Sheftali's Unknown

The first payout is real. That is the trick. A task scam pays you a few genuine dollars for clicking through fake "app optimization" or "product boosting" work, so that when the app later asks for a deposit to unlock the next set of tasks, it feels like an advance on money already earned. Think of that payout as the scammer's marketing budget. The deposit is the sale.

How do task scams work?

The scheme hires you for fake app work, pays small real amounts for the first easy tasks, then demands your own money, usually crypto, before the next set of tasks or your earnings unlock.

It starts with an unsolicited text or WhatsApp message about online work that names no company you could check. The "job" is tapping a button that supposedly rates products, inside a slick dashboard with a balance and a cheerful "mentor" in the chat. The FTC says paying people to rate or "like" things online is illegal, so the job itself is a red flag before any money moves.

Then the money arrives. Small, real, withdrawable. That payout turns suspicion into a story you tell yourself: they paid me, so they must be paying. The standard advice is to research the company, and I think it is out of date here. These apps borrow real brand names, the same way the safe account scam borrows your bank's real phone number, so a company that checks out tells you nothing about who is messaging you.

Partway through a set, the app says you must top up to finish it, usually in crypto. That payment rail is the giveaway. A March 2025 FTC release found people lost more to scams paid by bank transfer or cryptocurrency than to all other payment methods combined, which is also why a fake dealership website insists on a wire: scammers pick the payment you cannot claw back.

Four FTC numbers, from its December 2024 Data Spotlight and its March 2025 fraud release, show why the damage lands at the deposit stage.

Spread the half-year loss across the roughly 51,000 job-scam reports implied by the FTC's own share figures, and it comes to about $4,300 per report, counting everyone who lost nothing. That is derived arithmetic, not an FTC statistic, but it prices the deposit stage in thousands, against the handful the app paid you first.

A polished app settles nothing. What matters is which stage of the script you are in.

Why do I have to deposit money to unlock tasks?

You are asked to deposit because the deposit is the scam's only product: the tasks are fake, the balance is a number on a screen, and every early payout existed to make this one request feel safe.

Here is a one-minute check. Add up every dollar the app has actually paid into your bank, not the balance it displays, and put the deposit it wants beside that total. If the deposit is bigger, and sooner or later it must be or the scheme loses money, you are funding your own wages plus the scammer's margin. Call it the payout test. Then find your stage below and read across.

No row says "finish the set first." That urge to win back your money is the lever the next deposit pulls.

Can I get my money back?

Usually not: crypto sent to a scammer has no chargeback, so recovery depends on reporting it fast and on ignoring anyone who later offers to get it back for a fee.

Your exchange may freeze a receiving account if you tell it quickly, but nobody can promise a reversal. Report at ReportFraud.ftc.gov and the FBI's IC3 site anyway. The scheme needs you to answer at all, the same opening move as the toll text that asks you to reply Y.

The second wave is the dangerous one. Lose money once and "recovery agents" offering to trace your coins for an upfront fee start calling, running the same play twice, like the refund trap inside the renewal invoice scam. The pool keeps growing: the FTC told Congress in March 2026 that consumers reported $15.9 billion in fraud losses across 3 million reports in 2025, so anyone who paid once should expect a follow-up pitch. Here's the grey area, in my opinion: the platforms that turn a victim's cash into crypto should share that loss, and whether they ever will is an open question, probably a long one.

• A balance that grows but cannot be withdrawn without a "fee" or "tax".
• An instruction to move the chat from text to WhatsApp or Telegram.
• A recovery service that contacts you first and wants payment upfront.
• Any request to pay in crypto or through a crypto ATM.

The payout comes first because it is the cost of selling you the deposit, so the one rule that breaks the whole scheme is to never pay anyone to get paid. This week, before you open that app again, total what it has truly paid into your bank, send nothing more, and file the chat at ReportFraud.ftc.gov.

The number on your screen is the one printed on the back of your card. That does not mean your bank is calling. Caller ID is a label the caller's own system attaches to the call, and it can be set to almost any number, which is the whole trick behind the safe account scam: borrow the real number, then say the account is under attack.

How the safe account scam borrows your bank's number

The scammer sets the caller ID to your bank's real number, usually copied from the back of your card, so the display matches while the voice belongs to a stranger who wants your money moved.

The FBI's warning, as summarised by security firm Bitdefender in May 2026, lays out the sequence. After the spoofed number comes your account number and balance, pulled from breaches, phishing or malware, or from abusing automated balance-check lines. Then the claim that staff are illegally inside your account, and the offer of a fix: send the money to a "safe" account, which belongs to the criminals, by Zelle or transfer. Every step answers the question you were about to ask: is this my bank?

The FTC's June 2026 release puts business impersonators at nearly $1 billion in 2025 losses, up from $866 million in 2024, and says bank impersonators carry the highest losses among them. That makes the bank impersonation scam worth a rule of its own.

Fake auto-renewal charges that list a phone number and a fake dealership website that insists on a wire work the same way: they move you onto a channel the scammer controls.

Four figures decide how worried to be. The first two come from that FTC release: dollars lost to imposters in 2025, and how many people reported one. The third is my own division of the first by the FTC's all-fraud total of $15.9 billion (March 2026 testimony to Congress), a figure roughly a quarter above 2024, so "it won't be me" is the wrong assumption.

The call-length figure is the odd one out: the person who stayed on that long, in the report Bitdefender summarised, still caught a disguised dollar amount at the final Zelle screen, so the last confirmation is a real checkpoint. The script exists to keep you talking until your thumb is already moving.

Is a call from my bank's fraud department ever real?

