The job pays you first.

That single detail is why task scams work, and it is the part people get backwards. When a stranger’s Telegram group pays you $8 for liking three YouTube videos, the money is real, it arrives, and it is withdrawable. Nothing about that transaction is a scam yet. It is a marketing expense — the cheapest customer acquisition the fraud industry has ever built, because the next deposit is yours.

The FBI’s Internet Crime Complaint Center put a name on this in its 2024 annual report: “task scamming,” listed among the year’s emerging schemes. The lifecycle it describes is consistent. Recruitment arrives by text or messaging-app group. The first tasks are trivially easy — rating restaurants, liking videos, boosting product listings — and pay small commissions that genuinely land. Then the funnel turns: the work moves to the operation’s own crypto platform, “boosted tasks” multiply the promised return but require a deposit, and sooner or later a withdrawal is blocked over an “error,” a “tax,” or a “data mismatch” that only a further payment can fix.

This guide covers both halves of the machine. The first half takes deposits. The second half — less famous, more dangerous — offers the “worker” a promotion: a role receiving and forwarding other people’s money. That is where a task scam victim becomes part of the laundering infrastructure, sometimes without ever losing a cent on tasks.

The First Half: The Deposit Funnel

Recruitment. The invite is casual and unsolicited: a WhatsApp or Telegram group about “part-time earnings,” often added after a wrong-number friendship message or a job-board reply. The group is alive — members post earnings screenshots, thank the “teacher,” celebrate payouts. Most of those members are operators running multiple accounts, and the screenshots cost nothing to fabricate.

The easy stage. Tasks are real work in the trivial sense: like this video, rate this restaurant five stars, follow this account. Payouts are small and they arrive. This stage exists to produce one specific belief: this platform pays. Every later stage is priced against that belief.

The escalation. Basic tasks “sell out.” The platform introduces boosted tasks with multiples of the return — available only after a deposit, on the platform’s own crypto site, where you connect a wallet and fund a balance. You are now depositing your own money to keep doing a job. From the operator’s side, the economics are shaped like every exit scam before it: your deposit funds the payouts that keep the group’s belief alive, and the operator’s ledger never has to balance because withdrawals have a kill switch.

The freeze. A withdrawal request fails. Customer service — responsive for the first time in days — explains the error: your account was flagged, the task sequence was entered incorrectly, a tax must be settled, a margin deposit is required. Every variant ends the same way: pay to unlock. Victims who pay discover a new reason for the next lock. This is not a bug in the platform. It is the platform.

The deposit half of the funnel is brutal, but it has a ceiling: you can only lose what you deposit. The second half is where the ceiling comes off.

The Second Half: Your Account Becomes the Pipe

Some workers get a different promotion. The group offers a “merchant services” or “payment processing” role: the platform “needs local payment channels,” and your job is to receive incoming transfers on your bank account or payment app, convert them to crypto, and send them to a platform address, keeping a percentage commission.

Understand what this job actually is. The money arriving in your account is other victims’ money — deposits from the task funnel, or proceeds from an entirely separate fraud. Your role converts traced bank money into untraceable crypto and breaks the paper trail at the point where it is most convenient: you. The operators never touch the fiat. You are the insulation.

The FBI describes the arrangement without euphemism in its money mule warning: criminals recruit mules to launder proceeds derived from online scams, and — the sentence that ends every “I was just working” defense — “acting as a money mule is illegal and punishable, even if you aren’t aware you’re committing a crime.”

Two details make the mule role worse than the deposit role:

  • The money is provably stolen. When investigators unravel a fraud ring, the mule accounts are the visible surface. Each inbound transfer has a victim and a police report attached somewhere.
  • You handed over your identity. The role requires a real bank account, and the crypto leg typically goes through a KYC’d exchange account in your own name. The trail does not just pass through you; it is named you.

A related variant skips the task theater entirely: an “employer” or online romantic partner asks to send money through your account, or a “trading firm” hires you as a payments clerk. Same machine, different wallpaper.

What a Mule Wallet Looks Like On-Chain

The mule leg of the scheme is visible from the outside, and it is worth knowing the pattern in both directions — to check an address you’re about to interact with, and to understand what investigators and analytics firms see when they look at yours.

Paste the wallet address into any block explorer and the structure jumps out:

  • Fan-in. Dozens or hundreds of small inbound transfers from unrelated addresses — different clusters, different patterns, no common counterparty. A normal salary or trading wallet shows few, regular counterparties. A mule wallet looks like a drain grate.
  • Fast pass-through. Inflows leave within minutes. Balances don’t accumulate because the mule’s job is to forward, not hold. Watch the timing: a transfer arrives, and the same value minus commission exits toward a single consolidation address.
  • Convergence on an exchange. The pass-through ends, repeatedly, at deposit addresses for a CEX — the off-ramp where crypto becomes spendable money. Operators cycle through mules precisely because each exchange address burns out fast.
  • Inherited labels. Analytics providers and community-maintained databases tag addresses by their transaction partners. Once stolen-fund flows pass through your wallet, the wallet labels attached to it stop being about you — they become the labels of every victim and every scam cluster upstream. Risk-scoring services rate addresses exactly this way; our address risk scoring guide covers how a “high risk” designation forms and propagates.
  • Angry counterparties. Victims trace their own stolen transactions, find your address mid-chain, and file reports — against you. From the victim’s side you are the last leg they can see.

Some operators route pass-through funds through a mixer before the exchange leg. That does not launder your position — it just adds “proximity to a sanctioned mixer” to the list of things your address is now known for.

