Tell HN: Upwork has an impersonation problem
I had never setup an Upwork profile before so I said no, after which they responded with a link to a profile of someone that was completely impersonating me. They had scraped my LinkedIn page for information and were interviewing under the guise of being someone they were not (they were even using my picture). I talked to Upwork support, and after about 36 hours they deleted the impersonator. However, I just did another search and there is already someone else impersonating me again (this time they changed the face on the picture).
I only discovered this because the first impersonator was too lazy to change my resume they downloaded from my website and kept my real email on it, so some companies had used that email to contact me instead of their Upwork registered email.
I would recommend everyone search for their name on Upwork (I had to wrap mine in quotes to find the matches) and make sure they aren't being impersonated.
In the meantime, Upwork really needs a better validation mechanism. As engineers we really have no recourse, and there is absolutely nothing we can do to prevent this from happening.
207 comments
[ 5.1 ms ] story [ 255 ms ] threadSo, yes, your accomplishments in multiple different forms can be claimed by someone else. It can pay to be aware of this, but there's a cost to staying on top of it. Make sure to balance the two.
Side note, I cringe at that thought, I did some mturk work long time ago, had to scan people's photos on a random social network site. Tinder has this "verify" thing you stick your tongue out to the left, some worker somewhere sees it face #5753 and hits okay.
> Please know that as soon as the freelancer applies or is offered a contract, we would run an identity verification process which would have them submit a Government-issued ID and have a quick video chat or send us a selfie to prove their identity.
However, this is way too late in the process for my liking...and who knows how strict they actually are?
Need to find some way to automatically do reader mode whenever opening a Medium or Substack page.
https://mtlynch.io/upwork-scammer/
tl; dr - I caught an Upwork freelancer blatantly copying other freelancers profiles. I reported it to Upwork, who said they'd handle it but couldn't tell me the details I reached out to the freelancer's other clients to tell them the freelancer was a fraud, and they said Upwork had never notified them.
From the screenshots, I could identify other projects they worked on and other Upwork accounts they were using.
You mean...the account privacy of someone pretending to be me?
Me: "So... you're charging what is my credit card, you've verified my identity, you acknowledge this order was placed in my name, and you're happy to take my money, but you won't tell me where 'my' order was sent?"
Sears(!): "Yes, that's correct".
Called the bank... got a 'fraudulent charge' form faxed(!) to me, which I filled out and sent back same day.
Not giving the shipping address to the “customer” is just dumb. I think it’s good to protect people from abusive spouses and parents, but if someone is using their credit card and impersonating them then that’s not quite right.
I also think it’s more likely to have identity theft than to have a spouse trying to find the new address where a mattress was sent.
My theory is that the store was trying to protect their sale and was gambling that with less info the real person would not be able to cancel the order. So short sightedness.
I think the value of LinkedIn is diminishing and will continue to decline.
I don't see how that would be the case, it's the de-facto rolodex for your work-circle and I don't think I know any alternative that is getting popular.
But this goes towards the GPs post, it is public information. I also deleted my LinkedIn awhile ago. In my opinion a company or person should only be given my CV when I offer it to them.
In terms of a work-circle rolodex, this is odd to me. If I want to keep in contact with the person in the future I will have their personal contact info and keep in touch, otherwise not.
If I want to get in touch with someone I worked with ages ago, LinkedIn is still a good way, or even the only way. The value will decline if people stop adding contacts when they meet new people. Is that happening?
I hired an editor (not on Upwork) who had worked for a number of very famous authors (people you've heard of, people who've sold millions of copies). They did a fantastic sample edit, and the quality of the work dropped off precipitously by about the 20% point of the manuscript. The best-case scenario is that they just didn't care, because I'm a nobody and because of the novel's length--over 250K words, so self-publishing is the only option. However, there's a lot of forensic evidence suggesting that they farmed the edit out to more than one person (which would explain the inconsistent apparent level of skill and care). So I started looking into this, and apparently this is a common practice. Being traditionally published won't necessarily help you; the big houses contract out most of their editing work, and the same thing can happen.
Software might have the opposite problem from fiction editing, though. With editing, the issue is that the money (at all stages) is so poor--the average novel only sells a couple thousand copies--that I imagine a lot of people feel they have to do this sort of thing to survive. In software, these problems tend to involve there being far too much money at stake.
Notice, for example, you're not helping it decay, your story can't be tied to the bad actor. You have good reasons for this, but it's why the scam works.
