Does an offer letter make a recruiter’s request for identity documents safe?
No. Independently confirm the employer and hiring relationship, why the information is needed at this stage, and the approved collection route. Legitimate employers may need personal information; an offer letter alone does not verify who will receive it.
You have completed two interviews and received an offer letter. The recruiter now sends a form requesting a copy of your driver’s license and your bank details. The page has the company’s logo and calls the upload “onboarding.”
That request may look more credible than the original recruiting message because you have already invested time in the process. Yet the sensitive decision happens now: which organization will receive this information, for what purpose, through which channel? An offer letter is part of the material you are verifying. It cannot independently authenticate its sender.
Our coding-assessment guide covers the different risk of running recruiter-supplied software; our new-hire impersonation guide examines an employer granting access to an alleged worker.
How fake employers reach the document request
The FBI’s January 2020 advisory describes criminals impersonating employers, conducting interviews, sending employment contracts, and requesting copies of driver’s licenses, Social Security numbers, and financial information. It also warns that criminals can operate HTTPS websites. Encryption of the connection does not establish that the recipient is the employer you intended. FBI IC3: fake job listings and personal information
In December 2023, the FTC described reports from students who encountered convincing recruiting conversations, online interviews, formal-looking offers, and subsequent requests for personal information. Publicly available college details and copied branding helped support the story. The agency advised contacting the company through a known real number when the conversation turns to sensitive information. FTC: recruiting impersonation targeting students
Confirm the hiring relationship and collection route independently of the person making the request. Remote interviews and online onboarding can be legitimate; the format alone does not settle who is collecting the information.
Verify four things before the upload
The employer relationship. Contact the organization through a route you obtain independently of the disputed message. Ask whether the role, recruiter or recruiting agency, and offer are associated with its hiring process. A company’s existence does not prove that the person contacting you represents it. Our callback contact-source article explains how a verification conversation can become circular when the requester supplies the only number used.
The stage. Ask what step you have actually reached and what information that step requires. An interview, a conditional offer, an accepted offer, a background-screening step, and payroll setup need not use the same process. Requirements differ by employer, role, and jurisdiction. Ask the verified HR contact which requirements apply to your situation.
The purpose and fields. Ask why the requested document or field is needed, who is responsible for collecting it, and whether a less sensitive alternative is accepted. Legitimate onboarding can require personal information. That fact does not establish a need for every item on an unfamiliar form. Let the verified HR or privacy contact explain the applicable process instead of guessing from the form’s title.
The channel. Confirm the actual service or destination the employer uses, including any authorized third-party provider. A different domain is not automatically fraudulent, but the recruiter should not be the only source confirming it. Reach the service through the independently verified instructions. If the upload address changes unexpectedly, ask the employer to confirm the replacement before sending documents.
Before the identity upload
Recommended checks
- Employer relationship
Confirm the role, recruiter, and offer through an independent contact.
- Stage and purpose
Why are these fields needed at this hiring stage?
- Exact collection route
Confirm the service and destination with the verified employer.
Only when checks are resolved
- Supported submission
Use the confirmed process for only the required information.
Pause disclosure if any check is unresolved. Ask the verified HR contact; a new destination needs a new check.
A second person in the chat is not independent confirmation
A recruiter may introduce an “HR specialist” who confirms the upload link. A second person in the same conversation does not independently confirm that either one represents the employer. Reach the company’s recruiting team through its known contact route and ask it to confirm the role, offer, onboarding step, and collection service.
If a new upload link arrives afterward, check the replacement too. Confirmation of the original destination does not cover a substituted one.
Give candidates somewhere to ask
HR teams can make verification practical by publishing a clear recruiting contact route and preparing staff to handle suspected impersonation. The FTC specifically recommends that HR teams be ready for inquiries when criminals misuse the company’s name. FTC: employer response to student inquiries
Answer the candidate’s precise question: whether the employer recognizes this role and request, what process applies, and how to reach the approved collection service. Do not ask the candidate to email a complete identity document merely to verify that someone else requested it. A request reference and a redacted description may be enough to begin the investigation.
Set an internal owner for unresolved cases. If an external recruiting agency or screening provider is involved, HR needs a way to confirm that relationship. An employee who says “we use lots of vendors” has explained a possibility without validating this one.
If you already submitted information
Stop sending additional information and preserve the recruiting conversation, destination address, and approximate submission time. Record the categories of data disclosed rather than reproducing full document numbers in a general support ticket. Tell the impersonated company and the job platform using their established reporting routes.
For US readers, the FTC’s identity-theft guidance points people to IdentityTheft.gov for recovery help, including advice when information has been exposed. Use the official guidance relevant to what you disclosed; do not assume that every disclosure produces the same exposure or remedy. If bank details were involved, contact your financial institution through its known route. FTC: identity theft and recovery help; FBI IC3: victim reporting
