A single unsolicited text message offering easy work-from-home cash led one man to lose $10,000 in cryptocurrency after he deposited funds into a platform that displayed fake earnings he could never withdraw. The scheme follows a pattern that federal agencies have tracked since mid-2024: victims receive a message about simple online “optimization” tasks, see a growing balance on a fraudulent dashboard, and are told they must send crypto to unlock their supposed pay. Both the FBI and the Federal Trade Commission have issued warnings about this exact playbook, and a state-level enforcement action has now shown how the money trail runs through licensed U.S. exchanges before vanishing into wallets controlled by scammers.
How task scams turn a text into a $10,000 loss
The mechanics are consistent across dozens of reported cases. A target gets a text or call they did not request, offering remote work that involves clicking buttons or rating products. The tasks feel trivial, and a web interface shows earnings climbing in real time. Then the trap closes: the platform demands a deposit, usually in cryptocurrency, before the victim can withdraw anything. Each attempt to cash out triggers a new fee, a tax payment, or a required “upgrade.” The FBI’s complaint center described this cycle in Alert Number I-060424-PSA, noting that victims are required to make cryptocurrency payments to unlock work or earnings and that the interface showing those earnings is entirely fabricated.
The FTC published its own breakdown of the same pattern, explaining that scammers create the illusion of income through a fake earnings tally before eventually requiring victims to deposit their own money, typically in crypto, to continue. In an April 2026 consumer alert, the agency went further, warning that any unsolicited job-offer text asking recipients to reply “YES” or “INTERESTED” before requesting money is likely fraudulent. The key psychological hook is urgency: scammers tell targets that task slots are limited, bonuses expire within hours, or accounts will be “frozen” if they don’t respond immediately.
What separates this variant from older advance-fee scams is the specific payment rail. Victims are not wiring cash to an overseas account. They are buying stablecoins on regulated American platforms and then transferring those coins to addresses they do not control. That distinction matters because it creates a brief window in which the funds sit on a compliant exchange with know-your-customer records attached to both sides of the transaction. The same illusion of a growing balance keeps victims engaged long enough to move substantial amounts of money through that window.
New York’s enforcement action and the exchange trail
New York Attorney General Letitia James stopped a text-message remote-work scam that targeted vulnerable New Yorkers seeking remote job opportunities. The investigation revealed that victims were instructed to buy USDT or USDC stablecoins on Coinbase, Gemini, or Crypto.com and then transfer those tokens to unhosted wallets controlled by the scammers. The enforcement action included tracing and freezing funds that had moved through those exchanges.
The routing through licensed platforms is the detail that gives law enforcement a foothold. When a victim purchases USDT on an exchange, the platform logs the buyer’s identity, the purchase amount, and the destination wallet address. Once the stablecoin leaves the exchange for an unhosted wallet, it becomes harder to seize, but the on-chain record still exists. State attorneys general can subpoena exchange records, match wallet addresses across complaints, and request freezes before the funds are converted or moved to a second layer of wallets. That process is faster and more direct than tracing purely peer-to-peer crypto transfers, where neither party has passed through a regulated gateway.
Academic researchers have also documented how scammers reuse infrastructure at scale. A preprint paper titled “Anansi: Scalable Characterization of Message-Based Job Scams” described large-scale collection of scam messages and found that operators recycle templates, domains, and cryptocurrency wallet addresses across campaigns. The reuse of wallets is significant because it means a single freeze order tied to one victim’s complaint can potentially lock funds connected to many others. It also allows investigators to map clusters of related scams that may appear, on the surface, to be unrelated offers from different “recruiters.”
Gaps in recovery and what victims should do first
The enforcement record so far shows that tracing is possible but recovery is not guaranteed. No public case-level data from the New York Attorney General’s office or the FTC details how much money has actually been returned to individual victims of task scams. The FBI’s alert and the FTC’s consumer warnings describe the mechanics in detail but do not publish granular statistics on fund freezes or victim demographics for this specific scam type. That gap means the true scale of losses remains unclear, even as the volume of scam texts continues to grow.
The speed of the money movement is the central problem. Once stablecoins leave a regulated exchange for an unhosted wallet, the scammer can swap them, bridge them to another blockchain, or convert them through a decentralized exchange within minutes. Law enforcement freezes depend on victims reporting quickly and on exchanges responding to legal process before the funds are gone. Every hour of delay shrinks the recoverable pool. In many cases, by the time a victim realizes that the “withdrawal pending” message will never resolve, their deposits have already been split across multiple wallets or cashed out elsewhere.
For anyone who receives an unexpected text offering remote work, the FTC’s guidance is blunt: do not reply, do not click, and do not deposit money. If the message asks for crypto before paying out earnings, it is a red flag. Legitimate employers do not require job applicants to pre-fund their own paychecks or to buy digital assets to “activate” an account. Ignoring and deleting the initial text is the safest response.
For those who have already sent money, speed and documentation matter. Victims should immediately contact the exchange they used to buy or transfer cryptocurrency, provide transaction IDs, and state that they believe they are involved in a scam. At the same time, they should file reports with local law enforcement, the FBI’s online complaint portal, and the FTC. Even if individual restitution is uncertain, multiple reports tied to the same wallet address can support future enforcement actions like the one in New York.
Experts who study these scams emphasize that shame is a barrier to reporting. Many victims feel embarrassed that they believed a text promising easy money and hesitate to tell family members, banks, or police. That hesitation benefits scammers, who depend on silence to keep reusing the same wallets and scripts. Consumer advocates urge victims to treat reporting as a way to help others avoid the same trap, even if their own funds cannot be fully recovered.
The rise of task scams shows how quickly fraudsters adapt familiar tactics to new payment systems. A fake dashboard and a series of small, repetitive tasks can make the illusion of a real job feel convincing, especially to people seeking flexible income or working from home. As crypto-based payments become more common, the burden falls on platforms, regulators, and consumers alike to recognize when a “job” is really just a conduit for moving money into a scammer’s wallet. For now, the safest rule is also the simplest: if earnings only appear on a website you do not control, and you must pay to get them, they are almost certainly not real.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
