עברית

Mystery shopper job scam email: a fake remote job offer you never applied for

Reported as phishing

This email was reported as phishing in October 2026. It pretends to be a real employer offering paid work. It was aimed at United States and written in English.

This email was reported as phishing. It uses a made-up or generic sender to win your trust.

This email congratulates you on being hired as a remote "mystery shopper", a job you never interviewed for. It promises daily or weekly pay of $50 to $500 per task, a laptop and an "online supervisor". It says a contract and a W-9 tax form are attached, and asks you to reply "I ACCEPT". It comes from a free webmail address, not a company domain, and the company name is withheld here.

Easy work from home with high pay is tempting, especially when you are looking for a job. The best tell is that you are "hired" for a job you never interviewed for. The tax form is there to collect your personal data, and the equipment promise is the usual start of a fake-check or money-mule scheme.

What the email looks like

Dear [first name],

[Company name] is pleased to welcome you onboard. You have been approved for the position of MYSTERY SHOPPER you applied for with us. We are very excited about your potential and the commitment, honesty and dedication you can bring to the table.

As discussed during your application, you will be working at your desired location as this is a remote job position. You will report directly to your immediate Online Supervisor/Hiring Admin. Once you complete orientation, you will begin training and working in your position as a MYSTERY SHOPPER. The compensation for the job will vary from $50 - $500 (or more) depending on the task and you can decide to opt-in for daily pay or weekly pay depending on your choice. You will be provided with equipments such as laptop computer and its accessories and also be able to access the company's online portal where you will login daily to pick up available or assigned tasks.

The employment contract agreement and W-9 document has been attached to this email. You must thoroughly go through the employment contract agreement, and should you accept this offer and contract agreement, you should reply to this email directly with "I ACCEPT". [...]

Re-typed from the original with personal details removed. This is not the original email. This was a button in the original email. Here it is only a picture of the text and does nothing.

Subject line

Red flags

What to do

  1. Do not reply "I ACCEPT", do not reply at all, and do not click any link in the email.
  2. Do not open the attached contract, tax form or image, and never share your ID, tax or bank details with the sender.
  3. If you really applied somewhere, contact that company yourself through its official website, not through the email.
  4. Real employers do not ask you to buy gift cards, send money or deposit cheques for them.
  5. Mark the email as phishing or spam in your mail app, then delete it.
  6. If you already sent personal or bank details, contact your bank now. If you entered a password anywhere, change it and turn on two-step sign-in.

How to report it

In your mail app, use "Report phishing" or "Report junk" so the app learns to block similar emails. You can also forward the email to the real company's abuse or security team, using an address from its official website. If you lost money, report it to your bank and to your local police.

More scam email examples

These emails did not come from the companies or services they name. Brand names belong to their owners and are shown only to help you recognise the scam.

How we collect these examples

Each example is an email that was reported as phishing to the Mailbux security team. We publish it only after private details are removed: addresses are masked, names, tracking numbers and tokens are taken out, and links are shown as plain text that can't be clicked. We show the month an example was reported, not the exact date.

Last updated 10.11.2026 19:01 IL (10.11.2026 17:01 UTC)