The €100 WhatsApp ‘job’ that left a Spanish worker €40,408 out of pocket

An advert appeared on LinkedIn, the Paris company responsible genuinely existed and a signed pre-contract promised a monthly salary. After various small repayments and a WhatsApp group of apparently successful colleagues, the unlikely request started to look like something credible.

How a LinkedIn advert led to a five-figure loss

Paula Sánchez, a 47-year-old administrative manager from Pontevedra, was at her computer in when a remote vacancy caught her attention. The extra income appeared compatible with her existing job and family life, she later told El País. The supposed recruiter, who called herself Sofía Koivu, contacted Sánchez through WhatsApp and claimed to represent ReSee, a genuine vintage luxury company based in Paris. Within hours, Sánchez had signed a pre-contract for a remote “marketing ranking associate” position. It promised a basic salary of €600 and commissions for completing tasks designed, she was told, to improve the visibility of products online.

The unusual part came when she was instructed to convert €100 into cryptocurrency before beginning work. The person guiding her mixed conversations about search rankings and commissions with personal anecdotes about her dog and partner, gradually creating the impression of a normal working relationship.

Why the small repayments made the next demand appear legit

The first transactions appeared to work. Sánchez received money back, giving her good reason to believe the platform and its promised earnings were genuine. Then came the supposedly limited-edition products carrying commissions of 30 per cent. But to receive those returns, she was required to advance the full value of each item first. Every payment was presented as another step towards releasing her money.

The scheme also used WhatsApp and Telegram groups in which apparent colleagues posted screenshots of earnings and congratulated one another. They didn’t know each other in person, but their messages made it seem as though other workers were completing the same tasks as her successfully. Sánchez said she initially transferred money because she believed in the job, and continued because she was trying to recover what she had already paid. But by the time the promised withdrawals failed to arrive, she had transferred €40,408. “I never thought I would fall for something like this. I checked everything,” she said. 

A genuine company made the fake job look extra convincing

The business whose identity had been used in the scam was real, but there is no suggestion it was involved in the alleged fraud. ReSee subsequently posted a notice on Trustpilot stating that its official operation was not connected with cryptocurrency, external recruitment services or training platforms. 

The case shows why confirming that a company exists is no longer enough to avoid being scammed. Fraudsters can copy names, logos, tax information and job descriptions. Therefore applicants should first confirm on a company’s official website whether the job offer is genuine. Or independently contact the company through the telephone number or email address on its official website and ask whether both the vacancy seen on another platform and the recruiter are authentic.

Spain’s National Cybersecurity Institute (INCIBE) has documented similar fake task-based job offers. They commonly begin with simple, well-paid work, followed by a small investment, an early repayment and progressively larger demands. INCIBE does not have evidence proving this specific type of job fraud is increasing, however, broader cybercrime has risen. The Interior Ministry’s final 2025 figures recorded 489,248 cyber offences, 5.3 per cent more than in 2024. Computer fraud accounted for 430,493 cases.

How to spot a fake employer with one simple rule

INCIBE offered one particularly useful distinction: in a legitimate job, money travels from the employer to the employee. A worker should not be required to pay to begin a shift, unlock tasks, release wages or obtain commissions. Anyone who has already transferred money should stop further payments and contact their bank immediately. INCIBE also recommends preserving conversations, screenshots and payment records, reporting the relevant accounts on the messaging platforms and filing a police complaint.

Sánchez reported her case at a police station, taking her phone, screenshots, contracts and payment details with her. She has also asked her bank to reverse the transfers, although she confirmed that she has little hope of recovering the money.

A company name, polished contract and busy workplace chat can now all be copied, but if the supposed employer asks the worker to finance their next task, you know something’s up. Spain’s 017 cybersecurity helpline is national, free and confidential. Assistance is also available through WhatsApp on 900 116 117.