The key correlate to understand from "Extracting value from the brand" is that when the process is complete, there is no value left in the brand. It's explicitly setting up a con, defecting from the iterated prisoner's dilemma. Lying with more words.
My favorite examples of this pattern are from other areas of endeavor: Kitchen Aid mixers, which used to be an industrial quality offshoot of Hobart and now is trash; and Singer, which used to be a superb sewing machine, and now is trash.
But you can see the pattern in many places.
I'm sorry about your experience.
But you might be interested in knowing that that phenomenon goes way back -- a lot of the "old masters" paintings were done by apprentice artists working under some level of supervision from the "named" painters. And I'm talking about really famous painters like Rembrandt or Reubens.
Also quite a few of the most prolific contemporary mass market authors have "assistants.
I told my new editor what I paid to hire the big-name editor and she said, "You could've gotten a book [as in a ghostwriter] for that."
And yeah, I'm well aware of the authors who farm out their names. If you're writing formulaic commercial work, why not? I don't begrudge their existing; I just wish they didn't take up so much marketing and publicity oxygen (but, on the other hand, if the commercial hacks weren't using that up, it'd go to overconnected MFA "literary" hacks, so... no worse for it?)
Somebody is impersonating me on dating sites and blackmailing women. They convince their victims to send nude photos, and then they threaten to send the photos to their families. The scammer (or scammers) use photos of me that used to be publicly available on social media. They also use my real name, presumably so that the victims see a legitimate LinkedIn profile when they google "me".
Years ago, I got called to a meeting with my work's Human Resources department. The victim had looked me up and emailed my company. HR told me that "I" had to stop doing this. When I realized what had happened, I knew that I couldn't do anything to make it stop. Thankfully HR didn't take any action, but the whole time I worked there I had low-level background anxiety that another victim would contact them.
Last month, a different victim messaged me on LinkedIn because she was suspicious of "my" profile on OKCupid. She sent me screenshots of the profile and messages. The scammer used obviously non-native english, so at least there's some credible evidence that it's not actually me.
I've only become aware of the two incidents above, but I'm sure there are many other victims. I emailed OKCupid to ask them to block the impersonator, but I don't know if they can even stop him from re-registering, and there are other dating sites. I no longer have recent photos publicly available, and I've locked down all social media, but I don't want to delete my LinkedIn.
What else can I do? Has anyone else had something like this happen to them?
Would you mind suggesting how to word it?
Here’s a first draft:
NOTICE: It has recently come to my attention that someone is impersonating me, by using my name and photos, to take advantage of people on some social apps. If you saw my profile on a dating app or similar service, it isn't me. I'm not on any of those platforms. Thank you and please stay safe.
edit: removed scare quotes
You probably wouldn't be able to collect from the scammer (who is likely in another country), but I guarantee you'll get OKCupid's legal department's attention, and they might be able to put a stop to it.
The lawsuit would also create a paper trail that you can use to exonerate yourself in the future.
Sadly, this is unlikely to be the sort of case an attorney would take on contingency.
I'm thinking about doing something private but formalized, like having a lawyer send a letter to OKCupid summarizing recent events and demanding they take down profiles impersonating me. I could share that letter with my (new) employer if another victim ever contacted them directly. I know it wouldn't really prove anything, but it might be convincing to HR. Last time, the HR representative didn't seem to believe me, which definitely made me feel terrible and theoretically could have affected my career.
I mean, neither does OKCupid. If they don't want to play ball, going wide (notably, with an attorney) only seems to benefit you: current and future employers see it's not actually you doing this, OKCupid risks losing the only thing they want (women that trust the app), and other women get a heads up.
Thanks to the tragedy of a common name in my country, I’ve had to petition multiple jurisdictions to procure paperwork for a very similar reason.
Only became a necessity when applying for a job and being asked, once the background check came back for someone who had not only the same name but also birthdate 700 miles away if I had been convicted of extortion and blackmail.
How that had never come up before I hit my late thirties is anyone’s guess, since the conviction was recent enough to get someone looking more closely, but not so long ago that again I’m surprised that moment was the first anyone had asked me about it after doing a background check.
Long story short, a few letters to the jurisdictions in question and $500 worth of help from a local attorney and I soon had official papers saying “No, the Bob Loblaw applying for your job is not THAT Bob Loblaw we threw the book at.”
The scam is basically to find someone with a lot of friends and copy their profile, pictures and all. Once they’ve done that, they reconnect and have an emergency that requires the friend send money. People naturally see the profile photo and name and think their friend is in real trouble.
