Header Ads

The Job Seeker's Guide to E-mail Verification

It can be daunting looking for a job and also being unemployed can leave someone in a very desperate position. Social Engineers and scammers know this, and use various emotional techniques to fleece job seekers of the little money they have left. It goes without saying that if you are on the lookout for a new job, your senses should be on red alert.

Social Engineers also know that a very common means of communication between prospective employers and job seekers is through email. Hence email is a very common attack vector for scammers. This being the reality, you must be able to filter legitimate emails from malicious ones. The sample walkthrough below should help distill some basic email verification techniques which should keep you safe from potential Job scammers.

To be as practical as possible, I will be using a real email received by a Jobseeker. Though not an outright scam, the sender is not what they claim to be.

The very first rule of thumb is you should be skeptical about everything you received by mail, but more especially unsolicited mail. This is not unbridled paranoia but healthy skepticism. Approach every mail as if it was something potentially dangerous, this will give you the right mindset to perform a careful analysis. Second, while in this skeptical mindset, turn your eyes into a super scanner and go through the mail line by line looking for misspellings or other things that seem out of place. If you have the slightest bit of suspicion, never click on any embedded links or open any files attached to the mail.

Using the above guidelines, we can notice that the email address of the sender is not a company email. They are using outlook.com which is a personal email provider. Using an online tool normally used to confirm if email addresses are legitimate, we can confirm this to be the case. Typing the sender’s email address in https://hunter.io/email-verifier we get the response “This is a webmail email address. This domain name is used to create personal email addresses so we don't verify email addresses on this domain.

The question to ask is why would a reputable HR firm be using a personal email address provider? While this might be legitimate for a personal representative of the company, it is a clear warning signal if a full company cannot have its own email address domain.

The next thing to verify is the company name. Did they give a website address? If they did how long have the company website been up? Did they give a physical address? What about social media handles? How long have they been active on social media? All these checks are to make sure that the organization exists and you’re not dealing with a shell entity. To do this you can google the company name, log into your social media account, and check their activities on social media. If you’re not convinced, you can do a deeper investigation using Michael Bazzell’s open source investigation tools at https://inteltechniques.com/menu.html. From the mail, we can notice that no social media handles were provided, neither any company website. Googling for Unlimited Careers in Abuja turns up nothing. This is another sign that we might be dealing with scammers.

Another pertinent question to ask as it concerns Job offers is if you applied. Also, notice the mail does not state the position applied for which is another red flag. If you do not remember applying, then it is most likely a scam. Very few companies or HR firms send job offers or ask for interviews except such candidates are already established in their field and highly sought after.

Another good check to do is to verify if the email address has been spoofed. Email Spoofing is the creation of email addressed with a forged sender address. To check for email spoofing, you will need to open the email header. Every email provider has a different way of doing this, but for Gmail, click the 3 dots at the right upper corner and click on "show original".

If the domain in the “message id” is the same with the domain in the “from” section, then the email has not been spoofed and that is the sender’s actual address, but if there is a difference, then the sender’s address has been forged. Our current email under investigation passes this test, it hasn’t been spoofed.

Finally, considering all we have discussed thus far, the use of a personal email provider, lack of company website address and social media presence, absence of physical office address and no information after a google search, and the candidate does not remember applying to the company and the mail does not state which position the candidate is applying for, we can conclude that the invitation for interview is not genuine.

No comments

Powered by Blogger.