I can't believe there's more than one person doing this. I have an article in progress on a very similar scam, but I figured I'd get this one out first because it's even more crazy. I'm not even gonna jump into a backstory, let's get straight to the juiciness.
Note: this article is almost certainly getting updates over time, and I might write several articles. This is a developing story with an active lawsuit, and there's surely gonna be a lot to unpack over the next few months.
Also, please don't take any of this as a legal professional's standpoint. I am not a lawyer, just a tech nerd that's looking out for you.
Noveo.ai is a "training and internship" company targeting people in cybersecurity. Often times, with these companies that claim "training and internship", they really just want you to buy into a course of dubious quality, just like another company that I have an investigation on the backburner for (and will be posting eventually!)
Christopher Tampol is the leading image of Noveo, claiming to live in NYC. But, this story gets deeper. I was able to find the person behind Noveo's website, not just the operator.
A lot of these scam sites love to use WordPress, because it's easier to spin up a pirated WordPress theme than make your own custom website. The thing about WordPress is, it will often reveal your email in the form of an MD5 hash through Gravatar, a profile picture service.
I found the hash 1d27aea63102bdd09b4bfd7f14746718 connected to user khurram, who has made every page and post on the site, and found out that hash reverses to [email protected] and connected that email to Khurram Ghazi.
A Deeper Dive
Christopher seemingly only hires the best developers, with his WordPress developer scoring 30 marks out of 100 on a university IT test as recently as a month ago:
But, on the topic of Noveo itself. They have three "partner" companies: GPMS (Global Portfolio Management Systems), iSolve and i-Guardian.
GPMS appears to be a legitimate IT organization, incorporated in New Jersey in 2005, by a Gordon Tampol... wait, that last name appears again! Turns out, Christopher is Gordon's brother:
And he's the actual operator of Noveo:
GPMS claims to serve Fortune 500 companies. The only potential client I could find was the Sandia National Laboratory in New Mexico (from 2012!), and they seemed to only be at the stage of asking for a quote at that time with no actual contract number.
They apparently had a software called PdWare for portfolio management, in 2011. Most of the information on them is ancient, which makes sense as they were incorporated in 2005...
In fact, the original Global Portfolio Management Systems actually dissolved! "Global PM Systems, LLC" is also owned by someone with the last name Tampol and was reinstated around the same time:
GPMS has an address of 297-101 Kinderkamack Rd, Ste #108 Oradell, New Jersey 07649.
i-Guardian is a platform claiming to innovate the investigation of child abuse with.. the blockchain? Don't get me wrong, child abuse is a very serious issue. But this is literally making a mockery of it when you're using it as a part of the bait for your scam. Would you guess where the address is? If you guessed 297-101 Kinderkamack Rd, Ste #108 Oradell, New Jersey 07649, you would be right on the money.
Their Facebook page also proves Ghazi is an accomplice, not just a freelance developer - not only is he liking posts, but there is an admin from Pakistan on the Facebook page...
iSolve doesn't need much of an explanation, because they literally state their connection with iGuardian, right on the front page.
They're also registered by a registered agent - they couldn't even bother to file their own paperwork this time!
So, wouldn't you know it - the three partner companies are all ran by Gordon Tampol, Christopher Tampol's brother. See where this is going?
The Lawsuit
Oh boy, here we go.
In March of 2024, four people decided enough was enough. They decided to take NLS Global (another Tampol family company), GPMS, the Tampols, and a new person, Jennifer Corrao, to court.
Now, who is Jennifer? Her LinkedIn would have you believe she was a VP at JPMorgan Chase before ditching it all for this company, but when looking up the real person at the address stated in the lawsuit, she's really just a car and real estate saleswoman.
Now, back to the lawsuit. What is it exactly about? Well, if you guessed fraud and scamming, of course you're correct... four people paid a whopping 22,500 dollars each for this fake "internship", and Noveo never followed through on their contractual duties to pay the loans back afterwards.
I feel super bad for these four people. From what I can gauge, all four of them were fresh college graduates desperate to find a job and deceived by Noveo's blatant lying. The exhibits, however, give us a goldmine of information on their recruiting process.
First, Jennifer (or one of the organization's other scammer buddies) reaches out to you regarding a cool entry level job opportunity:
Then, she sends the document which tells you how to apply along with all sorts of buzzwords:
$75k to $150k salary as a fresh college grad? Say less! Except, this is where it all goes downhill.
You get sent a mutual NDA. I would never sign an NDA to just apply to a job, but apparently it fooled people.
Then, after you sign the MNDA, they supposedly do a credit check through Equifax so you can get approved for that hefty $22,500 loan (it doesn't show this in the court documents, but other sources talk about it) and send you a bunch of onboarding documents.
We don't have copies of everything, but we do have a copy of the Training Agreement and Training Bond Agreement. Let's start with the money:
Yep, it's $22,500, alright! On a 60 month loan term at an insane 14.50 percent interest rate, nearly $600 per month:
Now, to the actual Training Agreement. One thing of interest in here is an arbitration clause (am I surprised? They clearly don't want this to go to court):
The documentation in this lawsuit states it prepares you for the CompTIA Security+ exam, and doesn't even give you the exam. For $22,500, I would at least expect you to pay for a $400 voucher!
Now, who are their hiring partners? Let's look a little further into the documentation..
GPMS, Noveo, and iSolve are literally all owned by the Tampol family (also, why did they recommend themselves as a job site?), as I proved earlier in this post. So why are they the ONLY hiring partners? That is, because you'll never get hired. They just want to scam you.
Conclusion
There are so many things wrong with this. The legal battle is currently ongoing, and I hope the plaintiffs win.
To the Tampol family, Jennifer Corrao, and anyone else involved in this operation, shame on you for thinking it is a good idea to ruin people's livelihoods for a bit of extra cash.
To Meritize, the loaning company, shame on you for allowing a fraudulent operation to go unchecked.
And to LinkedIn, and everyone else promoting this, shame on you for letting this happen on your platforms.
If you want genuine cybersecurity training, there's better solutions. If you want the Security+ certification, buy the voucher for $400 and use courses like Jason Dion or Total Seminars on Udemy. At least then you'll only be out $500 at most and not 22 and a half thousand dollars. You can even get two SANS courses and exams, often considered some of the most expensive (and high quality) training in cybersecurity, for under $22,500. If you want to go the bootcamp route, things like CyberNow Labs exist that actually do give you near real-world SOC experience, cost a lot less, and are actually legitimate.
If you're reading this, and you were considering Noveo, please don't. Cybersecurity is a notoriously hard field to break into, and these companies rely on that to sink money out of you.
Let's spread the word to make sure nobody else gets scammed by Noveo/GPMS. Thanks for reading.