Just because it's 'working' doesn't mean it's legitimate.