Yes, banks do call about suspicious activity, but a real fraud team never needs you to transfer funds, so any caller who tells you to move money to a safe account is running the scam, whatever the display says.

The FTC says it will never demand money or tell you to transfer money, so an official who does is, by definition, not the agency.

A scammer can copy the number on screen and the balance they recite, but not the request. Judge what is asked, never who appears to be asking.

Only the last of the four stages is yours to stop, so the decision to refuse is made before the call, not during it. Stages follow the FBI sequence as relayed by Bitdefender; the zeros and the one are my count of what you control.

Will my bank refund me if I sent the money myself?

Often not: refund rules mostly cover transfers you did not authorise, and a payment you approved while deceived is usually treated as authorised, so recovery can depend on the bank's goodwill and on how fast you report it.

In the report Bitdefender summarised, a Huntington customer sent $5,000 and reportedly got nothing back because she had approved it herself, while a Chase customer's roughly $40,000 was gone by the next day. Your approval becomes the bank's argument, so call the real number first and gather proof second.

The FTC's June 2026 release counts a dozen actions and more than $70 million in redress tied to its 2024 Impersonation Rule, roughly two cents on the dollar against a single year of imposter losses. My arithmetic, and a loose one since the actions span years, but the money mostly does not come back.

My view, and it is only a view: the standard advice to stay vigilant puts the burden on the one person in the conversation who cannot verify anything. I agree with banks on "hang up and call back", not on burying it in the small print. Never act on an inbound call about money (banks do ring first sometimes, which is why you judge the request), because the display is the one thing the caller controls. The same instinct breaks the unpaid toll text scam, where the message asks you to reply Y before the link works: step out of the channel the sender chose.

• Redial from a different phone, because a line you thought you ended can stay connected to the caller.
• Ignore any number the caller offers "to verify"; use the one on your card or in your bank's app.
• Read the final confirmation screen slowly; stop if the amount or recipient is off.

This week, copy your bank's fraud line from the back of your card into your phone, and settle now that any call asking you to move money ends with you hanging up and dialling that saved number. One redial breaks the script.

Related: task scam that pays you first, then asks for a crypto deposit

Apple's iMessage quietly disarms texts from strangers: if the sender isn't in your contacts, every link stays dead until you reply or save the number. That rule explains the oddest line in an unpaid toll text, the polite request to reply Y and reopen the message. The reply looks like a confirmation. Well, it is one, just not of any toll. It's the key that switches Apple's protection off.

Why does an unpaid toll text tell you to reply Y?

It tells you to reply Y because iMessage keeps links from unknown senders switched off until you respond, and a single reply, whatever it says, turns the link on and confirms your number to the sender.

BleepingComputer laid out the mechanism in January 2025, with Apple's own explanation: links from an unknown number or email address stay disabled until you reply or add the sender to your contacts. The scam leans on habit. You already text YES to confirm a dentist appointment, so reply Y feels like routine admin. It's the one step the attacker cannot do remotely.

So I'd retire the standard advice to text STOP to spam. STOP is still a reply: it lights up the link, and as Malwarebytes noted in May 2025, every reaction tells the sender the number is in use, which raises its price as a traded data point, the raw material behind surveillance pricing built on your personal data.

A 2025 Palo Alto Networks Unit 42 report traced one smishing operation to 194,345 fully qualified domain names (full web addresses) on 136,933 root domains. Nobody can memorise a blocklist that long, so judging a link by eye was never going to protect you. Toll services were the most impersonated category, with nearly 90,000 dedicated phishing addresses. It's the pressure of the fake dealership website that insists on a wire transfer: rush you to the channel where checking feels like delay.

The amount is designed too. Malwarebytes reported in May 2025 that the DMVs of New York, Florida and California were warning about texts claiming a "small amount" in unpaid tolls. Small enough that you pay before you check. The real prize is the card number you type in.

Four numbers decide whether this deserves more than a delete, from the FTC's April 2025 tally of text-scam losses to NPR's monthly spam count via Malwarebytes and the FBI's first IC3 toll-smishing warning in April 2024.

The comparison with 2020 is the one to sit with. Reports fell while losses rose, so the people still caught are losing more each time, which fits a tiny fee that exists to harvest a card. My view, not data: Apple and the carriers could flag the reply-Y pattern itself, since no real toll agency needs a reply to make a link work. Until they do, your guard is your habit of not answering.

Real toll bill or toll text scam: how to tell them apart

A real toll bill reaches you through the account or mailed notice tied to your license plate, while the fake arrives from a stranger and only works once you reply to it.

The rows run from what you're asked to pay to what is left to do, with the genuine bill and the text side by side.

One row is our own arithmetic: the 46% is Unit 42's toll count divided by its total, and on the same numbers toll lures outnumber fake USPS ones about three to one. The complaint figure is from the FBI's IC3 notice, as covered by TechRadar in March 2025. Fail one row and you have your answer.

What happens if I clicked the toll text link and paid?

If you paid, assume everything you typed into that page now belongs to the scammer, and call your card issuer today to block the card and dispute the charge before bigger charges follow.

Then report the message at ic3.gov and delete it, as the FBI and FTC both advise. Screenshot it first: the payment page is probably offline already.

Expect a second wave, often dressed as help: a refund for a toll you never owed, the same move behind the extra-zero refund trap in renewal invoice scams.

• A text offering to refund the toll.
• A caller from your bank asking for a one-time code.
• Small unfamiliar charges on that card.
• More toll and parcel texts.

So here is the one step that breaks it, and you can take it this week: type the address of the agency that bills your plate, E-ZPass or your state's own, log in and bookmark it. Every toll text after that gets checked against the bookmark, never answered, and the reply the scam was built around never comes.