Fraudsters Target Ukrainians with Fake Job Offers and Gift Scams - How to Spot Them

Fraudsters are increasingly using well-known brands to lure money and personal data from Ukrainians. They create fake websites, offer easy part-time jobs, or promise gifts. ShoTam journalists figured out how to recognize a fraudulent scheme and avoid getting caught.

"I saw this ad on our local telegram channel. It's a good channel - they post about Ukrainian holidays and how many missiles were shot down overnight. And there were these gift certificates allegedly from Aurora. I was very excited because it was the holidays," says Antonina from Pryluky.

At the end of last year, she almost fell for a scam that offered to give her certificates for purchasing goods in a well-known Ukrainian multimarket chain.

The woman had already started filling out the questionnaire, but she was alerted by the paragraph about bank card information, so she stopped in time.

Yana, a freshman from Kremenchuk, was looking for a part-time job. On Viber, she received a message from a well-known store offering to pack gift sets at home. The avatar had a logo she knew well, and the message was also written in the company's corporate style.

For the first parcel with cosmetics, Yana was asked to pay a deposit of one thousand hryvnias, as if "the company needs to protect itself from unscrupulous employees." The girl easily agreed, because she had already calculated that she would earn 2,000 hryvnias a day by assembling gift boxes for her favorite store.

Yana received neither the parcel nor her "deposit" back.

Disguised as well-known brands, fraudsters cheat Ukrainians out of money and personal data.

Avatars are stolen from brands and money from people

One of the most popular schemes of online fraudsters is to create a social media page or even a whole website that copies the official resources of a popular brand as much as possible. The level of disguise depends on the skill level of the criminals: some simply put an avatar with a recognizable logo and pretend to be an employee of the company in correspondence, while others create a whole website in the brand's corporate identity, and another one that imitates online banking.

Here's how it works: you receive a winning notification, but to receive the gift, you need to log in via a link, and there's a trap waiting for a gullible user disguised as the website of your favorite store.

When it's a message written with three mistakes per sentence, it's easy to suspect that it's not your favorite brand. But when you receive an email that is written not only competently, but also in the company's corporate communication style, and then you end up on a clone site, the chances of fraudsters increase many times over.

Image: ShoTam

A screenshot of a message from fraudsters offering to pay for likes under products. Screenshot from the official ROZETKA telegram channel.

Aurora, ROZETKA, and Epicenter faced massive use of their names and logos by online fraudsters. "Aurora even launched an educational campaign "Don't Fall for Fakes" to warn Ukrainians against participating in "pranks" and fake vacancies.

ShoTam talked to representatives of the multimarket chain to analyze the most popular fraudulent schemes with fake lures from Aurora: prizes, gift certificates, and jobs.

"Promises"

"Promises" (from the words "work" and "promise") are fraudulent schemes in which the bait is a job - usually easy, not requiring qualifications, but highly paid.

Here are two popular scenarios with promises.

"Money for likes". Attackers send messages offering part-time work directly from the phone: you have to like products and write comments and reviews. For the first likes, fraudsters can even pay a symbolic amount of money. And then they offer you a more difficult task - you have to buy specific products, allegedly to verify the review. In this case, the attackers promise that the person will immediately receive their money back and a good percentage on top. After payment, the "employers" disappear, and the person discovers that they paid for the goods not on the brand's official website, but on its imitation.

Image: ShawTam

A screenshot of a message from fraudsters offering work writing reviews for allegedly Aurora products.

"Pack boxes and money". The scammers pose as brand representatives, saying they are looking for people to pack gift sets at home with products sent by the store. They usually offer a considerable amount of money - for example, 2,000 hryvnias for 10 boxes. Then there are two options: to get the first batch of products, you have to pay off the deposit or open an account on a certain website, allegedly for payroll or internal bonuses. This site is, of course, a phishing site, which is designed to obtain information needed to access your bank accounts.

Unfortunately, this fraudulent scheme with home delivery of goods is very common. Many people are looking for a job or extra income, and who wouldn't want to get 2 thousand hryvnias by packing 10 boxes of cosmetics?

"Even some of our employees, who also received such messages, became interested in this 'job'. Fortunately, they all asked their managers for more details and realized in time that it was a fake. We did not have and do not have a work-from-home format," says Yulia Storozhenko, head of HC marketing at Aurora chain.

Image: ShoTam

A screenshot of a message from fraudsters allegedly offering work at home packaging of cosmetics gift sets for the Aurora chain. Note the number of subscribers to the channel where this message was posted.

