How to Tell a Job Offer from an ID Theft Trap
krebsonsecurity.com
krebsonsecurity.com
In the USA you can contact: https://www.usa.gov/identity-theft
In the UK: https://www.actionfraud.police.uk/
Most countries will have a government organisation that can help you so don't disrepair.
Disrepair (noun) - The state of being in poor condition, in need of repair.
Disrepair (verb, intransitive, rare) To get into a state of disrepair.
The OP just made an honest typo, it shouldn’t detract from their post, let’s move along. :)
P.S. Personally, I also thought fakedang’s comment was fine. Just a helpful little note in case anyone was confused.)
Then at the end of this supposed screen, he asks for my DOB. "Uhm, why do you need that?" "It's not important, you can even give me a fake birthday". I ended the discussion there. He knew nothing and wanted my personal info and then told me I could even fake it. Wtf?
Things that are common in various other countries: including a selfie with your application, DOB, marital status, citizenships.
This is very common for legitimate job offers. And probably makes sense since many companies see almost no traffic from potential hires.
It's more like the industry has configured itself in such a way that it's indistinguishable from phishing. Like the insurance industry.
If that isn’t the absolute final step to becoming an employee there is a huge problem. Contact the potential employer using contact information from their website and verify the legitimacy of the opportunity before submitting any personal information beyond a resume.
It's pretty easy enough for a scammer to put together a fake offer letter to send over email.
Heck, some companies perform background checks before you can even interview, which saves time and effort on both sides. Nothing inherently wrong with that either.
The overarching point remains: any time you give out your identity info, verify whoever you're talking to is legit -- whether a bank, company, or recruiter.
The difference is that at some point you have to notify your current employer that you'll be leaving. You probably do that after receiving the offer letter, so if you never get one, at least you still get to keep your old job.
> -Interviews are not conducted in-person or through a secure video call.
> -Potential employers contact victims through non-company email domains and teleconference applications.
> -Potential employers require employees to purchase start-up equipment from the company.
> -Potential employers require employees to pay upfront for background investigations or screenings.
> -Potential employers request credit card information.
> -Potential employers send an employment contract to physically sign asking for PII.
> -Job postings appear on job boards, but not on the companies’ websites.
> -Recruiters or managers do not have profiles on the job board, or the profiles do not seem to fit their roles.
(The rest of the article is an anecdote. I kind of feel stupid for reading all of that now.)
"Here are some other telltale signs of a job scam, as per the FBI:
-Interviews are not conducted in-person or through a secure video call.
-Potential employers contact victims through non-company email domains and teleconference applications.
-Potential employers require employees to purchase start-up equipment from the company.
-Potential employers require employees to pay upfront for background investigations or screenings.
-Potential employers request credit card information.
-Potential employers send an employment contract to physically sign asking for PII.
-Job postings appear on job boards, but not on the companies’ websites.
-Recruiters or managers do not have profiles on the job board, or the profiles do not seem to fit their roles."
There is no way I would read the correspondence as legit, but it’s not bad and given the return on the scam it’s wild that they don’t slightly improve that step.
Getting grammar wrong likely attracts the level of sophistication required to make the scammers job easy.
> Can You Ever Be Too Smart for Your Own Good? Comparing Linear and Nonlinear Effects of Cognitive Ability on Life Outcomes
> Despite a long-standing expert consensus about the importance of cognitive ability for life outcomes, contrary views continue to proliferate in scholarly and popular literature. This divergence of beliefs presents an obstacle for evidence- based policymaking and decision-making in a variety of settings. One commonly held idea is that greater cognitive ability does not matter or is actually harmful beyond a certain point (sometimes stated as > 100 or 120 IQ points). We empirically tested these notions using data from four longitudinal, representative cohort studies comprising 48,558 participants in the United States and United Kingdom from 1957 to the present. We found that ability measured in youth has a positive association with most occupational, educational, health, and social outcomes later in life. Most effects were characterized by a moderate to strong linear trend or a practically null effect (mean R2 range = .002–.256). Nearly all nonlinear effects were practically insignificant in magnitude (mean incremental R2 = .001) or were not replicated across cohorts or survey waves. We found no support for any downside to higher ability and no evidence for a threshold beyond which greater scores cease to be beneficial. Thus, greater cognitive ability is generally advantageous—and virtually never detrimental. https://www.gwern.net/docs/iq/2021-brown.pdf
IQ measures how good people are at IQ tests. As much as some people like to pretend otherwise, it does not measure "intelligence" by any meaningful definition and certainly nothing inherent or genetic. If you improve socioeconomic factors, IQ rises almost automatically.
