A supposed Druni job offer on Telegram pays users for simple tasks then pressures them to invest more. Victims receive small initial payments, but the scheme quickly escalates to demands for larger sums. The scam exploits trust in well-known brands and leaves many at risk.
Getting paid more than you put in might seem like a good deal, but for one Spanish user, it was the first sign something was wrong. After answering a Telegram message about paid tasks for Druni, he received €5 for liking products. Then came the catch: to keep going, he was told to invest a much larger sum.
The scam starts with repeated calls from a mobile number. A woman's voice—clearly a recording—pushes the recipient to join Telegram. The offer is straightforward: do simple online tasks, like liking Druni products, and get paid right away. The first payment arrives through Bizum, which helps the scheme look legitimate and encourages people to keep participating. The National Cybersecurity Institute (INCIBE) notes that sending small payments up front is a common trick to build trust before asking for more.
Brand names as bait
Scammers use well-known brands to gain trust. In this case, the caller claims to be a Druni manager, but there is no link to the real company. Real product images and familiar names are used to make the offer seem genuine and push people to act quickly. According to the user, after the first payment, the tone changes—the supposed employer now insists on an investment to support "other investors," promising even bigger returns.
“Ya me los conozco y soy yo quien estafa al estafador,” the user said, describing how he recognized the scam and managed to get more money out than he put in. But this is rare. INCIBE has tracked this type of fraud since January 2024, warning that early payments are a classic way to build trust before demanding more. Spanish media and cybersecurity authorities have pointed out that these scams are part of a wider pattern involving instant payment apps and fake job offers.
How the trap tightens
After the first small payout, the scam changes tactics. The victim can't keep earning unless they invest more. The supposed employer stops paying for tasks, and the only way to continue is to send larger amounts. INCIBE's analysis of similar cases shows that after initial gains, the rules change: higher investments are required, and the promised returns never arrive. The setup is meant to make the victim feel in control, but the risk only grows with each step.
The user who shared his story did not lose money, but he mentioned others who lost significant amounts after investing more. There is no safe amount—any money sent is at risk. Angela García Valdés, a cybersecurity specialist at INCIBE, explained in August 2026 that these scams rely on small, real payments to build confidence before demanding larger transfers. Getting money at first does not mean the offer is real.
Verifying offers and protecting yourself
Druni's official job listings are only on their website, where candidates can submit CVs and see real openings. Trusting a phone call or Telegram message is risky. Even if the products shown are real, there is no guarantee the person contacting you is from the company. Scammers have also impersonated other brands, like Lidl, using fake websites and social media groups with made-up testimonials to attract victims.
INCIBE advises always checking job offers independently and contacting companies through official channels. Never trust group chats or testimonials from strangers. If you are asked to invest money to unlock tasks or withdraw earnings, stop immediately. Save all messages, usernames, links, and payment receipts, and report the incident to your bank and the authorities. If you have shared card details, tell your bank so they can act quickly. Recovering lost money is not guaranteed, but reporting fast improves your chances.
Even if you get more money than you sent, do not assume the scheme is safe. The first payout is meant to draw you in. For advice on suspicious messages or possible fraud, INCIBE's free and confidential helpline (017) can help you protect your accounts and avoid further losses.
This case is a clear warning: scammers are adapting, using trusted brands and instant payments to trick people. The promise of easy money is tempting, but the real aim is always to take as much as possible before vanishing. As long as people believe a familiar name means safety, these scams will keep finding new victims. The best defense is skepticism, checking offers independently, and never sending money to anyone who asks for it in the name of a job.
