The scammers used voice recordings to pose as Human Resources 'employees' and clones of legitimate websites, but raised red flags when they requested wire transfers for residence permit fees.