What are the red flags to watch out for

• Grammatical mistakes or signs that the message was translated into Ukrainian using an online translator.
• Unrealistic payment. 2,000 hryvnias for a job that takes half an hour and could be done by a child? It sounds tempting, but too fantastic.
• The recruiter only talks about your future benefits and earnings, without diving into the specifics of the job itself, and is not at all interested in your experience and skills.
• An empty profile of a "recruiter". If there is a photo on it, check it using Google image search.
• The need to make an advance payment for employment - allegedly for the materials provided or the first delivery of products, future training, etc.

"You have won a car! Complete the registration..."

Or a smartphone. Or a TV set. Occasionally, they also report winning something less expensive, such as an electric kettle or an iron.

Registration involves entering personal financially sensitive data ( bank card number, expiration date, and CVV) via the link provided. The link, of course, is phishing, meaning that all the data entered is sent to the fraudsters who developed this trap.

Another variant is that the lucky winner is asked to deposit a certain amount of money for paperwork, taxation, or as a guarantee of participation in a public award ceremony.

Image: ShoTam

Screenshot of a message from fraudsters about a car won.

"There have been cases of speculation on the brand name before, but in 2024 the situation became alarming. We started receiving a lot of calls from people about draws and gifts allegedly from Aurora. We noticed that the intensity of mailings about the gifts we won increased before the holidays: St. Nicholas Day, New Year's Day, and Valentine's Day.

The logic of the fraudsters is clear - brands really often organize drawings and promotions at this time," says Yulia Prylipko, head of the Aurora contact center.

Image: ShoTam

A screenshot of a message from fraudsters posing as representatives of the Aurora multimarket chain. The demand to do something immediately and stylistic mistakes are characteristic signs that this message was written by scammers.

Red flag - you are being pushed to take quick action: "go now", "register within 15 minutes", etc.

And if you are asked to pay any amount of money for your prize from a well-known brand or company under any pretext, you can be sure that it is a scam.

Fake gift certificates

Another variant of fraudulent generosity, but in fact ingenuity, is gift certificates for the purchase of goods from your favorite brand or store.

Several local telegram channels offered subscribers to receive certificates allegedly from the Aurora network in the denominations of 500, 1000, and 2000 hryvnias.

To do so, all they had to do was click on the link. It is easy to guess that this link will lead to a phishing resource by looking at the spelling of the brand name in it - "abpopa".

Image: ShoTam

A screenshot of a message from fraudsters posing as representatives of the Aurora network. Note the spelling of the brand name in the link.

Image: ShoTam

A screenshot of a message about certificates allegedly from Aurora in one of the popular telegram channels in Pryluky.

"What is particularly disturbing for us is that we received screenshots of such ads in popular telegram channels. These are no longer one-day channels specially created for sending out fakes, but publications in publics with hundreds of thousands of subscribers. Often, these are publics and channels targeted at older people," representatives of the Aurora network say.

How to check the message about winning a prize or certificate

Check if there is information about this contest, draw or promotion on the company's official website. Do not click on the link provided in the message, even if it says that it leads to the official website. Instead, find the company's website on your own using a Google search.

Make sure that the site is not fake - look carefully at the URL: are there any mistakes in the spelling of the brand name, the use of numbers instead of letters, or the mixing of letters from different alphabets. This is the first sign of a fraudulent clone site.

SSL certificate. In the same line next to the website address, you will find a symbol in the form of a "lock". If it is closed, the site is safe. However, sometimes even well-known brands forget to activate this certificate, so look for additional signs - whether there is contact information, whether all sections are filled in.

If the company is really holding a drawing or giving away gift certificates, the official website will definitely have information about it.

Let's assume that the official website also has information about the draw. Carefully read the terms and conditions to see if they match those described to you in the message.

Call the company's hotline and ask if the brand is currently holding any sweepstakes and what kind of sweepstakes.

"We never offer to make money transfers for participating in contests or provide bank card information to receive gifts. All our contests and sweepstakes are always transparent and do not have any additional conditions, except for those published on the website avrora.ua and on the official @avrora.multimarket pages in social networks," emphasizes Ulyana Shevchenko, Head of Marketing Communications at Aurora.

"Aurora has launched an awareness-raising campaign "Don't Fall for Fakes" on social media. The campaign aims to raise awareness of fraudulent schemes among Ukrainians, using simple messages and the most popular fakes as a visual example.

Image: ShoTam

Image: ShoTam

"Aurora uses popular and recognizable memes to convey the main messages of its "Don't Fall for Fake" awareness campaign. Illustrations are slides from the post on Aurora's official Instagram page.

How to help in the fight against fraudsters

Take a screenshot of a suspicious message or post. This information will help experts track down the attackers faster. In addition, share information about the fake you found with your friends and family to warn them against falling into similar traps.

Send a report of online fraud along with a screenshot to the cyber police by following the link to the Cyber Police Department.

Наталка Бардалим