Protecting the Onboarding Process

Employment scams are popping up more and more in the world of work today, including in places job seekers and employers may not expect. A fake job offer, a suspicious phone number, or a request for personal details can quickly turn a legitimate-looking hiring process into a job scam that creates information security and reputational concerns for the employer.

We see artificial intelligence (AI) showing up in interviews. It happens so often that there are guidelines on how to vet whether the person you are speaking to is real (Tip: Ask them to hold up a hand in front of their face; the screen will glitch if it is a simulated person). We see robot candidates applying for jobs. We see Applicant Tracking Systems (ATS) phishing scams that target candidates to upload ID documents, bank account information, and other personal data, enabling hackers to commit identity theft.

This should be of concern to employers, who bear responsibility for keeping the personal information of both candidates and employees safe.

Most employers have some sort of internal cybersecurity training and processes in place for their employees. However, it is becoming increasingly clear that we also need to have systems in place for our hiring processes. It is up to us to communicate our processes to our candidates and to have a standard operating procedure for oversight.

How Can Employers Reduce the Risk?

As this type of fraud becomes more common, employers should take practical steps to reduce risk, protect candidates, and make legitimate onboarding communications easy to verify before sensitive personal information is requested, submitted, or shared.

1.      Provide clear verbal and written instructions to candidates about who/where they will be receiving information from.

2.      Provide a list of the recruiting, onboarding, and HR platforms your organization uses.

3.      Encourage the candidate to contact your organization directly to verify if they receive something that looks suspicious.

4.      Include proper contact information in the offer letter.

5.      Have an internal process where a person oversees any automated messages and reviews them for accuracy.

6.      Have a process in place to assist your candidate or new hire in the event their identity is stolen, including steps for reporting the incident to the Federal Trade Commission, the Internet Crime Complaint Center, law enforcement, etc.

Security Language to Include in Onboarding Materials

Employers can also provide the following security notice as part of their onboarding process to help new hires verify legitimate onboarding requests and avoid employment scams:

Important Security Notice for New Hires

Our company will only send onboarding links from authorized company email addresses and approved onboarding platforms. Before entering personal information such as your Social Security number, banking information, driver’s license, or tax forms, verify that the email sender and website address are legitimate.

We will never ask you to provide sensitive information through an unsolicited email, text message, or website that has not been specifically identified by our company. We will also never ask you to purchase gift cards, provide credit card information, move money, or complete financial transactions as part of the hiring process. If you receive an unexpected onboarding request or have any concerns about the authenticity of a website or email, contact Human Resources directly using the contact information provided in your offer letter before submitting any information.

Employees are encouraged to verify the exact web address of any onboarding platform, compare it to the company website or approved platform list, and avoid relying solely on links provided in emails, text messages, job boards, or social media messages.

For employers using third-party systems:

Authorized Onboarding Platforms

The company uses the following onboarding and HR systems: [Insert Platform Names]. Employees should only complete onboarding documents through these approved systems. Any request to complete employment paperwork through another website should be treated as suspicious until verified with Human Resources.

Make It Easy for Candidates to Verify What is Legitimate

As onboarding scams become more sophisticated, employers must make it easy for candidates to know what is legitimate. Clear instructions along with verified communication channels, as well as a reporting process, can help protect candidates and reduce employer risk. A little preparation can prevent confusion and avoid issues from the beginning.

By: Amy Matthews, SPHR

• Previous