People who do well in life don't generally score higher in IQ tests, they score higher in IQ tests because they had the means (access to education, parental wealth, access to mentoring and care as a child, etc) to do well in life in the first place.
The paper you're citing is guilty of HN's favorite academic crime: Correlation does not imply causation.
Inversely we've see plenty of historical evidence of higher IQ scores in groups being directly influenced by socioeconomic factors in populations where these factors have changed. It has also been demonstrated that training for IQ tests (or growing up in an education system that routinely uses similar exercises) improves the scoring on those tests.
IQ is a shitty shorthand because there are far more reliable factors you can use instead (e.g. generational poverty) in most scenarios without bringing an arbitrary metric in that only exists because of one scientist's obsession with demonstrating the superiority of the White race (followed by post-hoc rationalizations about Asians actually being "too smart" and thus still inferior, because that's the kind of nonsense you end up with by narrowly hyperfocusing on one made up stat so you don't have to deal with the complexity of socioeconomics).
"Therefore, it's in the scammers' best interest to minimize the number of false positives who cost them effort but never send them cash. By sending an initial email that's obvious in its shortcomings, the scammers are isolating the most gullible targets"
[1] https://www.businessinsider.com/why-nigerian-scam-emails-are...
Here's a piece from MS Research coming to that conclusion ("By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select")
https://www.microsoft.com/en-us/research/wp-content/uploads/...
I struggle to believe that most scammers in the world are that good that make deliberate mistakes in their letters to reduce false positive rate. More realistic solution is that the average scammer is not well educated, he makes mistakes unintentionally and out of pure luck it works well for him.
About why they say they are from Nigeria, I'd say that simpler the scam is, easier it is to pull. If you communicate via voice, it is hard to properly mask accents. If you are sending something via money transfer, destination address is obvious as well.
If it is an effective strategy, then scammers who have better grammar may find their scams less profitable, and move on to other jobs. While scammers that have worse grammar end up being more successful, so decide to continue.
(I’m not saying this strategy is effective, or that this is the mechanism that explains the relationship, just offering one possible explanation)
These people are doing it as their actual job.
The scammers are not kids who are having fun with a prank, or hobbyists who make mistakes because they do not spend enough time on the task. The scammers are smart human beings who do their jobs, as professionally as they can.
If they wanted a foolproof version of their text, they would be able to find an automated correction tool (e.g. on Gmail), or to ask someone to proof-read it. The fact that they do not is a hint that it is either a waste of time from their perspective, or detrimental to the efficiency of their jobs.
This is a fascinating YouTube series from a guy who managed to hack into the IT system of an Indian scam operation (including gaining live access to their security camera footage!) It goes into a lot of detail about how this particular outfit operates:
That's a fairly big red flag these days, even if the company is actually using free email.
I don't know why, but unfortunately it's not actually a red flag at all. It's shockingly common.
Makes it easier to take connections with you to the next job maybe?
I'm from a small town of about 50,000 people but 45 minutes away is a small fishing village of about 100 people. The scammers say they are from large tech companies based in that town. Yes based in that town of 100 people, maybe they catch fish on the side? That town was and is somehow always picked by scammers. I've seen "hot girls in your area" ads pick the same town.
If it had been my town, a profile more believable maybe mix up the ethnicity of the profiles more, and be more not be so incredibly obviously a scam they may have got me.
In the same way you should call banks back when they call you and need a PIN or something, you need to similarly contact companies directly when they ask for an SSN or something.
As a general rule, companies can't protect individuals from being scammed in the name of the company (except for basic things like HTTPS, etc.). It's up to individuals.
His sense of urgency, the emphasis on high salary AND contact channel screamed scam.
(Instablocked)
> no: then its 99.9% fake / phishing.
