Work-from-home task scams: paid to like videos on WhatsApp

If a stranger on WhatsApp or Telegram offers to pay you for liking videos, following accounts or writing reviews, it's a task scam. The first small payments are real, and they're the bait: soon you'll be asked to deposit your own money to "unlock" bigger tasks or withdraw your earnings, and that money doesn't come back. If you already paid, stop paying now, don't pay anyone who offers to recover it, and report it.

How the task scam works

1. The offer. A message from an unknown number says a "recruiter" from a marketing or talent agency has a flexible job for you. Sometimes it uses the name of a real company. The work: like videos, follow accounts, rate hotels or products, or leave reviews on maps. The pay adds up to a lot per day.
2. The first tasks pay. You like a few videos, send screenshots as proof, and receive a small transfer to your account or wallet. That money is real.
3. The group. You're moved to a Telegram or WhatsApp group with a "mentor" or "receptionist" and other "members" who post screenshots of big earnings. Many of those members are part of the scam.
4. The paid tasks. Now there are "prepaid", "welfare" or "VIP" tasks: you deposit money, often in cryptocurrency or to a personal account, and they promise it back with a large commission. The first small deposit may even pay out, to hook you.
5. The trap. Your balance on their website or app keeps growing, but to withdraw you're told to deposit more: to finish a "combo" task, fix an "error", pay a "tax" or raise your "credit score". Every payment leads to another. The balance was never real.

The US Federal Trade Commission describes the same pattern: a few dollars at first to win your trust, then deposits, usually in cryptocurrency, to unlock tasks and to withdraw earnings that don't exist.

Why the first payments are real

For the scammer, paying you a little is an investment. It proves the "job" works, gets you used to following instructions, and makes you trust the mentor. The money they pay you may itself come from other victims. When you finally deposit a larger amount, they keep it.

It's also why people keep paying: money came in once, the balance looks real, and each deposit seems to be the last one. It isn't. A real employer never asks you to pay to work or to get paid.

The warning signs

• You never applied. The offer came out of nowhere, by WhatsApp, Telegram, text message or social media.
• The pay is too high for the work: good money a day for a few minutes of likes.
• They move you from WhatsApp to Telegram, or to an app or website you'd never heard of.
• Your "earnings" live in a balance on their site, not in your bank account.
• At some point you must pay: to unlock tasks, reach a level, withdraw or fix an error. This sign alone settles it.
• They ask for payments in cryptocurrency, or transfers to personal accounts that change each time.
• They ask for photos of your ID, a selfie holding it, or your online banking details "for payroll".

How to check an offer

1. Don't reply or do the first task. That's where the funnel starts.
2. Paste the message into the scam checker. It recognizes the "easy money for likes and reviews" script. The text is read in your browser and never leaves it; only the links go to our server (api.ethorns.com) to see where they lead and how old the domain is, and results are kept for up to an hour.
3. Look at any link before opening it. If the message has a short link or points to a "work platform", paste it into the short link expander. Our server follows the redirects, so your phone never visits the page, and shows the final address and warning signs. A "company platform" on a brand-new or odd domain is a bad sign.
4. If they name a real company, ask the company. Contact it through its official website, which you look up yourself. Real companies hire through their own channels and don't pay strangers for likes.
5. Apply one rule: if any step asks you to pay, it isn't a job.

If you already paid

1. Stop paying. Whatever they say (a last fee, a tax, a frozen account, a penalty for an unfinished task), no deposit will release your balance.
2. Save the evidence, then stop talking to them. Take screenshots of the chats, the group, the website address, usernames and phone numbers, and every payment: date, amount and destination account or wallet address.
3. Call your bank or wallet using the number on your card or in the official app. Report the payments as fraud and ask whether any can be stopped. There's no guarantee, especially for transfers you made yourself or for cryptocurrency, but the sooner you ask, the better.
4. Report it. In the "scammed or hacked? what now" tool, choose "I sent money to a scammer" and your country to see the steps and the official places to report. It's a page of steps and sends nothing anywhere. Also report the numbers and groups inside WhatsApp and Telegram. The guide on where to report a scam has more detail.
5. Don't pay "recovery" agents. After a task scam, people often get messages from "lawyers", "hackers", "blockchain experts" or even fake police offering to recover the money for a fee. That's a second scam. Reporting is free.

If they have your ID or used your bank account

Some task scams go further. They ask for photos of your ID and a selfie, or ask you to receive money in your account and send it on to someone else as part of the "job". Here is what's clear:

• Moving money for others makes you a money mule. That's someone whose account is used to move money from scams or other crimes. Even if you didn't know, your account can appear in fraud cases, and your bank can freeze or close it. In many countries it can also have legal consequences.
• If you're receiving or forwarding money for them, stop now. Don't send on anything you received, and tell your bank what happened. The FBI's advice on money mules is the same: stop moving money, stop contacting them, keep records, and tell your bank and the police.
• If you sent photos of your ID, they could be used to open accounts, wallets, loans or phone lines in your name. Watch for messages from lenders or companies you don't know, and read how to find out if someone took a loan in your name. In the "what now" tool, the situation "Loans, phone lines or accounts were opened in my name" has the steps.
• If you gave your online banking password or a code, call your bank now to block access, then change the password from the official app.

Quick checklist

• I don't pay to get a job, unlock tasks or withdraw earnings.
• I checked the message and its links before replying.
• I don't send photos of my ID or banking details to chat "recruiters".
• I don't let anyone move money through my account.
• If I paid, I stopped, saved the evidence, called my bank and reported it.
• I ignore anyone who offers to recover my money for a fee.

Frequently asked questions

They paid me and I never paid them. Am I safe?

You haven't lost money, which is good. Stop now: the next step would be asking you to deposit. Don't forward any money they send you, and if transfers you weren't expecting keep arriving, tell your bank.

Are all offers to get paid for reviews scams?

Treat them as scams. Offers that arrive out of nowhere by chat and pay for likes or reviews are the typical task scam, and fake reviews break the rules of the sites where they'd be posted.

Can I get back money I sent in cryptocurrency?

Rarely. Crypto transfers are very hard to reverse. Report it anyway, and ignore anyone who promises to recover it for a fee.

They say I'll be reported to the police if I don't finish the task. Is that true?

No. It's a pressure tactic: stopping isn't a crime. Keep the messages and include them in your report.

Try it

• 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
• 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
• 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.