Fake shopper scam recruits money mules

One of the few criminal requirements that transcends time and the physical/cyber realm is the need for money mules, or a person who transfers money acquired illegally on the behalf of others.

In the physical criminal world, the mule is paid for their service of either using a courier service or hand delivering money obtained through various methods of crime.

In the cyber world, the mule might transfer the money without ever knowing they are committing a crime.

Hacker and money

In a blog posted today titled “Fuel for the Mule: Fake Secret Shopper Site a Dangerous Proposition” by Chris Boyd, aka @paperghost, on the ThreatTrack Security blog; Boyd talks about a Bolivian website that was hacked and now hosts a money mule scam disguised as a Walmart Secret Shopper Page.

The scam instructs potential victims to sign up and to receive a check in the mail they can cash.

After that, they need to visit any Walmart store with a western-union kiosk in it.  They are allowed to keep $100 to spend at Walmart and keep the money and then use the remaining cash to test a potential “transfer” lapse that has been detected with Western Union.

The transfer is to be made to an agent that will check to see if the money is being “received” correctly. In reality, the victim who completes this task has just acted as a money mule for cyber-criminals.

Boyd goes into more information about the possible retribution one might face from law enforcement for falling for this trick and I wanted to make sure that our readers knew about it too.  If you need evidence about which Secret Shopper ad is legitimate and which is not, you can simply see Walmart’s stance on the Secret or “Mystery Shopper” program, which is they don’t have one.

Whether it be work-from-home scams, Nigerian princes, free PlayStations or secret shopper programs, all scams online are too good to be true and it’s better to do some deep research (i.e. Google) before committing to sending in money, personal information or agreeing to complete tasks for cyber-criminals.

By not doing so, you open yourself up to having your identity and/or money stolen as well as possible charges put against you.

Thanks for reading and safe surfing!


Adam Kujawa

Director of Malwarebytes Labs

Over 14 years of experience fighting malware on the front lines and behind the scenes. Frequently anachronistic.