With all of Facebook’s efforts to de-anonymize users, how is it possible that they’ve done nothing to prevent foreign scanners from blatantly copying accounts?
As others have said, you probably need to start the legal train rolling so you can subpeona OkCupid and co.
I no longer have any public photos available except on LinkedIn. I will consider taking that down.
This does come with obvious downsides.
Trying to get plenty of fish, bumble, tinder to respond was impossible.
Since there were very few photos of me publicly available online I feel I should be able to blacklist photos of me to these providers so people can’t use prepackaged profiles of me.
After he was deported, I was messaged by about 15 women in the US who were catfished by the same profile(s).
I feel there is some forum somewhere where people pass around these prepackaged profiles of people who they feel are good ‘candidates’ to impersonate.
Really disturbing
It's horrible to think that my photos are being used for this and there's nothing I can do about it. Even if I cover myself legally, people are still going to be victimized. I hope I never have to involve the police.
At best, they can make it slightly harder to impersonate a user by requiring MFA and detecting duplicate accounts (ie, accounts using the same picture). I think stuff like this will only get worse over time.
I sometimes hire from upwork. My litmus test is simple. I want to talk to you for 5-10 mins on video. If you cannot show up or have issues doing a video meeting, I won't proceed. It may help getting rid of scammers who are hiding behind a fake profile. I remember one guy telling me that he has speech issues and can only "interact" through messages/email. Even if true, I cannot trust someone on the internet like that.
As an example, I recently hired someone who showed his face on video and had great communication skills. Next time we did a call, he had no video and sounded totally different. It turned out to be a subcontractor impersonating him.
now? I've heard similar horror stories going back years. Perhaps you were lucky in that you got more positive than negative out of it earlier?
Recently I had thought that maybe prices had gone up, and I was just not paying enough for the honest, individual contractors, but even at $120+/hr, we were getting people misrepresenting their skills or trying to trick us with subcontractors.
What the fuck, man?
We had a specific project that required hardware to be shipped to the vendor, and required it to be in the US, and people would just lie, openly, as if when the time comes to ship the hardware to them I'm not going to notice it's going to China or a reshipper.
We needed a Django developer. Put an ad on Upwork at the high end of the recommended salary range. The ad specified US Eligible worker for legal reasons.
Of the 10 or so applicants, seven flat out refused to appear on webcam so I decided to talk to the eighth.
This person claim to be in Seattle. Having lived there I asked them two relatively simple questions. First, can you see the space needle from where you’re sitting? Answer: Yes.
Second, what color is the bubbly music museum next door? Obviously, this is a trick given it’s multicolored. My candidate, who did not lack bravado, guesses white.
I get that being born into particular circumstances is luck of the draw. On the other hand there’s a reason that people are willing to pay more to hire US-based workers.
I believe this has become a general societal problem. People running so called two-sided marketplaces regularly fail to take responsibility for gaming by one side. I would further argue that Upwork has even more responsibility given the monitoring of and commission they take from an ongoing relationship.
The US probably has too many regulations - in my opinion - concerning immigrant workers; however, no temp agency could get away with what Upwork is doing without facing severe repercussions.
I’d like to see Upwork punished.
Please don't take that offensively. I'm not throwing the word around. I don't mean "evil". I don't think it's "evil", I'm even jealous. Not just of money. Of the rationality.
The rest of us don't do this stuff because we'd feel horribly bad for doing it, to the point benefits would outweigh the costs.
I'd hazard a guess that most people would also say it was fine given a sufficient trolley problem set up "is it okay to take 3 jobs and not do the work I can't be held accountable towards given...I have a trust fund...versus...my kids wont have food"
You get to see your dying father for just one week as that is all the vacation time you have left and you cannot just walk away from your job due to house/kids/etc. Happened to a friend. Father had 6 months to live. He got 1 week with him in that time. Pile of cash lets you walk away. How horrible will that make you feel to not get to spend that time with him?
My employer, who I will end up leaving in a year anyway (if they do not lay me off as every company I have been with has had layoffs) as the best way to get a raise is to leave, is way, way, way, way down on the list of people it hurts to disappoint.
I would do the same as you if oprimozimg for income. But I tend to optimize for free time rather than income. So I take 4-5 months of PTO a year at one "full time" job which takes ~15 hours/week. (TC > $400k)
I have generous vacation at all jobs and at a prior job, I just quit to go on vacation after lining up another job to start in a few weeks, so booking the same time off everywhere is easy.
I am an unimportant rank and file developer.
