Scammer Impersonating Novo Nordisk Executive VP Jamey Millar

Imagine my surprise when, out of nowhere, the Executive VP of Novo Nordisk’s US Operations decided to reach out to me out of the blue for a great employment opportunity that’s a “role with a real, actively operating company in the technology sector!”

Never mind the fact that it’s being sent from a G-Mail address for some reason instead of a corporate account, and the picture is clearly taken from their corporate website.

Intrigued by this obvious phishing attempt, I decided to reach out and see where this goes.

Wow. They sent a pretty lengthy job description for a role in Australia. I’m surprised that whoever this person or persons are, they’re willing to put this much effort in. Or maybe it’s just AI-generated.

I couldn’t stop laughing at this part though. “It’s a real company, I swear!”

So, wanting to see more of this scam, I put together a quick CV for “Mr.Millar” consisting of information that’s already on my public LinkedIn profile plus a phone number I don’t mind them having.

Amazingly, “Mr.Millar” got back to me in just 14 minutes.

Where did I have “dense paragraphs” in that CV?

“Mr.Millar”, despite probably being a very busy man, was kind enough to review my CV. I don’t know where he saw “dense paragraphs” but maybe he mixed me up with someone else. There are also some typos in the list of certifications. For example, what’s “GICN”?

“Jamey” was even kind enough to refer me to an “Executive Document Specialist” who could help polish my CV.

This has to be some kind of bot. That reply format is something out of a texting campaign.

I honestly wonder what would’ve happened if I didn’t respond with “Yes, connect me.” Maybe I could’ve gotten the bot to malfunction. We’ll never know.

So of course I jumped at the chance to work with this CV guru and asked for his contact info.

Weird to just give me an e-mail without including his name in it. It’s almost like this is a template that can be used to loop in any individual into this surprisingly time consuming scam.

This is Akinloye Beyioku according to his Google profile. I thought this might be AI generated, but from seeing his e-mail signature in some of our later messages to each other, it seems like I found his old Facebook account.

“Self-Employed Entrepreneur” is a funny way to say criminal.

I mean, how many Akinloye Beyiokus can there be in Offa, Kwara State?

I tried to look up the Fiverr account but it’s either been banned, taken down by him, or never existed.

Apparently he went from being a “Social Medial/E-Mail/Content Marketing Freelancer” and “Crowdfunding Creator & Promoter” to a Professional Resume/CV Writer.

I won’t make a “Nigerian Scammer” joke, but it’s really tempting…..

The profile picture for that previous G-Mail address (akinloyebeyioku@gmail.com) shows something named “Israk Professional Crowdfunding.” I assume that’s the entity he did his previous work under. I tried to search for it but nothing came up.

To be fair, that’s not the worst logo I’ve ever seen.

I really hope these e-mails are someone impersonating him or a fake generated persona, because this is embarrassing.

So Mr.Beyioku got back to me in 7 minutes. Finally, we stopped beating around the bush and he told me how much money he (and whatever accomplices he might have) are trying to steal from me.

$800? Who would pay $800 for document editing?

Just for fun and to continue stringing him along, I asked Akinloye for a sample of his work. This was his response.

And he provided the following:

This is a lot of time spent for a pretty shoddy phishing attempt.

I asked for one more example, and he provided a screenshot implying he performed CV writing services for cybersecurity author and current CISO for Rezliant, Inc. Brook S.E. Schoenfield.

If you look closely, that Google profile picture “Brook” has is a picture that can easily be found on Google Images if you search his name. It’s almost like someone made a fake account.

It’s amazing how quickly you can debunk this stuff.

Eventually I decided to stop wasting time and visited the payment link (hxxps://contra.com/payment-link/T21DQOLe-ats-resume-writing). For some reason it’s paid to a different account on Contra named “Teejay UI” and the charge is for $500 instead of $800. I guess Akinloye gave me a discount.

From visiting the account’s page, it seems to be more focused on web and app design, and has a Twitter profile, LinkedIn profile, and Instagram account all tied to someone named “Victor Sofoluwe.”

This has to be a fake persona. There’s no way these accounts are for a real person and so easily tied to this scam.

Confused, I reached out to Akinloye asking why the payment was going to someone other than him. He confirmed to me that Victor is his “business partner” who handles the “payment processing and administrative side” of his operations.

Feeling like this whole thing has run its course, I stopped communicating with Akinloye and reported both his and “Jamey Millar’s” e-mails to Google as phishing content.

I also made a LinkedIn post tagging Jamey Millar and Brook Schoenfield as well as asking if any other cyber professionals have encountered this scammer.

Hopefully this burns these accounts for whoever this cyber criminal or criminals are. They’ll definitely return with some other grift in the future, but if this setback keeps a few innocent people from being robbed it was easily worth it.

HandsOnKB