The Civil Guard and INCIBE (National Institute of Cybersecurity) confirm to VerificaRTVE that these are fraudulent job offers that use Spanish phone numbers on WhatsApp to scam their victims. We have investigated 15 adverts falsely promoting work by packing items such as hair bands, costume jewellery or socks from home during flexible working hours. Here's what we found out.
"Hi, would you like to have something to do in your spare time? I am currently looking for people living in Spain for a flexible job with no time restrictions," we hear in a 20-second video on TikTok showing a woman packing hair ties. This short video advert promises in the subtitle a "work from home job" with "daily salary from 400 to 570; daily pay; no age limit". At the end, the recording gives way to a form in which "more information" leads to a WhatsApp account with a Spanish phone number.
Both INCIBE and the Guardia Civil confirm to VerificaRTVE that these ads are "scams" with which cybercriminals seek to keep the victims' banking and personal data or their money. "What they do is first request a small Bizum or a small amount, but then it's not just that, because you realise. If they keep asking you for money, stop", explains Eugenia Caballero, INCIBE's Incidence and Response technician. "Normally, what they try to do is collect bank details, which is the most serious problem we are encountering," she stresses. Cybercriminals can then use this banking and personal data to make "payments through payment gateways" or for "other scams".
From the Guardia Civil, a captain of the Cyber Command in León explains to VerificaRTVE that these fake ads on TikTok can be framed in "a pyramid fraud with several people". "They always use the same hook: a short video" from which they redirect the victim of the cyber scam to a number of "WhatsApp or Telegram", says this investigator of the Civil Guard.
We have asked the social network and TikTok assures us that it has already "removed" the ads we have sent it and that it has done so for violating its Advertising Policies against scams in the workplace. The platform reminds in an email that, according to Article 39.3 of the Digital Services Act, "when an ad is illegal or violates" the social network's "terms and policies", TikTok is obliged to "remove the video and the advertiser's name" from its Ad Library.
At VerificaRTVE we have identified 15 different videos of fake job offers that follow the same pattern: they show close-up shots of people packing products from home, use colourful and unelaborate lettering that says: "We are looking for people with free time", "work from home". Some videos use voices with accents from Spain and others from Latin America. These advertisements posted on TikTok do not allow the option to save, download or share the video.
The WhatsApp profiles to which the advertisements we have investigated redirect us belong to the Business version of the app and correspond to Spanish phone numbers. They all show photos of women that are, in reality, fake. Either because they are stock images from banks such as Freepik or because they are photos made with artificial intelligence.
Profile pictures taken from Freepik that use WhatsApp accounts.
These WhatsApp profiles with fake photos of women are defined in their biographies with generic job titles such as "head of human talent", "hiring manager" or "recruitment manager". In addition, they are classified as business accounts in the "arts and entertainment" category.
The TikTok accounts we have detected posting these fake ads also use Google AI-generated profile pictures, as can be seen in the image above. Several of the WhatsApp profiles have default messages that mean that upon entering that chat the victim has the following message ready to send: "Hi I would like to know more about this part-time job".
At VerificaRTVE we recorded from our mobile phones 15 advertisements that we detected on TikTok and that, due to their configuration, the platform does not allow downloading or obtaining their web link. We analysed these videos with AI identification tools that confirm the use of synthetic voices and images.
One of the recordings shows a woman holding a pearl bracelet in her hands. A Spanish flag can be seen in the background. In the audio, the voice of a woman with a Latin American accent is heard listing the benefits of employment.
We analysed this video with Hive Moderation and the tool confirms that it is made with AI with a 99.9% probability. The recording shows visible signs of being artificially generated because of the quality and because the voice is not synchronised with the movement of the lips. The tool finds indications that the video was generated with the platform Hunyuan Video.
Hive Moderation analysis confirming the use of AI-generated speech up to 99% probability.
Another video shows a woman packing socks, but both the audio and the image are generated with artificial intelligence. The footage, played at accelerated speed, reflects graphical errors characteristic of the use of AI, such as distortion in a chest of drawers. There are also errors in the audio, such as the reference to a "daily income of 200, 500 euros". The InVID tools WeVerify and Hive confirm that the voice in the video is cloned with AI, as shown in the image below.
One of the advertisers' strategies is to impersonate well-known brands in Spain such as El Corte Inglés and Amazon. One of the videos shows the name of the department store chain, copying the use of capital letters, but uses a picture of a woman as a profile picture.
Another video impersonates Amazon by showing its logo in the photo and on the form. In this questionnaire in Spanish there are errors such as "YEC" instead of "Yes" and clicking on it leads to another form identified as being from the "Real Fábrica de Tabacos", not Amazon. Like the rest of the videos with fake job offers, the process continues with a chat connection with a WhatsApp Business number with a photo of a woman taken from Freepik.
For those who have been victims of a cyber scam such as these fake ads on TikTok, the National Institute of Cybersecurity (INCIBE) recommends to "collect and preserve all evidence" and "file a complaint with the State Security Forces and Corps", with the option of filing it telematically at the Guardia Civil's electronic headquarters.
In the case of having suffered economic damage, INCIBE advises to "submit a copy of the complaint to the bank" to proceed to claim "the return of the charges or payments made". If the financial institution does not respond in a satisfactory way for the victim, the recommendation is to file a complaint before the Bank of Spain.
The dissemination of fake advertisements promising easy money for simple tasks is in contradiction with TikTok's rules prohibiting "deceptive practices" on this social network. The Digital Services Act states that social networks must remove illegal content when they become aware of its existence.
*Keyling T. Romero is a student of the Master's Degree in International Reporting at the University of Alcalá de Henares. This article has been reviewed by Borja Díaz-Merry, editor of VerificaRTVE, and Estefanía de Antonio, head of Verification, Data Journalism and New Narratives at RTVE.
An article written by VerificaRTVE (RTVE), initially published on 4 May 2026 at 07:00 (CEST)