Is It Safe to Upload Your Id on Upwork
We are reader supported and may receive a committee when y'all make purchases using the links on our site.
Identity fraud on Upwork and other freelance sites threatens gig economy integrity
Remote working and gig economy platforms are increasingly popular. However, major loopholes in some sites' identity verification practices make account fraud a threat to clients and buyers using these services.
The gig economy is booming, just what happens to those workers who are locked out of remote working platforms or the virtually valuable online job markets? Increasingly, the answer is identity fraud and account ownership. The average asking price for verified freelance accounts from 1 major remote working platform, Upwork, tin can exceed $1,300. Some sellers are fifty-fifty asking tens of thousands of dollars for their accounts. Additionally, the number of posts related to Upwork account ownership and selling on one website rose over 5,300 percent in the beginning six months of 2019 versus the same time period in 2018.
Gig economy workers are withal primary targets for "work from dwelling house" scams, but the need for remote workers, combined with major loopholes in identity verification methods constitute on most remote freelance platforms, has created a brazen and openly operated marketplace for account fraud. As a effect, a large number of clients and buyers take been defrauded by freelancers abusing gig economy platforms.
What we constitute:
- There are hundreds of Upwork accounts for sale on the surface spider web, meaning buyers don't need to use night spider web marketplaces.
- The average asking price for an Upwork account is over $1,300.
- The corporeality of identity fraud on Upwork appears to be increasing yr-over-year.
- The asking cost for verified freelancer accounts can exceed tens of thousands of dollars.
- Most account buyers announced to exist trying to featherbed freelance platforms' approval processes and regional market restrictions.
- Near account buyers appear to exist from China, Russia, various African countries, India, and Pakistan.
- Some buyers, peculiarly in China and Russia, are bypassing regional content restrictions using VPNs and renting time on sellers' computers through TeamViewer and other desktop-sharing apps.
Freelance platforms and identity fraud
The increasingly expansive gig economic system covers a huge diversity of job types. From ridesharing apps like Uber and Lyft to canis familiaris-walking apps similar Wag! and Rover, anyone with a skill, involvement, or valuable resource tin can participate. And anyone willing to pay for those services tin can often notice gig workers in just a few minutes.
These platforms provide an implicit level of trust for buyers. When a client or employer seeks out gig economy workers through these websites and apps, they expect to piece of work with the individual whose contour they explored in the hiring process.
All the same, identity fraud appears to be increasing across remote gig economic system platforms. Freelancers are purchasing, renting, and using other people's accounts, or creating false profiles to trick and defraud clients who employ the platform.
As one might await, some of the largest of these gig economy sites also feel the most fraud. Many clients and buyers who use these sites merits to have been defrauded by freelancers using bought, stolen, or imitation accounts.
As one Upwork customer explained on the Reddit forum /r/Upwork:
"Yeah [it] happened to me a few times actually. One was a translator that really didn't know the language, [another] was a marketer that ended up threatening me."
The customer noted that Upwork managed to close the account before he or she reported it, merely in other cases, some clients using Upwork lost meaning amounts of coin due to identity fraud.
Some other user explained:
"Ane of my clients hired several freelancers simultaneously on a time-critical project. 1 of them was a scammer that milked the customer to the maximum allowed hours just did not deliver any noun results. That scammer afterwards copied my contour. Digging through his feedback, he had scammed a few other clients. I reported him. It took a few months, but he was eventually booted off Upwork, but non earlier he had scammed a handful of other clients."
Stories like these regularly pop up across Upwork's community forums, too as forums and articles covering other remote working sites, similar TopTal.
Identity verification methods on freelance platforms
Many gig platforms and apps require some form of in-person interaction, making identity fraud particularly difficult to pull off. Some also employ technologically-advanced techniques designed to eliminate or significantly reduce the risk of identity fraud.
Uber, for example, utilizes a system chosen Real-Time ID Check. Powered by Microsoft Cognitive Services, Real-Time ID Cheque uses facial recognition technology to verify a commuter'due south identity before the driver can log in to the app.
According to Michael C., a Baltimore-based veteran Uber driver nosotros spoke to nearly the company'southward ID verification methods, Real-Time ID Check activates randomly via the Uber app. Nevertheless, identity won't be verified if the calorie-free is besides low, the face up is non fully visible, or the face up doesn't friction match what's on record. If the driver's face does not match Uber'due south records, the driver tin be deactivated from the platform. Drivers can only go reactivated by calling Uber's driver support service and by providing additional personal information that Uber has on record for each driver.
