Freelance Job Scams in 2026: The Seven Patterns and the Five-Minute Check

Freelancers are a better target than job seekers: we reply fast, we onboard with strangers for a living, and our IBAN is on every invoice. Here are the seven patterns the Verbraucherzentralen and the two large freelance platforms describe for 2025 and 2026, and the check that stops most of them.

First, the misconception

The old tell was bad grammar and a strange bank story. The 2026 warning from the Verbraucherzentrale (Stand 31 August 2026) describes the opposite: a polished ad on a real platform, a real company's name, and a process that looks like ordinary compliance. The tell is what you are asked to do before a signed contract exists: prove your identity, open an account, install a tool, or pay something.

The consumer body puts it in one sentence: "Kein seriöses Unternehmen verlangt im Bewerbungsprozess, ein Bankkonto zu eröffnen oder ein Ident-Verfahren durchzuführen."

The seven patterns

1. The identity check. The contract supposedly needs a KYC step. You upload your ID, a selfie, sometimes a short video, and the criminals open accounts and sign contracts in your name. The Verbraucherzentrale's advice is absolute: "Werden Ausweiskopien, IBAN oder Selfies über WhatsApp, E-Mail oder andere Messenger angefragt, sollten diese unter keinen Umständen übermittelt werden."

2. The Video-Ident trap. You are walked through a real bank's video identification "as part of onboarding". You think you are being verified; you are opening an account the scammers control. The Verbraucherzentrale Rheinland-Pfalz warned in November 2025 that these accounts are used for money laundering and fake-shop receivables, with damage that can reach "mehrere zehntausend Euro". The person on the account is you.

3. The bank tester. A "mystery shopping" gig: open an account at bank X, document the process, hand over the login as proof of work. Same outcome as pattern two, with your active help.

4. Pay to get paid. Training fees, a starter kit, a software licence, a "background check" fee. Upwork's 2026 scam guide lists the background-check fee and the "buy supplies, we reimburse you extra" variant as standing patterns. The Rheinland-Pfalz consumer body's line: "Niemals muss man für einen Job bezahlen, um bezahlt zu werden."

5. The overpayment. The client sends more than agreed, by cheque or transfer, and asks you to refund the difference before the project starts. You refund; the original payment bounces or is reversed. Malt's help centre (June 2026) describes this as the dominant scam on its marketplace, always preceded by a request to move the conversation off the platform.

6. The task scam. Small paid tasks arrive by WhatsApp or Telegram, and small real payments follow. Then the better-paid tasks need a deposit, usually in crypto. In the US, where the FTC tracks this by name, reports of task scams rose from about 5,000 in all of 2023 to about 20,000 in the first half of 2024 alone.

7. The tool you must install. The "video call software" or "application form" is malware that reads your logins and banking data. Combined with pattern one, the criminals now hold your ID and your passwords.

Across all seven, one move recurs: the request to leave the platform or the email thread for WhatsApp or Telegram before anything is signed. The Verbraucherzentrale names the encrypted messenger as a deliberate choice. Upwork adds a detail worth keeping: its genuine staff write only from @upwork.com addresses.

What we know about the size, and what we do not

There is no German number. The BKA's cybercrime report does not break out job scams, and the consumer bodies publish patterns, not counts. In the US the picture is measured. The FTC reported $220 million in job-scam losses for the first half of 2024, against $286 million for all of 2023 and $179 million for 2022, and adds that most fraud is never reported, so "this likely reflects only a fraction of the actual harm." The Better Business Bureau, a US non-profit rather than a statistics office, counted nearly 50,000 employment-scam reports over three years, said reports doubled in 2025, and puts the median loss of a task scam at $2,300 in 2025. US figures, from one government agency and one industry body; there is nothing comparable for Germany.

The five-minute check

Do this before your first substantive reply, every time, including on platforms. 9am does not publish a trust or verification page, and no listing anywhere is a check someone did for you. Do it yourself.

1. Handelsregister. Search the company name at handelsregister.de, the free official portal for the registers of all Bundesländer. No entry for a GmbH or UG is a stop sign. An address that differs from the email signature is a second one.
2. Impressum. Every commercial website in Germany must show, under § 5 DDG (the successor of § 5 TMG since May 2024), the name and address, the legal form and representative, an email address, the register and register number, and the VAT ID if there is one. Compare each line with the register entry and with the person writing to you.
3. Domain and sender. The email must come from the company's own domain, not Gmail or Outlook. Run a WHOIS lookup: a company "founded 2009" whose domain is three weeks old is a fake. Platform practice, not law, forty seconds.
4. VAT ID. Paste the USt-IdNr from the Impressum into VIES, the EU's official validator. It tells you whether the number is valid and whether it belongs to that name and address.
5. LinkedIn. Open the company page, not the profile that wrote to you. When was it created, how many employees list it, is your contact among them? A two-month-old recruiter profile with no colleagues is pattern one in progress.
6. Payment path. On a platform, stay on it and use its escrow for the whole project; Malt's own advice is exactly that, plus a look at whether the client has completed any missions. Off-platform, agree a deposit and never refund an "overpayment". A real accounts department reverses its own mistake.
7. Contract before anything. No identity check, no software, no test account, no purchase before a signed contract with a named legal entity. If the counterpart argues, you have your answer.
8. No ID scans, ever. Not by WhatsApp, not by email, not through a link. A client needs your invoice details and at most your Steuernummer, never your passport, never a Video-Ident.

Eight steps, five minutes. If two fail, stop replying and report the listing; Upwork and Malt both have a report button, and the flagged party is not told who flagged them.

If you are already in

If you sent an ID: file a police report the same day and tell your bank; the report number is what banks and credit agencies will ask for when something opens in your name. If you completed a Video-Ident: contact that bank immediately and get the account closed in writing. If you refunded an overpayment: your bank may be able to recall a transfer if you are fast, and again the police report comes first. A client who simply does not pay is a smaller problem; our guide on what to do when a client does not pay covers the Mahnung and the Mahnbescheid, and the 2026 late-payment figures show how common the boring version is.

What to do on Monday

1. Save the eight-step check as a note and run it on your two most recent inbound leads, including the ones you already trust. Time it.
2. Add one sentence to your standard reply to new inbound requests: "Happy to talk once we have a signed contract with your legal entity; I do not complete identity checks or install software before that."
3. Move every project conversation that lives in WhatsApp back to email or the platform, with the contract attached.
4. Check where your ID currently sits: old application PDFs, cloud folders, a chat thread. Delete what does not need to exist.
5. Look at where your leads come from. Platforms are the number-one client channel for a reason, and escrow is part of it. A free 9am profile brings companies across DACH to you; the eight steps above still apply to every one of them.

This article is general information for practitioners and does not replace legal advice.