To my point, people don't do this even though everyone knows it, and its obvious, because....:(
But you were the one who introduced the word "rationality". It implies ethical behavior is somehow irrational. I don't believe it is.
To ease your mind, let's keep the quotes and say I'm from Mars and don't share your definition of rationality, I'm using it wrong, but you want to avoid coming to a shared definition in order to have conversation without derailing:
it would be highly "irrational" to adopt this viewpoint given no code would ever be delivered if everyone adopted it. "Unstable equilibrium", in "game theory" sense. Everyone "can't" do it, but everyone "should" do it
(note airquotes again, don't want to come across as being a jerk and writing a book in response in order to be technically correct, could look patronizing since I think you understand the point)
You don't even need a good reason--just go out and do what you want, and nobody is going to stop you. It's like society hardly even functions anymore.
Because it doesn't. We aren't meant to live like we live. We're hyper-individualized, alienated, and atomized by our relations to the means of production. We're all mercenary wage slaves just trying to get enough scratch to escape the rat race for a few years before we kick the bucket. Nearly all of those that don't really have this concern (aka the already-set-for-life crowd) seem to be preternaturally greedy and devoid of empathy.
The deterioration of society under these conditions isn't exactly surprising.
Hoping to retire to either Europe or the middle of fucking nowhere within a decade.
I don't think it did. We forget that a few as 60 years ago, a person could rape a woman and she might be pressured to marry him to save face. Unless the accused rapist were black and then you would go find a tree to hang him and a couple friends from, whether or not he was guilty.
Scams are not new. Get rich schemes like crypto have been around forever. Same with scam medical treatments, fraudulent investments, abuses of power, skimming inventory, etc. Yes, we are worse on shoplifting now than we previously were, but the rest all happened before, at scale.
People have very rosy views of the past and their fellow humans. It is all a lie. It has long been the human way to ignore wrongdoing as it is too much work to fight over or pretend it does not exist.
Your problem is your lack of experience is also giving you a lack of empathy.
Also, what university was this? It doesn't sound like mine.
I am getting friends into tech firms with six figure salaries with nearly entirely manufactured resumes.
I admit that there is risk, but the payoff is also tremendous and there seem to be next to no barriers to well constructed fakery.
Aren't you only admitting it to people who can't DO anything about you, except express outrage? Why don't you tell your boss your scheme, and see if they only thing they do is "express outrage"? Your behavior is very anti-social, and your rationalizations for why it's OK are very weak.
By not having terminated me (and I survived two layoffs across the three companies, so they had a chance to do just that very easily), they do not have an issue with my current output.
~80% of people will push the limits until they see people are punished for breaking the rules.
~10% of people (often a little on the ASD spectrum) will follow the rules even if they don't really matter.
If your wallet is stolen from your locked home, it's the thief's fault. But if you leave your wallet in a crowded nightclub for an hour and it goes missing, maybe it's also your fault.
You're agreeing with him. He is making the judgement that actions such as his is a problem, and then he makes the point that there is no feedback to prevent such actions.
Namely individuals have to call out bad behavior to the point it’s regulated. Not so much in this case by the market but by government regulation to hold two sided marketplaces accountable for almost literal fraud by one party.
In this case it’s easier as more a legal question as opposed to a skill question.
I would penalize Upwork for the wage differential times three. Notice Upwork would be responsible, not the other side.
It should also be easy for the ”wronged” side of this transaction to pursue such a claim.
The non-irony here is the tremendous amount of effort, ie periodic screenshots, logs etc. that make sure Upwork gets paid.
In most big companies, unless you actually do something wrong or there is a hardcore metric they are monitoring you by, then it's very easy to do a fairly poor job and slip underneath the radar, because there are only a few things people see you doing, everyone else is too busy trying to deal with there own life and not get fired themselves.
The complete lack of consequence at the top of society can only lead to us at the bottom ignoring the rules too and frankly? There’s waaaaay more serfs with pitchforks than castles to storm.
I assume you're not religious, then? The prevailing view seems to be that the punishment for an amoral life will come when it's too late for apologies or take-backs.
If you really work in adtech, then keep up the good work (that’s a sentence I never thought I would type) :)
EDIT:(Yeah, I know it would be an obvious thing to throw out to try to turn the tide of the comments on HN :P)
As my grandmother used to say, "If you have to hide it, it's probably wrong."
"Anne Frank? Why yes, she's right upstairs..."
This is me. Can you please help? srpen6@gmail.com
Um ... surely when he showed up to work and he wasn't YOU ... there were some questions?
