Identity fraud on Upwork and other freelance sites threatens gig economy integrity

The gig economy is booming, but what happens to those workers who are locked out of remote working platforms or the most valuable online job markets? Increasingly, the answer is identity fraud and account buying. The average asking price for verified freelance accounts from one major remote working platform, Upwork, can exceed $1,300. Some sellers are even asking tens of thousands of dollars for their accounts. Additionally, the number of posts related to Upwork account buying and selling on one website rose over 5,300 percent in the first six months of 2019 versus the same time period in 2018.

Gig economy workers are still primary targets for “work from home” scams, but the demand for remote workers, combined with major loopholes in identity verification methods found on most remote freelance platforms, has created a brazen and openly operated marketplace for account fraud. As a result, a large number of clients and buyers have been defrauded by freelancers abusing gig economy platforms.

What we found:

• There are hundreds of Upwork accounts for sale on the surface web, meaning buyers don’t need to use dark web marketplaces.
• The average asking price for an Upwork account is over $1,300.
• The amount of identity fraud on Upwork appears to be increasing year-over-year.
• The asking price for verified freelancer accounts can exceed tens of thousands of dollars.
• Most account buyers appear to be trying to bypass freelance platforms’ approval processes and regional market restrictions.
• Most account buyers appear to be from China, Russia, various African countries, India, and Pakistan.
• Some buyers, particularly in China and Russia, are bypassing regional content restrictions using VPNs and renting time on sellers’ computers through TeamViewer and other desktop-sharing apps.

Freelance platforms and identity fraud

The increasingly expansive gig economy covers a huge variety of job types. From ridesharing apps like Uber and Lyft to dog-walking apps like Wag! and Rover, anyone with a skill, interest, or valuable resource can participate. And anyone willing to pay for those services can often find gig workers in just a few minutes.

These platforms provide an implicit level of trust for buyers. When a client or employer seeks out gig economy workers through these websites and apps, they expect to work with the individual whose profile they explored in the hiring process.

However, identity fraud appears to be increasing across remote gig economy platforms. Freelancers are purchasing, renting, and using other people’s accounts, or creating fake profiles to trick and defraud clients who use the platform.

As one might expect, some of the largest of these gig economy sites also experience the most fraud. Many clients and buyers who use these sites claim to have been defrauded by freelancers using bought, stolen, or fake accounts.

As one Upwork client explained on the Reddit forum /r/Upwork:

“Yeah [it] happened to me a few times actually. One was a translator that really didn’t know the language, [another] was a marketer that ended up threatening me.”

The client noted that Upwork managed to close the account before he or she reported it, but in other cases, some clients using Upwork lost significant amounts of money due to identity fraud.

Another user explained:

“One of my clients hired several freelancers simultaneously on a time-critical project. One of them was a scammer that milked the client to the maximum allowed hours but did not deliver any substantive results. That scammer later copied my profile. Digging through his feedback, he had scammed a few other clients. I reported him. It took a few months, but he was eventually booted off Upwork, but not before he had scammed a handful of other clients.”

Stories like these regularly pop up across Upwork’s community forums, as well as forums and articles covering other remote working sites, like TopTal.

Identity verification methods on freelance platforms

Many gig platforms and apps require some form of in-person interaction, making identity fraud particularly difficult to pull off. Some also employ technologically-advanced techniques designed to eliminate or significantly reduce the risk of identity fraud.

Uber, for example, utilizes a system called Real-Time ID Check. Powered by Microsoft Cognitive Services, Real-Time ID Check uses facial recognition technology to verify a driver’s identity before the driver can log in to the app.

According to Michael C., a Baltimore-based veteran Uber driver we spoke to about the company’s ID verification methods, Real-Time ID Check activates randomly via the Uber app. However, identity won’t be verified if the light is too low, the face is not fully visible, or the face doesn’t match what’s on record. If the driver’s face does not match Uber’s records, the driver can be deactivated from the platform. Drivers can only get reactivated by calling Uber’s driver support service and by providing additional personal information that Uber has on record for each driver.

Most remote working platforms implement various identity verification tactics to reduce the number of cases of account fraud. Thanks to the size and popularity of the site, Upwork serves as a perfect case study for this. The platform often (but not always) requires freelancers to verify their identity by submitting a government-issued ID, an official payment method (such as a major credit card or PayPal account), a bank statement, a telephone number, or official documentation that verifies a name and address.

