Scam Warning - SpellJobs.com

Summary

Although this is a byproduct of another investigation it is worth noting this issue as soon as possible. A party who acquired personal data without consent claim to have bought this personal data from SpellJobs.com.

Investigation

This is not apparently related to a legal entity anywhere - the WHOIS information also leads to a non-existent entity. The subject of the initial investigation passed the contact details of someone at SpellJobs.com who represents himself as "David Hilton". As you can see from the screenshot of the response the persons English seems to be slightly unusual.
You'll have to open the image zoom for this one...
By tracing the email headers it was possible to gain information about the whereabouts of the senders workstation: Bahawalpur in Punjab Pakistan. This would put the sender outside of the EU data area and list of countries considered 'safe' for personal data.

The website itself appears to initially offer similar services to most but appears very basic in design - almost like it's been thrown together. A number of links don't work, the contact us page just throws an error (or perhaps veils further data capture for spamming?). It appears that anyone can search the list of candidates within the Spelljobs.com database.

A link of "Preferred Companies" on the front page takes you to Orange, SJ itself and TripIt
The front web page lists a few preferred companies but if you follow the links the companies have no details and the jobs associated bear no relationship. This appears to be a facade.

The candidate data appears to be contrived in most cases.

Reason For Concern

Due to the type of information collected in this very specific instance and having analysed copies of the data received from the SAR to the original investigation the personal data has been acquired from a jobs board here in the EU - specifically Jobsite.co.uk. No consent was ever given for this type of data re-use & transfer and this is a breach of the original jobs boards T's and C's for recruitment agency activity.

There is simply no way that this website could be deemed legitimate. The author of this post is attempting to create a TrustPilot review for SpellJobs.com which serves as a warning to others.

Comments

  1. my friend just replied to email from spelljob and he was called Gibbs. My friend clicked on the link an sent his CV. What happens now ? what can he do to prevent fraud ?

    ReplyDelete
    Replies

    1. Hi Thomas - Sorry for not replying sooner but I didn't get any notifications from the blog system.

      If I were in your friends position I would cease all contact with Spelljob - My Job Matcher confirmed them as one of the sources where peoples personal information was bought to add to the MJM candidate database. Spelljob operate outside of the strong data protection laws provided by the EU, EEA and UK.

      In future you can verify that a recruitment firm is UK or EU based - for UK you can verify the company here: https://beta.companieshouse.gov.uk/

      Also, use more reputable jobs boards which have dedicated teams to look into data protection and misuse issues - for example Monster, Jobserve and Techno Jobs.

      Unfortunately your friend has already sent his CV across there's nothing he or she can do other than to be more careful in future. However Spelljob must have got their contact information from somewhere - if you can find that source you'll know where the data was scraped from.

      Get in touch with me directly if you'd like to discuss how best to approach that.

      Delete

  2. Thanks for the warning - just received an email from them

    ReplyDelete
    Replies

    1. You're welcome. If you know which jobs board they acquired your details from I'd appreciate some more info. Welcome to DM me on Twitter or contact me privately via my Blogger profile details.

      Delete

  3. This comment has been removed by the author.

    ReplyDelete

Post a Comment

All comments and critiques are welcome.

But if you're a spammer.. I have a very particular set of skills. Skills that make me a nightmare for someone like you. If you decide not to spam post me and walk away I'll think nothing of it. But if you do spam post me, I will find you and I will shut off your internet access.

Popular posts from this blog

Scam Alert - DMR Financial

Image
Back in September I received a cold call from DMRFS, where the caller asked me about my unclaimed PPI compensation.

Having had a number of these calls I provided the caller false details in order to trigger documents in the post to me. The arrival of these documents confirmed the recipient (who the original caller avoided naming).

Background
DMRFS have been under investigation since mid 2016 by the Claims Management Regulation Service, under Regulation 35 of the CMA. This regulation relates to "complaints or suspicions of unprofessional conduct".

A small company run by Donald M Rees of Llanelli who appear to outsource their call centre operations to another firm (possibly in Cheshire).

When I received the information pack from DMRFS under the name I'd given them, I waited for a short period to separate out events a little and sent DMRFS a SAR in early September 2016. I received no bounces and no response for over two months and so, in order to remind DMRFS that their st…
Read more

[Belated] Naughty List 2016

Image
I know Santa's already been and gone this year but after last years interview successes he decided to review his options yet again this year. I've been swamped with solution design and development work since December so this article is very late.

2016 saw a marked decrease in spam from the 'major' jobs boards and some new comers then balancing that out by making up for it - Notably My Job Matcher Ltd, who still seem fine with buying your data from India data traders. More of that in the list (yes a spoiler....sorry about that).

2016 also turned up new vectors of spam and processors which are probably unsurprising to most. These new-ish vectors indicate that companies who have received subject access requests SARs from me in the past, decided to sell those details onto spammers and criminals.

Very funny. Should have seen that coming I guess, however I've started designing and writing an anti-spam solution - with help from Santa of course after he got so annoyed wit…
Read more