Scam messages and emails targeting court translators, promising huge payments

An active scam campaign is targeting court translators with the goal of stealing personal information, setting up advance-fee fraud, and potentially identity theft. We got reports from scam attempts from Macedonian translators, and we suspect the campaign uses public records of translators to craft a spear phishing attack. 

In a spear phishing attack the attacker has some prior knowledge of the target so they can craft a message and a scam that looks logical or has some relatable context. Such attacks are much more difficult to defend against, since the message content seems legitimate.

The scam summary

The scam begins through email to translators, claiming to be from "Prime Table Hub Translations". The criminals claim to have found the target's profile on a translation directory website, and asks for a translation of a 10-page World War 2 summary. If interested, the victim should respond on WhatsApp or Telegram.

The scam also references a website of the business which is so badly created that it's not even funny. We'll analyze it after the messages. 

The initial message is used to confirm that the email is correct and that someone reads it. If the target responds via WhatsApp or Telegram, the attacker automatically has a valid phone number for that target.

The followup message promises huge amount of money (1250 euro) for a 10 page translation, but puts very short deadline to imply pressure. 

Targeted data

The scammers are collecting:

• Full name and age
• WhatsApp/Phone number (valuable for future scams)
• Likely will progress to requesting banking details for "payment"

If the victim continues engagement, the scammers will likely:

1. Request a small upfront payment for "registration" or "administrative fees"
2. Ask for banking details for "payment setup"
3. Request ID documents for "verification purposes"
4. Potentially send fake contracts to appear legitimate

During our review of the scam, we learned that the Ministry of Justice of Republic of North Macedonia has a list of all registered court translators (visited on 5th of May 2025). The list is even downloadable in full. 

We can't confirm whether the scammers used this resource to create their spear phishing attack. 

We can't comment whether translator records should be public record and whether it clashes with any laws. There is an  argument that this contact list brings business to the translators, and confirms their legitimacy. But people whose contact information is in public record registries - like this translator list, lawyers bar association lists, company registries etc must be doubly careful of scams, since their information is available for attackers to target them with a plausible story. 

For anyone managing lists of public records, such lists should be limited in details and show only basic info, with a drill down only available for one record at a time and after some sort of verification/"are you human" mechanism. Never a full list or a downloadable file. 

How to Protect Yourself

• Never trust unexpected job offers - especially those that require communication on WhatsApp or Telegram
• If your information is part of a public record database, be EXTRA suspicious of any communication (whether on email, messaging or phone), because you are more exposed.
• Be suspicious of high-paying offers - if it's too good to be true, it's a lie!
• Be suspicious of extremely tight deadlines - those are designed to create pressure and force bad decisions.
• Research companies thoroughly (check business registrations, reviews, LinkedIn presence)
• Verify physical addresses and phone numbers independently
• Never pay fees to receive work
• Don't share personal documents with unverified contacts

Scam Messages and Site Analysis

Red Flags in the initial message

• Alternate email: The attacker uses some random email address instead of a corporate email, so there is plausible deniability and
• Poor grammar: duplicate words "We came across your profile on a translation directory website website"
• VERY Suspicious contact method: Directing victims to WhatsApp/Telegram instead of business email or professional platforms like LinkedIn.
• Unusual wording: "I hope you honor this prestigious Email" and "Kindly" is not normal business communication.

Red flags in the followup message

If the target decides to respond to WhatsApp/Telegram, they will get another message full of red flags: 

• Implied urgency - there is a deadline of 48 hours to complete a "translation", pressuring the target to rush into responding
• Request for unnecessary details - the message asks for the age of the target, which is useless for a translation effort. But valuable for stealing personal information and building a profile to be used later for other scams
• Weird language - Again with "Kindly"
• Useless or distracting location - the message references the person being based in Harlem, NY. Which is completely useless for an online effort, and serves only to throw the victim off once they get scammed to look for the criminals in the wrong direction
• Compensation is too good to be true - there is ad-hoc offered compensation of 1250 euro (an enormous amount of money for a translation in the days of AI automated translation). Any company really looking for translators is going to ASK for a price from the translator, not give them a huge price. 

The fake website red flags

The website referenced in the original message is a story in itself. It was imagined to reinforce the legitimacy of the scam, but it's populated with a bunch of contradicting and illogical elements, to such extent that it becomes comical. 

• Completely Inconsistent Services
  • Email claims they're a translation service, but the website footer engineering services ("Chemical Engineering Projects," "Mining Engineering Construction, Welding Engineering, Space Program XYZ")
  • The home page advertises freelancer events ("Freelancers Growth Summit 2025," "Creative Freelancers Expo")
  • The services page only says "Quality Services" and has a bunch of placeholder companies named "Logoipsum". No actual client brands or testimonials from translation clients.
• Multiple fake office locations and addresses mentioned: Lists Locations in United States, Australia, Canada and Europe in the footer, but the contact page has offices mentioned in Canada, Denver, and Malmö. And ALL these offices have the same address "75 Tower Court Kernersville, NC 27284 PO Box, 6658 Rockhild SDT 2505"!.
• More offices inconsistency - The footer has a different address for "Office in Canada" - 7300-7398 Colonial Rd, Brooklyn, NY 11209
• Placeholder text - "Lorem ipsum" text appears in the pages, left from a generic template for a web page.
• Social media links don't work - All social media icons link back to the home page of the website. This is another indicator of a generic template for a web page, before it's properly configured.
• Generic team content - Team member images look very much like AI generated or  stock photos, with generic names (Mike Rich, Jenny Smith, George Becca, Maria Jay) and vague job titles ("Freelancer System Strategist," "Tech Solutions Architect")