**EE KB - NDF Information Guide

*Note* Much of this information comes directly from Payment Risk and should not be shared, either internally or otherwise

What Is NDF or ‘Non Delivery Fraud’

The main goal of NDF groups using Upwork is to earn as much money as possible, as quickly as possible. They do this via targeting higher paying job categories, higher rates, and attaining attractive and verified profiles so that they can then appeal to higher paying clients.

Typical NDF Behaviours:

• Hacking client accounts
• Blackmailing clients
• Build account job feedback through begging and/or bribery
• Sharing accounts with each other
• Leasing accounts from other Upwork freelancers
• Purchasing accounts from other Upwork freelancers
• Purchasing identity verification (webcam, ID docs) from others

Structure: Factions

• NDF are divided into groups and given quotas for how much they are supposed to earn
• Groups don’t necessarily communicate, but may share some learnings / best practices

Although there is clearly some degree of information / technique sharing amongst disparate groups of NDF users, they are separate entities that do not overlap in terms of membership as far as we can tell.

We see one group of NDFs operate in a particular way, and then you’ll see what seems to be another group of people sharing similar behavioural patterns. For example, one group of NDFs were wearing wigs for webcam verifications, and an entirely unconnected group shortly afterwards started doing the same, though they did not share members on Upwork.

Another group may have had some success using a specific email domain (Yandex, for example), and then we started seeing different groups doing the same - Though again, they appeared to be otherwise unconnected.

Structure: International Presence

NDF Respond & Change as Upwork Detects them

The first is the typical, original ‘Chinese Freelancer’ or agency. These users will typically initially deliver great work, and then start overbilling, and soon after stop delivering work to their clients. They will often retaliate against the client when confronted. This is not as common any more, but they do exist and we see them from time to time.

Then the second is the ‘Location Liar’ persona, more common currently, where often the user is often Chinese, but pretending to be an Eastern European freelancer. They do this because they are able to charge a higher rate than they would if they were telling the truth about being in China/India/Bangladesh etc. They typically start as a good freelancer, but will then likely stop delivering like Persona #1, or continue to work depending on client wealth/spend rate.

The third is the ‘Client’ persona, primarily used to hire other NDF users and build feedback, in order to appear more attractive to other clients. They are also used to check on other freelancer accounts, and train new NDF recruits on how to apply to jobs successfully.

The fourth persona we see is the ‘Paid/Secondhand/Piggyback’ user. As NDF has evolved, it has started engaging in more complex methods of evasion, and these are the most difficult for us to identify, as well as the most dangerous.

Sub Type A: Paid Freelancer 

The point of these accounts is evading our identity verification process. 

Secondhand Account Persona:

These will be an existing freelancer account, possibly with some jobs or earnings already, but they are approached by NDF either before or after the verification process. 

Once the account has been sold, it will then be taken over by the purchaser, a member of one of the NDF groups. Below is an example of the type of approach NDF groups are taking:

Piggyback Account Persona:

These can involve either a new or existing account, and we use the term ‘piggyback’ because the NDF and the original non-NDF freelancer will operate out of the same account, sharing it. Here we’ll often see different disbursement methods, and two different IPs logging into the account. 

Below is an example of what we often see from NDF users approaching other users to establish this type of account:

The table below details the key differences between the three leased account subtypes:

Scam / Spam Accounts:

These accounts are often detected as false positives for NDF accounts, but actually operate rather differently:

Limited Admissions / Other Non NDF

Users attempting to circumvent Limited Admissions are another group of freelancers that can appear to fit the NDF profile, but are generally not. Limited Admission ‘Gamers’, for example, do buy and sell accounts in order to evade Limited Admissions based on poor quality profiles, but are largely just people wanting to get on the platform to do genuine work rather than commit fraud.

Web Presence

Some of the Persona types detailed above (particularly the sold accounts) are real people, and so when looking for details about them online we will often find legitimate information. This has led to escalations in the past from EE to Payment Risk, assuming that there was a potential false positive, where the suspension was actually valid.

There are a number of cases when an NDF related issue might reaches EE, though the three most common of these are:

• False Positives - Users that Payment Risk has suspended for having NDF associations in error. 

• Client Unhappy With Suspension - Clients who do not believe the FL they have been working with has done anything wrong and are upset their contract has been disrupted

• Client Unhappy with Upwork - For allowing them to be defrauded and losing money/time on a contract with a fraudster.

In the first two cases in particular, we should do as much research and investigation as possible into the validity of the suspension on Payment Risk’s part, using the information presented in the first part of this document, as well as the additional Payment Risk centric details below.