Well-nigh remote working platforms implement various identity verification tactics to reduce the number of cases of account fraud. Thanks to the size and popularity of the site, Upwork serves as a perfect case study for this. The platform often (simply not always) requires freelancers to verify their identity by submitting a authorities-issued ID, an official payment method (such as a major credit menu or PayPal business relationship), a bank statement, a telephone number, or official documentation that verifies a proper noun and address.
The service also recently implemented an ID Verification Badge (similar to those used by Twitter and Facebook), which is earned through video calls with Upwork agents to cross-bank check the ID flick with the supposed user.
Information technology's non a perfect organization, however, and noticeably less rigorous than the system currently utilized past Uber.
Upwork support agents accept acknowledged in community forum posts that ID verification is non ever required for freelancers to perform work on the platform:
This means some freelancers tin can create accounts and work contracts with clients prior to account verification, leaving a window of opportunity for fraud to occur.
Other remote working platforms, such as Freelancer, Fiverr, PeoplePerHour, Guru, and TopTal also take identity verification methods in place:
- Fiverr : Requires a onetime upload of a authorities ID and a selfie.
- Freelancer : Requires a government ID, photo of the user holding a paper with a keycode, and copies of 2 utility statements or bank statements (or i of each). Verification must occur using a mobile device.
- PeoplePerHour : Requires a government ID, a re-create of a utility or bank statement, a photo of the credit carte associated with the account, and a copy of a verified PayPal account.
- Guru: Requires a government ID, proof of accost, and a current photo. Guru may inquire for identity verification on an ongoing footing.
- TopTal: Thorough identity verification process that includes a photo ID, social network data, possible criminal background check, family information check, and more than.
- Contently : No unique identity verification process in place. Too does not prohibit account sharing (based on the language used in the terms of service).
Those services that practice require identity verification commonly ask for it during or before long after account creation. In some cases, re-verification may occur later on a service updates or changes its verification policy. Upwork's new policy to verify freelancers using video calls required many freelancers on the platform to finer re-verify their accounts in guild to receive the new ID badge. In some cases, Upwork suspended freelancer accounts until video chat verification was completed.
Virtually remote working platforms have a policy to simply require identity verification i fourth dimension, although few openly state this as an in-writing policy. Fiverr is an exception, however, as it states on its identity verification folio that information technology only asks for account verification once.
A i-time ID verification policy ultimately makes information technology far easier for scammers to exploit remote working platforms and makes it possible for anyone to create and so sell a fully verified business relationship.
How fraudsters exploit open freelance platforms
There is now a growing market of business relationship sharing, selling, and renting, particularly for Upwork accounts. (Some account selling verifiably exists for accounts from another big remote working platform, Freelancer, but to a significantly bottom caste.)
Where are Upwork and Freelancer accounts bought and sold?
In nearly cases, illegal account selling tends to occur on nighttime spider web marketplaces. For example, anyone who wants to buy illegitimate Uber accounts can practice so for around $5 USD. In the case of Uber, most accounts sold are user accounts, not driver accounts. Fifty-fifty if users could sell their own or stolen Uber driver accounts, Uber'due south Existent-Time ID Cheque reduces the value of driver accounts.
By contrast, the selling and renting of Upwork and Freelancer accounts appears to primarily take identify on the surface web, or the meridian-level portion of the internet which most of us employ. And one of the most popular forums for this sort of activity appears to be a gaming website called PlayerUp.
In 2018, a website called UpBuy.in (also promoted as UpBuy.me) attempted to formalize Upwork account selling, but information technology appears to have been shut down presently after it started. That site too advertised itself on PlayerUp's Upwork accounts department, highlighting the much larger market of sellers and buyers that exist on PlayerUp.
Although designed every bit a resource to help video gamers buy, sell, and trade accounts, a big number of PlayerUp'southward community is instead using the service every bit a medium for freelance account identity fraud, or to buy, sell and trade social media accounts for services similar Instagram and YouTube.
At this fourth dimension of writing, there are effectually 300 current and archived posts on PlayerUp either selling or asking to buy identity-verified Upwork and Freelancer accounts. (We were unable to locate buying or selling posts for other major freelance platforms on this site, which partially highlights the bear on of a gig website's size and popularity on account selling.)
The vast majority of these freelance business relationship selling posts are for Upwork, which is where we focused our attention the almost.
Upwork account sellers tend to advertise a few key areas of their accounts to persuade potential buyers:
- Verification status
- Age of the account
- Amount of positive feedback or reviews
- Task Success Score (a mensurate Upwork uses to rate freelancers on client satisfaction)
- Business relationship location
- Full earnings
- Average earnings per month
- Number of active and billable contracts
- Number of jobs completed
- Remote control of a PC through a VPN and Teamviewer to access and operate the account
Those selling Freelancer accounts expect for similar criteria, but the number of accounts from that platform advertised for sale on PlayerUp is far smaller, so in that location is far fewer data to go on.
