1

Recently started the process of getting hired by a new company, but I'm finding it a bit strange they are asking for pictures of important sensitive information over email ( picture of driver's license & Social Security, address and place of birth, etc.) I know that this is information workplaces require, I just find it strange that I'm being asked for this information over email, as it doesn't feel very secure. Is this allowed? Or is there a way to make sure that this is all credible and I'm able to safely send this type of information over email?

Improve this question
9
  • 3
    Have they told you what they need these documents for? This sounds fishy, Ive only ever had to provide stuff like that after starting a job and certainly not during the hiring process. That's just my experience though.
    – InBedded16
    Commented Feb 8 at 22:11
  • 5
    Put everything into a password protected zip file, and add that you will communicate the password over the phone. However, there’s a good chance the whole thing is a scam.
    – gnasher729
    Commented Feb 8 at 22:17
  • 4
    Do some digging and check that this is a real job, not somebody gathering personal data about you to commit identity fraud.
    – Simon B
    Commented Feb 8 at 23:21
  • 5
    They want a screenshot of your Social Security card? That is typically information you would provide in a secure fashion only after you were hired directly with HR in order to handle your tax liability. Your driver license isn't personal information. It's your address (which is public unless you are unlisted) and your full name which they already know. Request for your SSN (or any similar number associated with your nationality) in this fashion are typically a scam.
    – Donald
    Commented Feb 8 at 23:45
  • 3
    Do they have physical office that you can physically drive or walk to ? Can you drive or walk over to HR and hand them the documents (because they are located near you) ? - If yes, then call them and ask them if you can do that. They should accept this option. Right ?
    – Job_September_2020
    Commented Feb 9 at 5:09

3 Answers 3

Reset to default
8

Assume it's a scam until proven otherwise. Do not send anything yet.

It doesn't matter if the business looks legit. They could be impersonating a real employee from a real business. Or they could have copied the html of an existing business and modified it slightly. The same goes for a LinkedIn profile. It's trivial to copy someone else's profile.

Inspect the email headers. https://www.wikihow.com/Read-Email-Headers If they're using an email address from a generic email platform. That's a potential red flag.

If the email uses a business domain name, do a whois search (or equivalent) on the domain name. Look up its registration information. https://whois.domaintools.com/

Look at the dates of recent registrations/recent transfers, the business address, etc.

Also, ask yourself if the job offer falls within one of these categories: https://www.indeed.com/career-advice/finding-a-job/job-scams

Improve this answer
5

I find that too many organisations think that email is fine for such documents. They also think that their email servers are safe and that their desktops are safe. But none of those are safe.

I also find that too many organisations ask for more information than they need. This is a violation of things such as GDPR.

  • If you really want this job, then go in personally with the documents that they want.
  • Otherwise resist and ask them why they need them and why other companies do not need them.
  • Complain to your local relevant authority.
Improve this answer
-2

It depends. Normally, your mailbox and the mailbox of your employer are considered trustable, i.e. no one really thinks that documents could leak from there. Thus, you can exchange docs there.

Btw, very likely, if you would give the documents to them, for example by visiting them in their office where they scan them, they would still end up in some internal document storage, exactly like their company email.

Improve this answer
10
  • 2
    While the mailbox might be considered trusted, the path between two mailboxes, especially from unrelated organizations, is not secure/trusted.
    – Bart van Ingen Schenau
    Commented Feb 9 at 9:05
  • @BartvanIngenSchenau Everybody is using SMTP with strong cryptography today. I see no real reason of such a leak. Also practically impossible to get into the traffic between the mailservers to eavesdrop or mitm. I think, the most likely way to such a document leak is the compromised laptops of the HR guys or bosses.
    – Gray Sheep
    Commented Feb 9 at 9:14
  • @GraySheep - SMTP isn’t encrypted. Unless they are using certificate based encryption, which is impossible, if the author doesn’t have their public key, the email will in fact essentially be in plaintext
    – Donald
    Commented Feb 9 at 11:33
  • @Donald you are confusing client side cryptography with server side.
    – Aida Paul
    Commented Feb 9 at 12:02
  • @Donald That is right, but today practically all mail provider, incl. the big cloud ones, are using some form of SMTP encryption (SSL or TLS). Beside that, spam/virus filters consider with high paranoia any not encrypted communication. It is similar to http, in theory your browser can visit http pages and you can develop http pages, but there are more trouble with it as configuring the https certificates once. Beside that, to eavesdrop unencrypted communication, an attacker would need access to the middle point of the communcating sides, i.e. access to some router or ISP, that is unrealistic.
    – Gray Sheep
    Commented Feb 9 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .