from Hacker News

Ask HN: Is this plea for help some creative new scam, or does this look legit?

by JesseTG on 7/12/24, 6:15 PM with 5 comments

I got a very interesting e-mail through Jobvite that I'm still puzzling over. Here's a screencap and a transcription, both with redactions. https://i.imgur.com/pGegcMM.png

> Dear valued clients and partners of TalentOla,

> This is [first name]. I've work in TalentOla for 10 years, but today I'm violating every company policy and legal agreement by contacting you directly using our proprietary software without authorization. I'm fully aware that I'm breaking the law and company rules. I know this will cost me my job and possibly more, but I have no choice.

> My wife is critically ill and needs immediate, expensive surgery. The cost far exceeds our means, and time is running out. In desperation, I turn to you.

> If you can help, please donate to this Ethereum wallet: [Ethereum address]. I'm using crypto to prevent the company from intercepting or reclaiming any donations.

> I understand this breach may shatter your trust in TalentOla. Please know that this illegal action is mine alone and doesn't reflect on my colleagues or the company.

> I'll face termination and possible legal consequences for this, but saving my wife's life is worth any price. Thank you for reading, and for any help you can offer in this crisis.

> With deepest gratitude and apologies,

> [full name]

Here are some facts:

- I am _not_ the person asking for help. I'm not married, and no one in my family is dying.

- I don't know the person asking for help.

- Both the `From` address and the `Reply-To` address belong to Jobvite, so this was definitely sent by someone on the platform. I did not see any address-spoofing tricks in the e-mail's source.

- This e-mail contains about a dozen legitimate links to job descriptions on Jobvite, mostly for a company called Apexon.

- I got this e-mail about six hours ago and have not received anything from Jobvite since then.

My question: Does this look real, or is this some clever new scam?

  • by latexr on 7/12/24, 6:29 PM

    > My question: Does this look real

    It looks like a scam to me, right from this sentence:

    > I'm fully aware that I'm breaking the law and company rules. I know this will cost me my job and possibly more, but I have no choice.

    Scam messages that elicit a sense of urgency (family terminal illness is quite common) often have this type or martyr discourse.

    > If you can help, please donate to this Ethereum wallet

    And this just cinches it. So this person is “risking everything” to send this plea and they ask for money in a form the recipient is unlikely to have and is linked to countless scams?

    > I'm using crypto to prevent the company from intercepting or reclaiming any donations.

    I don’t buy it. The wallet address is right there. If the company had any legal way of seising that money, they could do it anyway at conversion time. Or has this person found a hospital that takes cryptocurrency?

  • by JojoFatsani on 7/12/24, 6:34 PM

    I would call this a "real clever new scam." Malicious actor gained access to the email sending platform (most likely a third party SaaS and not "proprietary software"), looked up an employee on LinkedIn and sent out the pitty party message in their name to fish for untraceable crypto donations.

    Having worked in the email marketing industry in the past, i can tell you that many end-users (marketing personell) are not technically sophisticated or following best password practices.

  • by navjack27 on 7/12/24, 6:30 PM

    Does it literally matter? Did you ask to have this correspondence with this assumed person? You can safely ignore it if you've answered no to either of these. If it's real, it's not your job to save everybody on this earth. If it's not real then you should really just follow the simple rule of "did you ask for this communication to happen? If not, ignore."
  • by PaulHoule on 7/12/24, 6:29 PM

    One way or another it's a scam.

    Even if the person is telling the truth they are still violating the trust their employer has in them. See

    https://en.wikipedia.org/wiki/Lawrence_Kohlberg%27s_stages_o...