Sellers can also use PlayerUp to act every bit a secure middleman payment system, although some seek payment through Payoneer, some other middleman payment service, or but through PayPal. Middleman payment methods are common on dark web marketplaces and allow both parties to exchange funds while remaining completely anonymous to each other.
Outside of PlayerUp, some account buyers and freelance platform identity fraudsters use a more direct route. Some choose to contact freelancers with verified and active accounts directly through social media, such equally Facebook or LinkedIn.
As an active Upwork user, this has happened to me twice within the past several months.
In i instance, an Upwork user from Russian federation who already has a verified account attempted to contact me to get me to share my account with him, due to the nationality preferences that exist on Upwork and Upwork'south select market created but for United states of america clients and freelancers. With millions of Upwork users worldwide, many of whom are in "preferred" countries, it's likely numerous other freelancers on the platform have been contacted in this manner as well.
How much are remote freelance platform accounts worth?
There'southward a very large difference between how much remote freelancer accounts are worth and how much sellers are request. Account sellers on PlayerUp can list any request toll they want, and they can mark posts equally "Sold" once a successful transaction has taken place. Buyers can create posts seeking to purchase accounts for any amount and tin marking their posts equally "Sold" if they brand a purchase. This makes the business relationship asking price the most reliable data related to account selling.
Based on a review of over 280 PlayerUp posts (at the fourth dimension of writing), the average asking price for an Upwork account is merely over $one,330 USD. The boilerplate price of accounts marked equally "Sold," nevertheless, is around $610.
The type of services offered by the account, such every bit programming, translation, or writing, did non appear to be relevant plenty to include for nigh business relationship sellers or have much of an impact on how many potential buyers responded to a post. Scammers can buy verified accounts and and then change the account's registered skills and business organisation model, although this activeness can get an business relationship banned on Upwork.
Many Upwork business relationship sellers failed to identify where the account is registered and verified. Notwithstanding, we generally observed posts identified as being created and verified in the Us, as well equally in many European markets, including the UK.
Too little land-by-country data means we couldn't draw conclusions about the popularity of unlike account regions. Most posts received at to the lowest degree a few replies, while some posts received no replies at all. Nosotros as well institute that a number of posts received replies past many of the same user accounts, which may indicate some additional down-market place ownership and selling.
Posts can stay up for months, although most older posts are locked after an uncertain corporeality of time. However, we didn't observe that a postal service's age had much impact on the number of replies it received.
Most replies to posts happened within days of its posting. Many posts received little to no responses at all despite a insufficiently low asking toll, while others (such as the one post advertising a Macedonia-based account), received a large number of replies within just a few days.
Due to how the PlayerUp service is designed and the way black market account selling tends to piece of work, information drove across asking price was overall inconsistent. Many sellers failed to list a toll in their posts, for example, instead requesting that potential buyers brand an offer via individual bulletin (usually Skype). Some sellers also advertised that they were selling several dozen accounts in batches for the same price, meaning there'due south a potential undercount in our data related to the number of advertised accounts.
A fair corporeality of action goes toward business relationship renting equally well, an area we did not dig likewise far into due to limited data. Even so, many posts discuss renting the accounts for several hundred dollars per month, with an initial entry fee. How sellers are working out the rental payment organisation without getting defrauded themselves is difficult to determine.
Additionally, it's nearly impossible to verify account sales, making list cost the well-nigh accurate number for this type of market place. Anyone using PlayerUp can mark a mail service as "Sold," while many freelance account sales likely occur without a "Sold" marking beingness added to the post.
Who's ownership freelance platform accounts?
Buyers all over the world are likely buying freelance platform accounts, simply our review of PlayerUp posts and replies, every bit well every bit other research, appears to indicate most buyers are from simply a few regions:
- Communist china
- Russia
- Africa (diverse countries)
- Republic of india
- Pakistan
Chinese and Russian buyers announced to exist particularly interested in renting Upwork accounts, and in accessing sellers' computers via VPNs and Teamviewer or other desktop-sharing software. This post on the Upwork Customs Forums from a large-spending Upwork client appears to highlight the problem:
To note, Upwork is not banned in China or Russia. However, Upwork implements location verification methods that it does not openly advertise. It appears those methods can be bypassed through VPNs and desktop-sharing software.