So I think it’s pretty common.
However, you care as a manager. What I am doing works best with managers who do not care.
How you interact with someone is just as important, if not more important, than if they can choose the correct algorithm.
The A/B studies are also used to prove discrimination that people usually won't admit to, not only to reveal unconscious bias.
On the topic of fraud prevention, the interviewer could simply ask the interviewee to be on camera for literally 5 seconds, then feel free to turn off video.
Again, this is based on an Upwork profile that already had a picture, so if discrimination was going to happen, it would be before the video interview stage anyway. This is just about a verification step, and in a platform like Upwork, refusing to be on camera for LITERALLY 5 seconds probably SHOULD be considered a big red flag.
It's also true that Upwork has many, many people who will present themselves as a single individual. Instead, they are actually an agency and you will get a rotating cast of developers. This becomes apparent the fifth time you explain the same thing to your contractor, who is actually not the person you explained it to the fourth time, or the third time, or on and on and on.
Video verification helps you ensure that you are getting what you paid for, and that your time explaining the brief and iterating on their work isn't wasted.
I've noticed in the age of remote work some people seem suprised when they first see me. I am now wondering if I am benefiting from the opposite problem of people correlating me with Asian stereotypes?
But that's not quite the same as interviewing with the webcam off.
And I now do a video chat about once a week, which isn’t particularly demanding, and it’s generally a positive experience because we work well together… but I do take an hour or two to decompress afterwards.
I think we all get not wanting to be on camera for every meeting, but surely it makes sense to present yourself on camera for the initial interview if you're able?
I've made it clear to bossmang that I don't really do customer contact. I got badly burned out in technical support decades ago, and it's still baggage I carry around, so I simply do not have a "customer service voice".
I'm hired to develop software, and I will do that to the best of my ability, but if they ever ask me to help out on the support end, I've made it clear what they can expect.
"Now listen here, you little shit..."
I went to the Space Needle three years ago and I wouldn't be able to answer that question. I wouldn't assume that someone who lives in Seattle goes through the Space Needle area on a daily basis; it's quite touristy.
This comes from someone who lives in touristy areas. Ask me what color a building is next to my statehouse (just walked by a few weeks ago,) or next to the famous place that Elvis was photographed by that I drive by almost every day, and I wouldn't be able to tell you.
[0] https://www.chihulygardenandglass.com/about/exhibition
https://www.mopop.org/
That being said, it's definitely much shorter than the Space Needle.
The EMP isn't a music museum any more, it's now the Museum of Pop Culture. I can get being confused by that one :)
I have always said no, but this is another way upwork may have an impersonation problem. Using accounts with a great track record, then selling the login information to someone else to pretend to be them. Then when you hire someone, it isn't actually them.
Having zero cost of goods sold makes it possible to undercut on prices and pay for all your acquisition and still make a buck. Doesn't seem scalable or sustainable, but it has been a real nuisance for us. Translators are contacting us for their payment...
Upwork has not been willing to help us at all. They pull the ads quickly so by the time support clicks the link, the ad is down. They act as if it didn't happen if the link doesn't still work. Crazy.
There is a lot of fraud out there. Anything you can imagine and then quite a bit you can't if you don't spend your time thinking about how to screw others.
Upwork takes a commission, so they are benefitting financially from this fraud. You absolutely have recourse.
For every good experience, we have had about four bad experiences. The Upwork marketplace is filled with accounts pretending to be in North America and using fake photos. If you start looking at the profile pics on Upwork, you'll see they have the fake teeth from thispersondoesnotexist.
We've accidentally hired some of these fake people. Not only can they code, but they are pretty good. Upwork usually freezes the contractor's account when they try to get their first payout and fail the identity verification. Then we get a request from the contractor to pay by Paypal. It's a mess.
Here's the chat response from one of the contractors when they were found out:
> OK, let me explain. > To be honest, i am based on China. > But i can complete the task really well. > But i can't work with high rate on upwork as Chinese. > I am really sorry for that. > You can confirm me through video call. > Anyway, i am really good developer in Bootstrap 4 and css3, Html5 and etc. > you can check my result.
Upwork should be doing more to fix this. They are very aware of the issue. I once emailed their old CEO about the issue and got a reply from an assistant offering an account credit.
I wish there was a good alternative!
Not sure if anyone actually responds positively to these DMs but I guess if they do it feeds into the same scam.
Turns out that someone was impersonating me on Upwork.
I now have a call with a potential real client next week.
I feel like I need to go cybersquat my identity everywhere now.