Surprisingly these attacks and other forms of phishing are on the rise ever since that facebook leak... coincidence? that joincidence with a c! ;)
This means giving your SSN to a random person calling. Every GM recruiting house has to do this.
Not even worth it, the other auto companies pay just as good(minus Tesla)
But that's extremely high risk to take a 30-50k pay cut and move from highly affordable Michigan to Cali. All to bet it on stocks.
Source- 2017 recruiter was offering 80k, I was making 120k(40hr/week). Bonus points for the recruiter harassing me multiple times about "not changing the world" until I finally told him that I need to hang up.
So while not ideal, this doesn't feel particularly egregrious to me. Of course, like any time you give out your SSN, you need to verify you're entering it on a legitimate site, or that you're dealing with a legitimate recruiter.
Pretty much every recruiting process at any large company has dumb policies, sadly. If something this small makes it "not worth it", I doubt any of the other companies would be "worth it" for you either.
Doctors tend to be major offenders here - their forms always ask for SSN. I never fill it in and they often don’t even ask a follow-up. But when they do, I’ve almost always been able to still get out of it by telling them that I don’t give it out to anyone ever. Or I don’t remember it.
Is that actually a thing in America?
When it can take many months to evict a tenant who stops paying their bills, all of which is lost income plus then the cost of finding a new tenant, minimizing the probability of that is a landlord's top priority. Frankly, they'd be insane not to.
It's pretty standard to require a year or two of the first couple pages of your tax returns, and 2-3 months of bank statements, to prove your income as well, since standard background/credit checks don't have that.
Why, where do you live? Do landlords not require all this there?
Yes it takes a while to evict people and agents have a shared blacklist of tenants who didn't pay their bills but it is expected that the house owner has insurance to cover damages and loss of income, just a part of being a landlord.
Australia has a specific magistrates court for dealing with those issues and unscrupulous landlords or tenants for example
I'm actually quite curious then -- if a landlord has, say, 5 different prospective tenants then how do choose?
Because in NYC the landlord will take offers from those 5 tenants, run checks, and then pick the one who seems least likely to default.
In Australia and the UK is it the same, but they just go with more of their gut feeling or something, rather than hard data? Or is it primarily income listed on the work contract but they can't find out about debts?
I obviously can't speak for how they pick, but I think it's usually a case of first application that meets the affordability criteria and has rental history or reference s.
They take offers on higher rent in a hot market.
Or maybe Ive just been very lucky and had kind agents
Edit:
>It's pretty standard to require a year or two of the first couple pages of your tax returns, and 2-3 months of bank statements, to prove your income as well, since standard background/credit checks don't have that.
That sounds insane to me.
Refuse to rent to someone who you met in person and is an obvious meth head who will totally trash the apartment they second they acquire it; who obviously has no job and will never pay rent? Well you "must" have learned of some protected characteristic too and therefore you just discriminated against them.
Refuse to rent to someone because "computer says no"? You're fine.
I'm just saying, if you're dealing with recruiting at a large corporation and they need an SSN to start the process, that seems like one of those special circumstances it makes sense to make an exception for.
When did you experience this? Was it recent? I've interviewed for multiple jobs at GM over the years (multiple locations, not just Detroit) and I've never been asked for my SSN. The last one was in 2016, and I even got an offer (that I turned down) - they never asked for my SSN but did say it was needed for the background check if I had accepted the offer.
At a previous job I worked for a GM vendor. So I interacted with a lot of GM folks and did some of their required virtual training associated with the ignition switch scandal and being able to communicate those types of violations up the chain. It really seemed to me that GM is very careful about any type of situation that could result in lawsuit.
If they are asking for SSN's now as part of the recruiting process, that strikes me as really strange.
When I bought my first Car, a fraternity brother of mine was able to get me a GM Friends and Family Discount. He wound up having to get my SSN to give to his Father so that his father could get it put 'in the system'. Which at the time (2006) may or may not have involved others handling that info in the process.
Not gonna lie, if it wasn't for how long I'd known him etc, I would not have believed that GM would use such a thing.
Also, those programs have limits on how many times and how frequently an individual can take advantage of them. They may have used your SSN as the unique identifier to ensure you aren't exceeding the program limits. Not ideal obviously but really not all that unusual.