The service also recently implemented an ID Verification Badge (similar to those used by Twitter and Facebook), which is earned through video calls with Upwork agents to cross-check the ID picture with the supposed user.

It’s not a perfect system, however, and noticeably less rigorous than the system currently utilized by Uber.

Upwork support agents have acknowledged in community forum posts that ID verification is not always required for freelancers to perform work on the platform:

This means some freelancers can create accounts and work contracts with clients prior to account verification, leaving a window of opportunity for fraud to occur.

Other remote working platforms, such as Freelancer, Fiverr, PeoplePerHour, Guru, and TopTal also have identity verification methods in place:

• Fiverr: Requires a one-time upload of a government ID and a selfie.
• Freelancer: Requires a government ID, photo of the user holding a paper with a keycode, and copies of two utility statements or bank statements (or one of each). Verification must occur using a mobile device.
• PeoplePerHour: Requires a government ID, a copy of a utility or bank statement, a photo of the credit card associated with the account, and a copy of a verified PayPal account.
• Guru: Requires a government ID, proof of address, and a current photo. Guru may ask for identity verification on an ongoing basis.
• TopTal: Thorough identity verification process that includes a photo ID, social network information, possible criminal background check, family information check, and more.
• Contently: No unique identity verification process in place. Also does not prohibit account sharing (based on the language used in the terms of service).

Those services that do require identity verification commonly ask for it during or shortly after account creation. In some cases, re-verification may occur after a service updates or changes its verification policy. Upwork’s new policy to verify freelancers using video calls required many freelancers on the platform to effectively re-verify their accounts in order to receive the new ID badge. In some cases, Upwork suspended freelancer accounts until video chat verification was completed.

Most remote working platforms have a policy to only require identity verification one time, although few openly state this as an in-writing policy. Fiverr is an exception, however, as it states on its identity verification page that it only asks for account verification once.

A one-time ID verification policy ultimately makes it far easier for scammers to exploit remote working platforms and makes it possible for anyone to create and then sell a fully verified account.

How fraudsters exploit open freelance platforms

There is now a growing market of account sharing, selling, and renting, especially for Upwork accounts. (Some account selling verifiably exists for accounts from another large remote working platform, Freelancer, but to a significantly lesser degree.)

Where are Upwork and Freelancer accounts bought and sold?

In most cases, illegal account selling tends to occur on dark web marketplaces. For example, anyone who wants to buy illegitimate Uber accounts can do so for around $5 USD. In the case of Uber, most accounts sold are user accounts, not driver accounts. Even if users could sell their own or stolen Uber driver accounts, Uber’s Real-Time ID Check reduces the value of driver accounts.

By contrast, the selling and renting of Upwork and Freelancer accounts appears to primarily take place on the surface web, or the top-level portion of the internet which most of us use. And one of the most popular forums for this sort of activity appears to be a gaming website called PlayerUp.

In 2018, a website called UpBuy.in (also promoted as UpBuy.me) attempted to formalize Upwork account selling, but it appears to have been shut down shortly after it started. That site also advertised itself on PlayerUp’s Upwork accounts section, highlighting the much larger market of sellers and buyers that exist on PlayerUp.

Although designed as a resource to help video gamers buy, sell, and trade accounts, a large number of PlayerUp’s community is instead using the service as a medium for freelance account identity fraud, or to buy, sell and trade social media accounts for services like Instagram and YouTube.

At this time of writing, there are around 300 current and archived posts on PlayerUp either selling or asking to purchase identity-verified Upwork and Freelancer accounts. (We were unable to locate buying or selling posts for other major freelance platforms on this site, which partially highlights the impact of a gig website’s size and popularity on account selling.) 

The vast majority of these freelance account selling posts are for Upwork, which is where we focused our attention the most.

Upwork account sellers tend to advertise a few key areas of their accounts to persuade potential buyers:

• Verification status
• Age of the account
• Amount of positive feedback or reviews
• Job Success Score (a measure Upwork uses to rate freelancers on client satisfaction)
• Account location
• Total earnings
• Average earnings per month
• Number of active and billable contracts
• Number of jobs completed
• Remote control of a PC through a VPN and Teamviewer to access and operate the account

Those selling Freelancer accounts look for similar criteria, but the number of accounts from that platform advertised for sale on PlayerUp is far smaller, so there is far fewer data to go on.

