RICHMOND, Va. -- Research conducted by cybersecurity professionals has revealed more than 18,000 fake job listings that help con artists steal Virginians’ identities, according to LexisNexis Risk Solutions, Government Group CEO Haywood Talcove.
Talcove leads a team of cybersecurity experts that have tracked fraud targeting the Virginia Employment Commission.
“The government has traditionally been behind the private sector in using tools to do transactions,” Talcove explained. “[Fraudsters] took advantage of legacy systems that were built in the early 2000s. They took advantage of the fact there was a disaster.”
The VEC admitted that the agency gave out $930 million dollars last year in incorrect payments. 7 percent of the money was fraudulently obtained.
It all starts with a fake job posting online.
The con artist poses as a hiring manager using a legitimate company’s name.
The applicant fills out a standard-looking application and the “manager” conducts a virtual interview.
"Created by criminals, Virginians think they're applying for a job, and as part of the application process, they are tricked into confirming their identity with Virginia's identity-verification system for unemployment benefits. Having no idea that they've even been scammed, fraudsters then use their verified identity to file for unemployment assistance," LexisNexis wrote in a press release.
The VEC has partnered with the federally certified identification website, ID.me, which has worked to prevent the scams from happening in the first place.
"However, ID.me blocks these scams. ID.me’s numerous controls prevent social engineering techniques from being successful," according to the company.
ID.me describes the process as "social engineering" or the use of deception by fraudsters to trick you into sharing personally identifiable information (PII), such as your Social Security number, and credit card information.
They shared these tips on their website to keep yourself safe:
- Protect your privacy. Be particularly careful in public areas of sites like Facebook and Twitter. Keep your private information private, and share it only in trusted places.
- Be suspicious of new social media contacts. For example, fraudsters often pose as ID.me employees and ask you for information to "help verify your identity". Legitimate ID.me employees never ask for information in this way.
- Beware of job scams. Scammers may offer you a false job opportunity, then convince you to complete ID.me's identity process for "employment verification". The scammer can then use your cooperation to acquire your personal information. There are similar scams involving dating sites, sweepstakes, or other types of fraud.
- Know who you are communicating with. Legitimate support through social media will only come from official ID.me pages:
- Constant vigilance! Always be on the lookout for suspicious looking links, odd looking content (with typos, etc.), unsolicited contact from people you don't know (e.g. on dating sites), etc.
Sen. Mark Warner described the persistent issues and fraudulent incidents as a “huge issue” during a press call with reporters on Thursday.
“Our technology inside government is part of infrastructure and candidly, we haven’t made the investments that we should,” Sen. Warner explained. “Both at the federal Department of Labor and state employment commissions all across the country, our technology is way outdated. One of the things frankly we didn’t do enough of in the CARES Act relief package is upgrade technology.”
Warner is working to pass bipartisan legislation requiring state agencies like the VEC to report suspected fraud to the Department of Homeland Security. Such a requirement does not exist yet.
“That has to start with an obligation to report,” he stated. “I’m very confident we will see this at least the first step that the VECs and others report these cyber incidents so law enforcement and cybersecurity professionals across state government and federal government can act to prevent this.”
If you suspect a job listing online is fake, call the company’s HR department directly. Often, a hiring manager will not communicate via social media.
Talcove warned that scammers often use google.com, yahoo.com or other commonly used email addresses to trick their victims.
If you’re a victim of identity theft, immediately call local law enforcement and the IRS to report the crime.
“The third thing you need to do is notify the credit bureaus, Experian, Equifax and Transunion, and get a freeze on your credit,” Talcove said.
Joyce Fogg, the VEC's spokesperson, shared the following statement on the situation:
The Virginia Employment Commission cannot release detailed information on fraudulent claims due to ongoing investigations and litigation. The agency is actively working to recover all funds disbursed to fraudulent accounts in partnership with the Attorney General’s office.
