Freelancer theft of client's property and non-shipment (US client, India freelancer)

Question

I posted a basic hacking investigation job on Upwork and one of the people who applied seemed to be an excellent candidate. His cover letter informed me that he was USA licensed and certified, had been involved in the arrest of several high-profile hackers and had worked for the US department of defense and other agencies. I hired him and mailed my phone to him for investigation. He turned out to be located in a place called Gurugram Haryana India. Through email he confirmed receiving my phone, conducting his investigation and finding proof and IPs but now he will not ship anything (my phone, the new modded phone he upsold me and the hacking report) and will not respond to my messages via the site or my emails. I've reported him to the website and they're working on it but what else can I do? I'd rather have my phones and proof and etc. than perhaps an Upwork credit. I have his real name, bank details, home/office address and two email addresses plus all communication and receipts when applicable.

Answer 1

It's likely that you've been scammed by someone who simply created the details in order to fleece you out of a relatively expensive phone and any data on it that has additional value (e.g. network passwords, emails, texts, etc). They may have also hoped to get the phone working again and spoof the people in the address book by asking them for remote access to systems, passwords and to send money.

---

There were a number of potential red flags here that you should have been warned by (but apparently weren't).

• "His cover letter informed me that he was USA licensed and certified"
  Although there are many ethical hacking certifications, most if not all are offered by international/global organisations, rather than nationally-based companies.

• "had been involved in the arrest of several high-profile hackers"
  Individual white hat freelancers are rarely involved in 'high-profile' hacking investigations. Those tend to be left to the authorities (who have their own investigators) or very expensive companies. This sort of boasting is common from scammers, though.

• "had worked for the US department of defense and other agencies"
  The US Dept of Defence rarely (if ever) hire single IT freelancers to do work for them and they pretty much never hire contractors who aren't US Nationals.

• "He turned out to be located in a place called Gurugram Haryana India."
  In combination with the above, this should have been a huge red flag. He's name-dropped some weighty American organisations to get you sucked in, but then he turns out to live in India.

• "Through email he confirmed receiving my phone, conducting his investigation and finding proof and IPs"
  At this point in the "investigation" he was probably trying to rinse the phone for any useful info to steal.

• "now he will not ship anything (my phone, the new modded phone he upsold me and the hacking report)"
  No report exists and apparently he got some extra money out of you (as well as a free phone).

---

"What else can I do?"
Recognising that you've probably been scammed, you need to report your problem to your company's IT Officer and ensure that you do appropriate damage control by removing any access that that phone has to servers, accounts and systems as well as re-securing all of those with fresh passwords and checking intrusion logs (he might still be in there right now!).

You also need to change your bank details and report him to the police as well as contacting UpWork and asking them to refund at least your payments through their system.

Answer 2

Sadly, you have nothing - no information of the true scammer, no money, and no phone.

Unfortunately, all the information above can be created on a whim, or passed through multiple gullible victims to hide the true source.

Your best bet at this point is to cut your losses, and move on. Sorry to be the bearer of bad news.

Answer 3

Sites like these act as intermediates, try solving amicably with upwork and if they can't solve or deny responsibility, sue them for damages. It's just like amazon or ebay. They are getting a cut of every payment, so they are to blame.

Don't settle for a credit, you should have your phones and whatever the proofs you asked for would grant you. I'm assuming you were already trying to find evidence to sue someone, if you can't because of someone that upwork vetted, then they are to blame and they owe you whatever you were getting from the evidence the said hacker uncovered.

And mainly, keep an eye out when dealing with India, Brazil, China and Russia. Scammer nests.