Many Chinese and Russian buyers may also be using this method to play a joke on Upwork's clients via the Time Tracker app, which takes images of freelancers' desktops at regular intervals. Clients can more easily observe fraud if buyers in Red china or Russian federation use their own computers to complete hourly projects. Using remote connections to a unlike reckoner can, therefore, make fraud detection more difficult.
Account purchasing also appears to be popular in Kenya and other African countries. A 2017 article in the Kenyan online newspaper Standard Digital explored how many young Kenyans are turning to online remote working platforms to earn a living. Although the article did not specify which platforms young workers in Kenya are using, the limited number of such sites likely ways they're primarily turning to Upwork and Freelancer.
The commodity highlights a trend revealing many immature Kenyans opt to purchase accounts instead of attempting to go through the verification process. "Online writing accounts tin be acquired either through buying or opening one. Most people prefer to purchase [accounts] as the process of opening one is very rigorous and competitive," the writer wrote.
While PlayerUp was the source we located and studied, the depth of account fraud on Upwork and other gig economy websites is probable far more extensive. We take reason to believe more covert marketplaces exist, likely on the dark spider web or other private sites, with many likely hosted inside the countries where business relationship ownership is almost popular.
Consequences of remote platform identity fraud
Information technology's unclear how much of a trouble identity fraud is on remote working platforms like Upwork. We reached out to Upwork for comment on how information technology handles identity fraud simply did not receive a response by the fourth dimension of publication. However, it'southward particularly piece of cake to find Upwork's clients and buyers complaining about fake profiles and fraudulent use of accounts, stretching back several years.
In add-on, the utilize of PlayerUp as a medium for buying and selling Upwork accounts is on the rise. PlayerUp's website went alive in 2015, while the first Upwork-related post did non appear until 2016. In that location were only a small number of posts in 2017.
In 2018, there was an average of five.5 posts per month related to the buying and selling of Upwork accounts.
Only in the first six months of 2019, at that place was an average of 36 Upwork account buying and selling posts per calendar month (a total of 217 posts between January to June). By contrast, at that place were just 4 posts in the first six months of 2018, mark an increase of over 5,300 percent.
The increasing number of PlayerUp posts related to Upwork business relationship identity fraud appears to indicate a stable and growing market is firmly in identify, despite Upwork's account verification methods. This puts Upwork clients at risk and creates integrity issues for Upwork's service. It'due south also a warning sign for other open up freelance marketplaces: The more popular a service becomes, the more than it'll have to account for identity fraud in its organization.
Some post replies suggest that there are also inherent risks for buyers, who themselves could exist defrauded while trying to covertly purchase or rent accounts.
Sellers also put themselves at take a chance, specially if they plan to hire accounts. Buyers who gain access to accounts may be able to completely take over the accounts by changing passwords and other registration information, locking out the original account holder.
How Upwork and remote gig platforms tin protect buyers
Upwork's boxing against identity fraud appears to have no clear stop, at least not without a major shift in how the service verifies freelancer identities. It'southward likewise an event that existed well before oDesk and Elance merged to grade the Upwork brand in 2015. However, now that Upwork is a publicly traded company, it may face up extra scrutiny—and receive harsher consequences—if it continues to struggle to rein in business relationship fraud.
The company, as well as other gig economy platforms like Fiverr and Freelancer, may need to implement ID security measures similar to the arrangement Uber currently employs. A shift toward a more robust and regular ID verification process may anger some freelancers, while too requiring the visitor to admit to its longstanding issues with account fraud (something Upwork has been unwilling to practise publically). Information technology will likely come at an boosted cost, which Upwork will either need to incur itself or pass on to its platform'southward users.
Nevertheless, stricter identity verification methods may go a long way to creating a more trustworthy service for clients and could help preclude buyers from fleeing to Upwork's competitors.
Methodology
Nosotros gathered data from PlayerUp.com via its Upwork accounts section and its Freelancer.com accounts section. Information was collected and updated over the course of several days in July 2019. We gathered information from over 280 posts in the Upwork section and over xc posts in the Freelancer.com section, including post dates, mail service replies, location of the account to be sold, asking cost for accounts, account sell condition (sold/non sold), and the total number of posts for seeking to buy and sell accounts.
Freelancer.com posts were not properly disambiguated from a video game listed on the site, resulting in far fewer posts related to Freelancer.com sales than it initially appeared. As a consequence, nosotros left Freelancer.com out of virtually data assay and most discussions in the commodity.
Source: https://www.comparitech.com/blog/information-security/upwork-gig-economy-identity-fraud/
0 Response to "Is It Safe to Upload Your Id on Upwork"
Post a Comment