Sellers can also use PlayerUp to act as a secure middleman payment system, although some seek payment through Payoneer, another middleman payment service, or simply through PayPal. Middleman payment methods are common on dark web marketplaces and allow both parties to exchange funds while remaining completely anonymous to each other.

Outside of PlayerUp, some account buyers and freelance platform identity fraudsters use a more direct route. Some choose to contact freelancers with verified and active accounts directly through social media, such as Facebook or LinkedIn.

As an active Upwork user, this has happened to me twice within the past several months.

In one case, an Upwork user from Russia who already has a verified account attempted to contact me to get me to share my account with him, due to the nationality preferences that exist on Upwork and Upwork’s select market created just for US clients and freelancers. With millions of Upwork users worldwide, many of whom are in “preferred” countries, it’s likely numerous other freelancers on the platform have been contacted in this manner as well.

How much are remote freelance platform accounts worth?

There’s a very large difference between how much remote freelancer accounts are worth and how much sellers are asking. Account sellers on PlayerUp can list any asking price they want, and they can mark posts as “Sold” once a successful transaction has taken place. Buyers can create posts seeking to purchase accounts for any amount and can mark their posts as “Sold” if they make a purchase. This makes the account asking price the most reliable data related to account selling.

Based on a review of over 280 PlayerUp posts (at the time of writing), the average asking price for an Upwork account is just over $1,330 USD. The average price of accounts marked as “Sold,” however, is around $610.

The type of services offered by the account, such as programming, translation, or writing, did not appear to be relevant enough to include for most account sellers or have much of an impact on how many potential buyers responded to a post. Scammers can purchase verified accounts and then change the account’s registered skills and business model, although this activity can get an account banned on Upwork.

Many Upwork account sellers failed to identify where the account is registered and verified. However, we mostly observed posts identified as being created and verified in the US, as well as in many European markets, including the UK.

Too little country-by-country data means we couldn’t draw conclusions about the popularity of different account regions. Most posts received at least a few replies, while some posts received no replies at all. We also found that a number of posts received replies by many of the same user accounts, which may indicate some additional down-market buying and selling.

Posts can stay up for months, although most older posts are locked after an uncertain amount of time. However, we didn’t find that a post’s age had much impact on the number of replies it received.

Most replies to posts happened within days of its posting. Many posts received little to no responses at all despite a comparatively low asking price, while others (such as the one post advertising a Macedonia-based account), received a large number of replies within just a few days.

Due to how the PlayerUp service is designed and the way black market account selling tends to work, data collection beyond asking price was overall inconsistent. Many sellers failed to list a price in their posts, for example, instead requesting that potential buyers make an offer via private message (usually Skype). Some sellers also advertised that they were selling several dozen accounts in batches for the same price, meaning there’s a potential undercount in our data related to the number of advertised accounts.

A fair amount of activity goes toward account renting as well, an area we did not dig too far into due to limited data. However, many posts discuss renting the accounts for several hundred dollars per month, with an initial entry fee. How sellers are working out the rental payment system without getting defrauded themselves is difficult to determine.

Additionally, it’s nearly impossible to verify account sales, making list price the most accurate number for this type of market. Anyone using PlayerUp can mark a post as “Sold,” while many freelance account sales likely occur without a “Sold” marker being added to the post.

Who’s buying freelance platform accounts?

Buyers all over the world are likely buying freelance platform accounts, but our review of PlayerUp posts and replies, as well as other research, appears to indicate most buyers are from just a few regions:

• China
• Russia
• Africa (various countries)
• India
• Pakistan

Chinese and Russian buyers appear to be particularly interested in renting Upwork accounts, and in accessing sellers’ computers via VPNs and Teamviewer or other desktop-sharing software. This post on the Upwork Community Forums from a big-spending Upwork client appears to highlight the problem:

To note, Upwork is not banned in China or Russia. However, Upwork implements location verification methods that it does not openly advertise. It appears those methods can be bypassed through VPNs and desktop-sharing software.

