Employment fraud that runs through prepaid vouchers comes in two shapes, and it is worth separating them, because the damage differs and so does the way out.
In the first, you pay to get the job. In the second, you get the job, and the job is the crime.
Shape one: costs that appear before the work does
The approach usually arrives unsolicited. A WhatsApp or Telegram message with your first name in it. A note about a CV you posted on a job board and forgot. A recruiter profile with a stock photograph and a handful of connections. The role is remote, the pay is comfortable, the hours are flexible, and the interview is a text conversation that ends in an offer the same afternoon.
Then a cost appears, and it is never framed as a cost to you.
- A refundable deposit on equipment, against a laptop that will be shipped next week.
- A training course or certification the client insists on.
- A criminal record check or screening fee.
- Software licences, a portal subscription, a virtual office.
- Visa processing, a work permit, a medical, an agent's fee for a role overseas.
- A small verification payment, to confirm your details work.
The payment has to be made by voucher code, or by crypto bought with vouchers, or by a gift card read out over chat. Sometimes the reason offered is convenience: payroll cannot process an incoming transfer, the finance team is in a different time zone, the accounts system is being migrated.
Payroll runs one direction. Money that moves from the worker to the company before any work has been done is a fee, not an employment relationship, and no invented reason changes that.
There is a real edge case worth naming, because pretending otherwise is condescending. Some genuine work does require you to own tools, a laptop, a headset, insurance or a licence. The distinction is who holds the money and who chooses the supplier. In real work you buy from a supplier you pick, on your own terms, and you keep what you bought. In the fraud you pay a supplier the recruiter names, by an instrument the recruiter names, and the promise is reimbursement in a first pay packet that never arrives.
Shape two: the job is the laundering
The second shape does not ask you for money. It gives you some.
The titles vary: payment processor, financial agent, regional coordinator, personal assistant, customer support with a reimbursements duty, crypto liquidity operator. Mystery shopping is a long-running variant, in which you are asked to evaluate a retailer's service by buying vouchers and then reporting back — reading the codes out to your handler as proof of purchase.
The mechanics are consistent. Money arrives in your account from a third party you have never heard of, or you are told to deposit a cheque. You keep a percentage as commission. The rest you convert into vouchers or crypto and forward on.
Two things are true about that money. It is usually not the sender's. And it is not settled. A cheque or an incoming payment can appear as available balance before it has genuinely cleared, and it can be reversed later — after your voucher codes have already been spent. You are left owing your own bank the full amount.
The legal position is heavier than most people expect. In many jurisdictions, moving criminal property is an offence not only when you knew, but when you had reasonable grounds to suspect, and "the recruiter seemed professional" is not a defence. The everyday consequences arrive first: accounts frozen, accounts closed, a fraud marker shared between banks that makes opening a new account difficult long afterwards.
The variant that looks like piecework
Task work, app rating, product boosting, order grabbing. You complete simple tasks, a balance grows on a dashboard, and you withdraw a small amount early to prove the system pays. Then a task requires you to hold a larger balance than you have, so you top up to unlock it — often by voucher, because the platform accepts almost nothing else. The number on the screen is a number in a web page controlled by the people asking you to fund it.
The first small withdrawal is not a sign of good faith. It is the cost of the pitch.
The tells, in the order you can check them
- An offer without a live conversation with a named human being.
- An entire hiring process conducted inside a chat app.
- A company address on a free email provider, or a domain that differs from the real one by a single character or an added word.
- A recruiter the company's own switchboard has never heard of.
- Pay noticeably above the going rate for work described as requiring no experience.
- A deadline: the position closes tonight, the client needs a start date tomorrow.
- A payment method chosen for you, and it is a code.
- Requests for identity documents and money in the same conversation.
Checks that take ten minutes
Ask for the legal entity name rather than the trading name, then look it up in the company register of the country claimed. Telephone the company on a number you found yourself, not one supplied in the message, and ask whether the vacancy and the recruiter exist. Compare the email domain character by character against the site you reached independently. Search the exact wording of the message in quotation marks, because these scripts are reused across many approaches. Ask for a written contract naming the employer, its registered address and the payment terms, and check that the address is a real business rather than a mailbox shared by a long list of unrelated companies.
A genuine employer will not be offended by any of this. A fraudulent one becomes irritated quickly, which is itself informative.
Your documents are the other target
Even where no money changes hands, these approaches harvest passport scans, selfies holding identity documents, proof of address, tax numbers and bank details. That package is enough to open accounts in your name, and those accounts are then used for the laundering you declined to do yourself.
A real employer collects identity documents after an offer is accepted, through a system you can identify, with a named company behind it and a written explanation of what happens to the data. So does any regulated financial business — that is the point of our verification process, and it comes with a privacy notice stating who holds the documents, on what basis and for how long. A recruiter on Telegram can tell you none of this, because there is nothing behind them to tell you about.
If you have already paid or forwarded codes
Stop moving money immediately, including any final payment described as the one that releases everything else. It does not exist.
Gather the receipts and voucher serial numbers, and contact each issuer directly using a number from the brand's own site. If a balance has not been spent, it may be possible to block it. Tell your bank the same day if a cheque or transfer passed through your account, and say plainly that you believe you were recruited into fraud — volunteering it is far better than a bank discovering it. Report to the police and keep the reference. Preserve the job advert, the messages, the contract and the recruiter's profile before the accounts are deleted.
The full sequence is set out in you sent someone a voucher code, and the wider pattern in how prepaid voucher scams work.
One sentence covers the whole category, and it is worth keeping where you can reach it during a promising conversation with a persuasive recruiter: nobody legitimate asks to be paid in vouchers — least of all someone offering you a job.