's no sign that the e-transfer she deposited at the cryptocurrency ATM has bounced, but her bank hasn't confirmed that. Like Thomson at the anti-fraud centre, she suspects that the people responsible were using her to launder money. 

In addition, when she called credit monitoring companies Equifax and Transunion to flag her credit cards the day after she realized Gux-IT was a scam, she was horrified to learn her birthdate and address had been changed in Equifax's system. Transunion told her someone had called, Ashley said, but didn't indicate any of her information had actually been changed. 

Although they can't prove Gux-IT was behind that, Thomson said he wouldn't be surprised.

"They're not just going after your money, they're going after your personal information. Your personal information is a commodity," he said, noting that the fraudsters would likely use it to open other accounts, or sell it to other identity thieves. 

Although Ashley did her due diligence in researching the company, the "red flag" that should stop even the most savvy people from falling for schemes is being asked to transfer money — especially into cryptocurrency, Thomson said. 

"That's where we say, 'don't do it," he said. 

Ashley hopes that sharing her story will also help. 

"This is a new digital world," she said. "I hope this helps others educate themselves."