The job offer came from a real university address. The cheque did not.

The cheque is for about a thousand dollars and it is going to bounce. Maybe not that day, maybe not that week, but it will, and by then the gift cards will have been bought and the codes read out to a stranger.

Proofpoint published the chain on 28 September, tracing it to West African fraud operators. It opens with something dull: an email telling a student to verify or refresh their password, linking to a form on Google Forms, Wix, Jotform, Zoho Forms or Microsoft Office. The form collects the password along with a name, phone number and email address.

Then the stolen account goes to work. Job offers start going out from a genuine university address, remote personal assistant roles and secret shopper positions, and that address is the whole asset. The follow-up questions are the tell: do you have mobile banking, do you have access to a printer. Both are needed to photograph and deposit a forged cheque. Deposit it, keep a slice as your first week's pay, spend the rest on gift cards in hundred-dollar increments, send back the codes. When Proofpoint's researchers played along and then refused to pay, the calls and texts turned to threats, and one of the men on the line introduced himself as Agent Dozier Jr. of the FBI. The connecting addresses traced back to Nigerian mobile networks.

Nobody from the FBI will ring you about a job. No real employer sends money before you have worked, and no bank treats a deposited cheque as real on day one, whatever the balance on screen says. If a password did go into one of those forms, the account it belonged to is the small problem; every other site where the same password was reused is the large one. Tendvane's privacy and accounts check shows which accounts are signed in on the PC and whether two-step verification is actually switched on for them.