Research Tools

There are some useful tools, most of which are also used by Payment Risk, that can help us make a determination about whether a freelancer is NDF:

• IP Quality Score - This site lets us check the ‘quality’ of an IP address (how likely it is to be fraudulent), and provides a host of other useful information (see below):

• iOvation - Searching by user ID in iOvation will give us a list of accounts and devices associated with that ID. This can help detect less savvy NDF user groups, as well as other types of multi-account or fraudulent users.
• Maxmind - Searching by IP address give us a much more complete set of information about an IP address than is usually available via OBO, such as specific location (including city and postal code), ISP, organisation and more.
• Check Mail - Tool that allows us to check whether an email address used to register an Upwork account is a ‘disposable’ address, which are often used when creating NDF accounts.

Other EE NDF Research Methods

 Aside from the tools mentioned above, and the information detailed in the Payment Risk section below, there are numerous methods EE can use as a team to attempt to establish whether a user is NDF.

• Hourly / Manual - It’s a very common tactic for NDF users to insist on changing from the client’s suggestion of a Fixed Price contract to an (often unusually high) hourly rate. Once the contract is established, they will often push for Manual time to be allowed too.
• Language - Does the user claim to be from an English speaking country, or to be fluent in English, but struggle to communicate in coherent/fluent sentences in the chats with their client?
• Communication - Is the suspected user delaying and pushing back the potential due date of the project regularly? Not always a warning sign but combined with other tells this can show that the user is attempting to extract more hours from the client before abandoning the project.
• Withdrawal Method Mismatch - A major warning sign, seeing an accounting entity in a name which does not match the one being used by the FL strongly indicates that they are lying about their identity.
• Profile Pictures - Does the profile picture used by the FL look surprisingly professional / mismatched with the name they are using? A reverse Google Image Search might reveal that it’s been stolen from elsewhere.
• Non-Delivery - In cases of false-positive suspensions, we might see evidence of the FL delivering a final or close-to-complete work product. In genuine NDF cases where the user is appealing, we should check recent contracts to establish whether they had in fact delivered work. 

False Positives

If we have cause to believe that a user has been incorrectly suspended and that their case may be a false positive, we should:

• Create a ticket via email to: tns-investigations-escalations@upwork.com 
• This email should detail the reasons we believe the account requires an additional review
• Add as much information as possible regarding the case as possible

The detection and handling of NDF users and groups on Upwork is a process largely handled by Risk Management. Included below is some useful information about their processes and some background / ‘behind the scenes’ detail which will be useful to us when working with them on NDF cases which have been escalated to us.

Payment Risk will make a decision on freelancers based on the level of confidence they have the user is part of NDF. Based on this level of certainty Payment Risk will adjust their actions that impact clients, including ending contracts and reversing payments, to minimize impact to the freelancer.

The following table shows the action Payment Risk took and how you can identify it in OBO:

As before, Payment Risk will initiate the ticket with the client to inform them of the action taken. If the client responds the ticket will automatically be reassigned to Client Retention.

Appeal / Verifications

Freelancers who are determined possible NDF or confirmed NDF and allowed appeal will be required to further verify their account before being resumed.

If the freelancer does not respond within 7 days their contracts will be ended and earnings reversed. Otherwise Payment Risk will wait until the outcome of the account verification before taking further action (either end the contracts/reverse the earnings or resume the FL).

Codes Used By Payment Risk in OBO:

Below is a list of codes used by Payment Risk when noting NDF accounts in OBO. Although the list is incomplete, it does help us get some more insight as to the reasons users have been flagged as NDF, and combined with our own research can help us decide whether a user requires an additional review when we are handling an escalation:

Macros Used by Payment Risk when Handling NDF-Affected Clients: (customised for HV CLs)

Frequently Asked Questions:

• Is there a simple way to tell whether a freelancer is able to appeal an NDF suspension?

• When Payment Risk suspends an NDF user from ZenDesk, they are essentially saying that person is not able to appeal because of the strong evidence they found. However, because they are not always correct, if the user reaches out via other means and there is an escalation, we want to make sure that case is reviewed.

• Are there any stats that show Payment Risk’s rate of false positives? 

• Right now we reinstate approximately 5% of ‘Confirmed Fraud’ cases. We are actively moving towards more granular information being available based on fraud type.

• How often when EE has new / qualitative information to share with Payment Risk about an NDF user does that make a difference to your decision when making a further review?

• Rarely. We look again at the standard methods we already used to make the decision and review them again, basically reinstatement cases are more to do with performing QA on ourselves than additional information provided from EE.
• If EE receives an escalation from a user who has contacted us via Social Media about an NDF account suspension, should we make this clear and give the account info to Payment Risk for further review? 

• Yes, this would be useful, though it’s possible that the SM account has also been sold and so it doesn’t necessarily mean it will add weight to the potential for the suspension to be a false positive.

• Because EE gets a lot of pushback on these cases, from both the user and elsewhere in the company, would it be possible to share information with us about the type of NDF persona / fraud that has resulted in the suspension?

• Yes, we have agreed to start doing this moving forward.

• Could we have access to a tool to help reset the issues that False Positives create (such as ended contracts / resultant JSS issues / reversed funds etc)?

• This will be considered this quarter.