Many Chinese and Russian buyers may also be using this method to trick Upwork’s clients via the Time Tracker app, which takes images of freelancers’ desktops at regular intervals. Clients can more easily detect fraud if buyers in China or Russia use their own computers to complete hourly projects. Using remote connections to a different computer can, therefore, make fraud detection more difficult.

Account purchasing also appears to be popular in Kenya and other African countries. A 2017 article in the Kenyan online newspaper Standard Digital explored how many young Kenyans are turning to online remote working platforms to earn a living. Although the article did not specify which platforms young workers in Kenya are using, the limited number of such sites likely means they’re primarily turning to Upwork and Freelancer.

The article highlights a trend revealing many young Kenyans opt to buy accounts instead of attempting to go through the verification process. “Online writing accounts can be acquired either through buying or opening one. Most people prefer to buy [accounts] as the process of opening one is very rigorous and competitive,” the author wrote.

While PlayerUp was the source we located and studied, the depth of account fraud on Upwork and other gig economy websites is likely far more extensive. We have reason to believe more covert marketplaces exist, likely on the dark web or other private sites, with many likely hosted within the countries where account buying is most popular.

Consequences of remote platform identity fraud

It’s unclear how much of a problem identity fraud is on remote working platforms like Upwork. We reached out to Upwork for comment on how it handles identity fraud but did not receive a response by the time of publication. However, it’s particularly easy to find Upwork’s clients and buyers complaining about fake profiles and fraudulent use of accounts, stretching back several years.

In addition, the use of PlayerUp as a medium for buying and selling Upwork accounts is on the rise. PlayerUp’s website went live in 2015, while the first Upwork-related post did not appear until 2016. There were only a small number of posts in 2017.

In 2018, there was an average of 5.5 posts per month related to the buying and selling of Upwork accounts.

But in the first six months of 2019, there was an average of 36 Upwork account buying and selling posts per month (a total of 217 posts between January to June). By contrast, there were just four posts in the first six months of 2018, marking an increase of over 5,300 percent.

The increasing number of PlayerUp posts related to Upwork account identity fraud appears to indicate a stable and growing market is firmly in place, despite Upwork’s account verification methods. This puts Upwork clients at risk and creates integrity issues for Upwork’s service. It’s also a warning sign for other open freelance marketplaces: The more popular a service becomes, the more it’ll have to account for identity fraud in its system.

Some post replies suggest that there are also inherent risks for buyers, who themselves could be defrauded while trying to covertly purchase or rent accounts.

Sellers also put themselves at risk, especially if they plan to rent accounts. Buyers who gain access to accounts may be able to completely take over the accounts by changing passwords and other registration information, locking out the original account holder.

How Upwork and remote gig platforms can protect buyers

Upwork’s battle against identity fraud appears to have no clear end, at least not without a major shift in how the service verifies freelancer identities. It’s also an issue that existed well before oDesk and Elance merged to form the Upwork brand in 2015. However, now that Upwork is a publicly traded company, it may face extra scrutiny—and receive harsher consequences—if it continues to struggle to rein in account fraud.

The company, as well as other gig economy platforms like Fiverr and Freelancer, may need to implement ID security measures similar to the system Uber currently employs. A shift toward a more robust and regular ID verification process may anger some freelancers, while also requiring the company to admit to its longstanding issues with account fraud (something Upwork has been unwilling to do publically). It will likely come at an additional cost, which Upwork will either need to incur itself or pass on to its platform’s users.

Nevertheless, stricter identity verification methods may go a long way to creating a more trustworthy service for clients and could help prevent buyers from fleeing to Upwork’s competitors.

Methodology

We gathered data from PlayerUp.com via its Upwork accounts section and its Freelancer.com accounts section. Data was collected and updated over the course of several days in July 2019. We gathered information from over 280 posts in the Upwork section and over 90 posts in the Freelancer.com section, including post dates, post replies, location of the account to be sold, asking price for accounts, account sell status (sold/not sold), and the total number of posts for seeking to buy and sell accounts.

Freelancer.com posts were not properly disambiguated from a video game listed on the site, resulting in far fewer posts related to Freelancer.com sales than it initially appeared. As a result, we left Freelancer.com out of most data analysis and most discussions in the article.