If that isn’t the absolute final step to becoming an employee there is a huge problem. Contact the potential employer using contact information from their website and verify the legitimacy of the opportunity before submitting any personal information beyond a resume.
It's pretty easy enough for a scammer to put together a fake offer letter to send over email.
Heck, some companies perform background checks before you can even interview, which saves time and effort on both sides. Nothing inherently wrong with that either.
The overarching point remains: any time you give out your identity info, verify whoever you're talking to is legit -- whether a bank, company, or recruiter.
The difference is that at some point you have to notify your current employer that you'll be leaving. You probably do that after receiving the offer letter, so if you never get one, at least you still get to keep your old job.