1

Ontario Canada, engineering company.

Recently I started work on a new project for a long-term client of the company. I have worked numerous projects for this client in the past.

I get an email from a manager I have never heard of. She wants my mother's maiden name for billing on this new contract. This is new to me. I have never been asked this before. I ask questions.

It seems that there is a new billing system. The client demands we use it. And they demand this information because they want to cross-check my name against my security clearance form.

Um... Click, click... (These are the gears in my brain skipping.) My security clearance form is the only place my mother's maiden name has ever been entered in regard to employment. Mother's maiden name is one of the questions the Canadian government uses to renew lost documents. I know this because it was what they asked me to replace my birth certificate. Which I had to do before I got my security clearance that first time.

So the client's payroll clerks have access to my security clearance form, and they use it to cross check identity.

Am I right to be concerned or is this normal? As I understand it, the people who do security clearances are examined pretty carefully before they get those jobs. The security clearance form has a bunch of info beyond this. Like place of birth, public school, high school, home address at each age, etc. And I would have expected that the information on the application form was protected pretty closely.

6
  • 2
    Is it odd? To me it is, but I am not in canada and I have no insight. Is it scam? It depends on whether 1. this manager really exists and 2. really needs this information. What does the email address tell you? Should you reply by mail or click a suspicious link (don't do that!)? Ask someone at this client who it is and what they need this information for. Generally don't reveal anything to someone you have no idea who they are. Some companys want to find out how exployees react on scam, that's one more reason to investigate and show you don't blindly do what anyone tells you.
    – puck
    Jun 11, 2023 at 7:35
  • @puck You also have seized on the email and think the email is a scam. As I explained in the question, the situation is as I explained.
    – Boba Fit
    Jun 11, 2023 at 15:55
  • How did the company get that security form? Or did you supply it a some point in the past? Is there any form of data protection in Canada?
    – Solar Mike
    Jun 11, 2023 at 18:24
  • @SolarMike Security clearance with my own company to work for this client that does big life critical stuff.
    – Boba Fit
    Jun 11, 2023 at 20:37
  • 1
    "the people who do security clearances are examined pretty carefully before they get those jobs" and the people who lie about doing security clearances aren't checked at all.
    – cdkMoose
    Jun 12, 2023 at 16:12

3 Answers 3

19

My instinct would be to treat it as a Social engineering/Phishing scam until proven otherwise.

When it comes to things like Security questions - If someone needs my identity confirmed, then they can either pass whatever needs my details to me directly and I will fill them in, or they can sit me at their computer and I can authorize it that way.

Either way - I'm not going to give out the answers to my security questions to an individual.

Especially if they those same set of questions/answers are used in other locations.

3
  • 1
    Yes; Treat it was as a scam. Typically, HR would ask you for information if they require it, then send an acknowledgment to the client saying you do indeed have what the client requires of you.
    – Donald
    Jun 11, 2023 at 4:38
  • You have seized on the email, and think the email is a scam. As I said in the question, I asked questions and the situation is as I explained.
    – Boba Fit
    Jun 11, 2023 at 15:54
  • 2
    @BobaFit - The client can validate your identity more ways than you are giving away personal information. You asked if you should be concerned, the response you are getting, is you should be concerned. What you are being asked to provide is NOT normal.
    – Donald
    Jun 12, 2023 at 16:46
6

You should speak about this with your supervisor.

I would be inclined to think it's phishing.

4

Am I right to be concerned...

Yes, you need to be concerned and you need to report it up the chain.

It doesn't matter if you're not sure. You don't have a choice. The default action is to report suspicious requests up the chain as quickly as possible (since you may not be the only person targeted).

And yes, it could be nothing, but there is no harm done if that's the case. Treat any attempt like this like a phishing attempt or a penetration test.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .