Important Announcement – Unauthorize Job Post & Potential Job Advertisement Scam

CLARIFICATION

Unfortunate incident has happened to us and potentially over 166 victims. We have previously made a police report when this incident happen in late August and it has been weeks without any calls to check on the job post. We did not expect to receive another call yesterday, it was from a person who has submitted his application to 1 of the unauthorized job post. This is the second time we received calls to verify if the vacancy is available or following up on the application status.

We feel the need to make an announcement so that everyone is aware and avoid becoming another victim. We wish to clarify that:

1. Our company name is STRONGBOX TECH SDN BHD as registered with SSM (check here). There are no such company with the name of STRONGBOX IT SDN BHD registered with SSM nor have any relation to us.
2. We only have 1 office which is located in Shah Alam/Subang. The fake company claimed we have a branch in JB, that is NOT TRUE, WE DO NOT HAVE ANY BRANCH IN JB.
3. There are no such person with the name of ANDY TAN, ANDY CHONG MON HOW in our company. He is not our director or employee. We do not know who he is.
4. This phone number 6011-62260911 IS NOT OUR OFFICIAL NUMBER (yes, you may be able to reach the scammer if you call the number).
5. Our official email is hello[at]techstrongbox[dot]com.
6. We DO NOT request* for IC (black & white / colored) for job application.
7. We DO NOT request* for bank statement for job application.
8. We DO NOT request* for utilities bills for job applications.

* Update as at 11.10.2021: 

• We are informed that the person by the name “Andy” has requested personal information that has nothing to do with job application. PLEASE DO NOT provide any document to him or communicate with him.
• We strongly advice to make police report immediately and let the police know about this post because it detailed the issues and we have made announcement about this incident.

WE DID NOT AUTHORIZED THE FOLLOWING JOB ADVERTISEMENTS

OUR COMPANY IDENTITY HAS BEEN USED BY UNAUTHORIZED PERSON/ORGANIZATION

1-2 weeks before this incident happened, we found an exact replica of our website on Google. We manage to take down the website but we feel very uncomfortable as we never encounter this kind of situation before. We are worried sick that something bad may happen.

On August 23, 2021 (around 5:32 PM), we received a phone call from a person asking whether we have a vacancy for Senior Admin Executive. To clarify, we do not have any active job post as at August 23, 2021. Because our job advertisement has ended on August 11, 2021.

Immediate we thought something is wrong and proceed to check our JobStreet account. We are shocked to find 3 active job advertisements inside our account aiming to recruit Senior Administrative Executive, Digital Marketing Executive and Customer Service Representative.

Unauthorized Job Posts – Senior Administration Executive

Unauthorized Job Posts – Digital Marketing Executive

Unauthorized Job Posts – Customer Service Representative

What we found at our JobStreet admin account

Upon checking, we are very suprised to see there is an invoice and an unknown user in our admin account.

The details in the invoice is wrong (i.e. company name – see image below). That is not our company name and you cannot find it inside the SSM database (check at MyData SSM).

JobStreet has been billing us many times over the years. We trusted the company and believe they have a well designed filtering & background check process that ensure no illegal business or fake company able to access to its candidate’s information this way. We kept wondering why they did not realize the company name is incorrect? There are no apology for what the candidates (who are the biggest victim here) and us has gone through (continue reading to see why this is important for candidates).

This person identify himself as Andy told JobStreet he is a director of the company, which is not true at all.

The email address used by Andy does not belong to us. If you notice, his name inside the account “Andy Chong Mon How” & the invoice “Andy Tan” is not consistent at all. Here is a question “Why JobStreet fail to notice that?”

We seek help from JobStreet

We seek help from JobStreet on the same day (August 23, 2021). We presented all the information we can gather and send it to JobStreet via email. The following day, we received a call from JobStreet as they want to know more details about the incident. We are told that they would do the same with “Andy” (the potential scammer). We asked JobStreet representative how can this happen and why “Andy” was given a login access to our account. It was unfortunate that all our conversation are done through the phone. What we could recall is that the JobStreet representative told us that “Andy” provided a Form 9 & told the JobStreet representative that he is a director/owner of Tech Strongbox.

We cannot believe that with only this little amount of information given and of course with payment made to JobStreet by “Andy”, JobStreet would allow “Andy” to use our account to publish these post. If you look at the 1st image we shared in this post, there were 166 candidates who submitted their application. All of them became potential victims instantly!

During our conversation over the phone, we asked whether JobStreet would allow “Andy” to set up an account on the JobStreet platform if he provide a Form 9. The answer we were given is “as long as he can provide the document”. For your information, the Form 9 and information “Andy” gave JobStreet is fake.

In all our email exchange with JobStreet, they did not admit negligence on their part and they did not apologies to us. Of course, they did try to help us obtain the phone & name (fake identity) and they did carry out their internal investigation (we don’t receive the full report). However, it is not enough to ensure this incident will not happen to any company and any person again. There is no mention or assurance given that they would improve their security or process.

Fake Form 9 – Photoshopped

We made police report

The assistance given by JobStreet through our observation are:

• Responding to our email.
• Made an attempt to contact us and “Andy” to understand the situation.
• Assist us to obtain further information from “Andy” (in the end, they provide us the same information as what we can get from the invoice).
• Remove the job advertisement from our account.
• Remove the account used by “Andy” to carry out these illegal activities (potentially more than 166 victims – everyone who submitted their resume).
• Remove the fake company profile on JobStreet platform (see image below). We are absolutely confused as to how “Andy” are able to have a profile under the name “Strongbox IT Sdn Bhd” but at the same time using our account to do the job advertisement.

We thank them for this. However, we believe they have not done enough to assist us. For example, let us know what we should do to file a complaint to relevant authority. Despite our disappointment over the lack of assistance given we made a police report as soon as we can the next day.

Why candidate must be careful

The purpose of this post is to create awareness. We do not gain from this post, in fact all these issue arises when “Andy” is able to access to our account and the damage was done. Our company’s reputation is affected.

Because of the call we received on 06.10.2021, we must make an announcement:

1. So that any person who has submitted their application is aware of this post and stop further conversation with “Andy”.
2. If any person has already contacted “Andy” and provided their photocopied IC to him, you are advised to make a police report soonest possible. We can’t imagine what “Andy” would do with their IC or the information provided to him.
3. To ensure all employer is aware of what we gone through and take caution. Understand this is not related to password information leak or our account is hacked. At this point, we do not know how many victims are out there, we only know there are at least 166 applicants (can be seen in the screen shot).
4. To ensure all recruitment platform who are serious in protecting their clients (employers & employee) can take this as a lesson to improve their SOP/processes.
5. To ensure all recruiters/head hunters is aware and be extra careful when helping your client to submit information to potential employers.

Below is an extracted email sent by a candidate to “Andy”. What we found out is that “Andy” never reply him via email. All their conversation are done on the phone or WhatsApp. Hence this may not be the first time “Andy” doing this.

Update as at December 07, 2021:

We are informed by another victim that “Andy” has been pressuring her to submit her application. She was given a form that request victims to provide many sensitive information such as height, weight, bank account number, bank name, EPF number, residential phone number, DOB, place of birth, driving license etc., we want to remind everyone who read this post that we do not request for such information from candidate. Thanks her, we are able to get a copy of the form as evidence (view here). Once again, if you feel that you have become a victim of this “Andy”, please make a police report immediately and share the link to this post to the authority.

We hope this announcement would help remind everyone to take caution and we hope all the job portals are able to improve their SOPs and do thorough background checks to prevent incident like this from happening again.

We have no intention to talk negatively about JobStreet, we thank them for doing whatever they could. Our hope is they can make an announcement soon to assure all their users that they would improve their security & SOPs. We do not want any other person/company to become another victim where “Andy” or his gang can access any company’s account by giving limited & fake information.

This is a challenging time where everyone is working so hard and focusing their energy to survive. If you are one of the victim, we encourage you to make a police report immediately. 

Lastly, what we hope JobStreet would do is:

1. Take full responsibility of this issue & mistake and the damages done to all the potential victims and damage done to our company reputation (talents may not want to submit application to us anymore).
2. Make a public announcement for 2 months at their social media posts & website so that everyone who submitted their resume can see and stop providing “Andy” any sensitive information.
3. Make a public announcement detailing how they are going to ensure their SOPs & security will be improved from this experience. We want them to protect all their clients and candidates, let us feel safe to use the platform again.

Contact us if you are a lawyer who has experience in the area of negligence.