Upwork Scam: A Real Life Example

All of our reviews and recommendations are completely impartial but some posts may include affiliate links. Click here for full details.

Having written about Upwork scams before, I didn’t expect to nearly fall victim to one myself.

However, in the course of applying for a few writing roles in recent weeks, I came (virtually) “face to face” with a real life cyber criminal. It provided me with a great insight into the latest Upwork scam technique – AND I screenshotted the whole thing to share with you here!

The incident began with a seemingly innocuous job advert. However, the application I sent through was rather half-hearted, as there were already a few reasons for suspicion. I’ve marked them in the screenshot below.

Upwork Scams Job Ad

So what raised my suspicions?

  1. The client was brand new to Upwork, with an unverified payment method. Now, every client is new to Upwork at some point, and I’m not as paranoid about this as some people who actively avoid anything advertised by clients without feedback. However, it’s always best to at least be wary…
  2. A client wanting 20 freelancers right from the off? This would mean a big operation and just didn’t sound right.
  3. The payment. $80 per article isn’t at all unusual for experienced freelance writers, and may seem low to some. However is is high for an advertised starting rate on Upwork.
  4. The advert, despite being long, is completely non-specific as to what subject matter writers will be writing about.

Despite my suspicions, I spent two minutes sending an application off, if only out of curiosity. I didn’t know at the time that it would end up forming the foundation of an Upwork scams article!

It didn’t take long to receive a communication back from the client, who asked me to add his “editor” on Skype, as per the image below. Names have not been redacted to protect the guilty!

Upwork scam

I added the Skype account and soon received my first communication:

Scam Skype conversation 1

Now, the suspicions really began to mount.

First off, I was pretty sure this “Judith Cooper” wasn’t using a legit photo. I’m pretty sure the person shown is actually a celebrity.

Then, when I saw a ZIP file I became almost certain an Upwork scam was afoot.

Inside the ZIP file were two files:

Writer Guidelines file contents

The PDF file was a generic style guide, but the “Payment Terms” file (the one that potential freelancers are going to be in a hurry to open) was a .LNK file. This is a file that triggers the loading of another file, but only on Microsoft Windows. As I use a Mac, opening it would do nothing to me.

However, I decided to take a look inside the file. What I found inside had “virus” written all over it. Anyone opening this on a Windows computer would have ended up with a keylogger installed on their computer, ready to log their keystrokes and send them back to the hackers behind this scam – who could then have used them for financial gain and for hacking into online accounts.

Scam fileBy this stage, the fact a scam was in progress was no longer in doubt. I even found a link online from someone who had encountered this before and written about it.

So, all it was left for me to do was have a little fun with the scammer. Sadly this was rather short lived before I was sworn at and blocked, as you’ll see below:

End of scam Skype conversation

After this, I headed back onto Upwork, where I reported the job to the “Upwork police” as “phishing or fraud.”

Having just checked back, I’m relieved to see that the job has been closed, and the perpetrator has been booted off Upwork. However, I’ve no doubt they’ll soon be back with a different name and IP address.

Job closed

Credit is due to Upwork for reacting quickly to the complaint. However, I’d be willing to bet that the scammers hooked several people first, and that those people may be being ripped off as we speak.

After this happened, I told my wife about the scam, and she informed me she’d had exactly the same experience with an Upwork application in the past. She actually went as far as double-clicking the .LNK file. It’s only because she uses a Mac that nothing happened – otherwise she would have infected her computer.

So, the lesson here is to be very wary and suspicious if you see anything like that described above. If you’ve experienced this, let us know in the comments. You can read more about Upwork scams here.


About Author

Founder of HomeWorkingClub.com – Ben is a long-established freelancer with a passion for helping other people take control of their destiny and break away from “working for the man.” Prone to outbursts of bluntness and realism.


  1. Today they really hit rock bottom with an full-on BANK SCAM! Be Warned! Upwork is now scamming US freelancer’s banking info! They have started a new policy of requiring additional info above and beyond your current financial data to “prove” you are a US resident for a new option for clients to request only US workers. They refuse a driver’s license and want your banking info…which does NOT prove residency. So all you guys overseas, start looking for a fake address and setup a bank account I guess. It looks like a bank scam. I contacted them, went through 3 levels of support before they said they were not interested in me proving where I live, but want my bank info!

    • I’ve approved this comment for reader’s info but I’m extremely doubtful that Upwork’s identity checks are a scam! I’m a non-UK Upworker and have had no issue. The only reason to get a fake address would be to pretend you’re US-based when you’re not, which is a “scam” in itself and not something I would condone.

  2. Pingback: Bad Feedback is Bad for Business: A Study - HomeWorkingClub.com

  3. This happened to me, except the email came from John Evans. I have Windows. This is what happened:

    I became suspicious of “Judith Cooper” when she asked me to open a file that my system had flagged as malware. Unfortunately, even though I couldn’t open the “Payment Terms”, double clicking had activated the virus and my computer became infected. Red flags went off when Cooper suggested that I “disable my antivirus software” to access to file. I promptly called it out as a scam but thought I was safe because I didn’t open the file.

    Within 10 minutes, my PayPal was hacked and $100 was removed. I notified my bank and PayPal who refunded me the money. I then changed all of my passwords and ran an antivirus scan. It came back clean.

    Fortunately, I related the story to my brother who works in IT and he told me that the virus was still operating in the background of my computer. The only way to get rid of it is to clear everything and restore the computer to Factory Settings.

    I did that, reset all of my passwords and posted my story and screenshots of my Skype conversation with “Cooper” all over Facebook writing groups. I received hundreds of responses from people who had clicked on the files. I told them exactly what happened and told them what I was told for how to get rid of the virus. I also advised that they consult an IT professional independently (as I am not one).

    I found the job on ProBlogger and let them know what happened too.

    It’s important to know that even if you don’t successfully open the file, clicking on it starts the virus.

    I’m glad you called out these assholes. I’m filing a complaint with the FBI Internet Crimes Division. Fortunately for me, I have PayPal alerts and was able to catch the theft fast, and deal with it within 10 minutes. Fortunately for me, I have a brother who works in corporate IT. Others might not be so fortunate, so I’ve been doing my best to expose these disgusting trashbags for what they are.

    • Thank you for your comment, and for sharing your story. And good on you for taking it further! The thing that frustrates me most about this is that Upwork seem to be doing little to prevent them repeating the scam over and over when, as far as I can ascertain, it would be pretty easy to detect it.

      Best wishes,


Leave A Reply

Join HomeWorkingClub.com
Get genuine freelance home working opportunities delivered direct to your inbox.
We won't send spam and we promise not to share your data.