The Consequences Ladder

The unwinding, when it comes, tends to follow the same order regardless of country:

  1. Exchange freeze. The exchange’s own monitoring — or a law-enforcement request — freezes the account you used for pass-through deposits. Withdrawals locked, pending review.
  2. Bank freeze. A victim’s report or a cross-bank fraud flag lands on the receiving account. In most jurisdictions, “the funds are frozen pending investigation” can mean weeks to months, and you will be explaining inflows one by one.
  3. Named party. Somewhere in a case file, your account appears in the fund-flow chart between a victim and a cluster. “I didn’t know” determines charging decisions, not whether you appear.
  4. Criminal exposure. Where “knowing” can be argued — you ignored obvious red flags, the commission was implausibly high, the “employer” was anonymous — muling drifts from victimhood toward accomplice liability. The FBI’s warning exists because “I was unaware” is a question for a courtroom, not a shield.

Red Flags: The Task-Job Checklist

  • Any job that asks you to pay to unlock work, tiers, withdrawals, taxes, or “data corrections.”
  • Earnings screenshots in a group where everyone is celebrating constantly. Real workplaces are not that happy.
  • The platform has its own crypto site you must deposit on, connected via your wallet.
  • Withdrawal “errors” that require payment to fix. No legitimate payroll works this way.
  • A role receiving third-party money into your bank account or payment app and forwarding it as crypto, minus commission — the mule role, whatever it is called.
  • Anonymous “employers”: no company name, no contract, no verification, communication only through Telegram groups that periodically dissolve and reform.
  • Pressure to recruit friends — your social graph is inventory too.

One flag is a coincidence. Three is a pattern, and the pattern has a name.

If You Are Already Inside

The unwinding protocol, in order:

  1. Stop forwarding. Every additional transfer deepens the exposure. This is true even mid-”shift,” even with a commission pending.
  2. Freeze, don’t spend, don’t return. Leave the remaining balance untouched. Do not send it back to the “employer” — that destroys evidence and pays the operators twice. Do not pick a victim from the incoming transfers and refund them directly; you cannot refund all of them, and partial self-help complicates every case. Funds should move on the instructions of your bank, the exchange, or law enforcement — nobody else.
  3. Preserve everything. Group names and links, the platform URL, handle names, task screenshots, payment instructions, and every transaction hash in and out. Time-stamp them. This is the difference between “victim who documented” and “account holder with no story.”
  4. Report. In the US, file with IC3 — the same report pipeline that tracks task scamming. Elsewhere, your national cybercrime channel. Include the hashes; investigators can join your report to existing cases through the on-chain trail.
  5. Call your bank and exchange proactively. “I believe I received fraud proceeds through a task scam” is a survivable conversation. Having it after they freeze the account, unprompted, is a worse version of the same conversation.
  6. Distrust the follow-up. After you report or freeze, someone will DM you offering to recover your deposits or “clear” your account — for a fee. That is round two, aimed at people who have just self-identified as victims. The same rule from our fake support guide applies: anyone who contacts you first with a fix is selling the next stage of the problem.

Why It Keeps Working

The task scam is the only major fraud pattern that pays before it takes. Every other script in this archive — phishing, drainers, social engineering plays — must extract before it gives anything back. The task funnel inverts the burden of proof: the victim has already been paid, so the deposit stage feels earned rather than risky, and the mule stage feels like a promotion rather than a trap.

That inversion is also the defense. When easy money arrives before any work of value exists, the work was never the product. You were.

Frequently Asked Questions

Are crypto task scams ever real jobs?

No. The structural test is who pays whom for access to work. A real job pays you for output; a task scam asks you to deposit crypto to unlock higher-paying tasks, pay withdrawal fees, or pay a tax to release earnings. The FBI's IC3 documented this exact escalation pattern as 'task scamming' in its 2024 annual report. The small early commissions that arrive are real — they are the bait, funded by later victims' deposits.

I did a few tasks and actually got paid. Doesn't that prove it's legit?

It proves the opposite once you know the design. Early payouts are budgeted customer-acquisition cost: real money, small amounts, paid out to build trust before the deposit stage. The pattern — easy social tasks, then a crypto platform, then 'boosted tasks' that require deposits, then a frozen withdrawal — is the documented lifecycle of the scheme, not a coincidence of one unlucky platform.

My 'employer' sends money to my bank account and asks me to buy crypto and send it onward. Is that a problem?

That arrangement is money muling. The money arriving is often stolen — frequently from other scam victims — and your account is being used to convert and move it while insulating the operators. The FBI warns that acting as a money mule is illegal and punishable even if you are not aware you are committing a crime. 'I was just working a job' does not un-freeze a bank account, and it does not remove your address from an investigation.

The platform froze my withdrawal until I pay a release fee. Should I pay it?

No. The frozen withdrawal is not a glitch; it is the revenue stage of the scam. Every payment triggers a new reason for the next payment — a tax, a margin call, a 'data error'. The IC3 pattern description and every serious fraud agency describe the same loop. Money already sent is best treated through the recovery checklist: preserve evidence, report to IC3 or your local channel, and distrust anyone who DMs you offering to get it back.

I received transfers from strangers and now my exchange or bank account is frozen. What should I do?

Stop all forwarding immediately, and do not spend or 'return' the remaining balance on your own — sending it back to the scammer destroys evidence and does not clear you, and refunding one victim directly still leaves you holding every other victim's trail. Screenshot the task platform, group names, handles, instructions, and every transaction hash. Report to IC3 (or your local cybercrime channel), proactively tell your bank or exchange you believe you received fraud proceeds, and follow their instructions with the funds untouched.