I got scammed over a job offer | Hacker News Reader

I got scammed over a job offer

linkedin.com

30 pointsmavelikara20 comments

It's important to become versed in scamming techniques no matter who you are. There are a number of red flags that you would catch:

The email came from info@splunkcareers.us. The first thing to do when receiving such an email is search for the company home page (in this case: splunk.com). If the second and top level domains don't match, you have a scammer. Companies never use addresses outside of their domain.

They asked the person to buy things and then send them somewhere via UPS. This is THE hallmark of a scam.

Next is the linking of a "company" account to your personal card. This NEVER happens.

Finally, asking you to buy things on your personal card and expense them is almost never done before you've actually started work (I say "almost" because some very small 1-2 person startups who don't know any better might do this even though they shouldn't).

> Companies never use addresses outside of their domain.

Sadly not always true. If they use bulk mailers like MailChimp or SendGrid for newsletters, I've seen links in the mail with the domain $company.newsletters.blah.blah, which are controlled by MailChimp/SendGrid.

Definitely linking the card and sending stuff via UPS are glaring red flags.

Ignoring that part, even if they just stick to collecting the background information, SSN, copies of drivers license - that is just good enough information for full-blown ID theft.

Even legitimate companies use varieties of third-parties that help with hiring, background checks, payroll etc. I remember entering data to Workday, some background check provider's site, jobvite, {mycompany}benefits.com etc. the last time I went through hiring process. It's just easy to scam candidates unless they pay close attention to smallest details.

> Companies never use addresses outside of their domain.

    att-mail.com (not att.com)
    vectrenmail.com (not vectren.com)
    discoursemail.com (not discourse.org)
    facebookmail.com (not facebook.com)
    emailbcbsma.com (not bluecrossma.org)
    lyftmail.com (not lyft.com)
    redditmail.com (not reddit.com)

I've twice emailed a complaint (once each) to a bank and a credit card issuer that switched to something like this - and without warning too, my suggestion was they should at least email from bank.co.uk to say that thenceforth mail would come from bankmail.com or whatever it was - they're just teaching people to be over-trusting, and they're the last organisations that should be doing it, makes a mockery of the 'we want you to recognise fraud' spiel they all have in the template.

it's actually a recommended best practice to not send your marketing/comms emails through your main domain, apparently helps with deliverability

It’s in case your marketing domain gets nailed for spamming, you don’t want your regular employees work email blacklisted.

In AT&T's case, it's because @att.com addresses were (are?) given to AT&T residential Internet customers, so they needed a separate domain so it's "clear" if an email is from AT&T itself or from a rando residential AT&T customer.

> Companies never use addresses outside of their domain.

As others already pointed out, this is outright wrong and very bad advise.

Some companies do have their recruitment effort assigned to divisions within the company which do not share the company's institutional domain.

Also, some companies also subcontract their recruitment effort to recruitment companies.

My company was hit by same or similar scammers. We had people turn up in our office for their first day of work only to be told they were scammed.

The most heartbreaking part of this is these people are actually typically in poor financial situation (looking for a job) and are on an extreme emotional rollercoaster (from not having a job to getting a fantastic job to not having it again and loosing their last money).

The solution to not get scammed is to know at least a little bit how companies operate, but in large population there will always be gullible/oblivious people. Nobody ever will ask you to buy a corporate computer with your own card and then ship it to the office to have configuration on it done. That's just too much hassle. But too many people just don't understand this or are too excited to question it.

What I would ask companies to do is to start having an official hiring rules page on their corporate website that explains the process to ensure hiring process is genuine.

I'd say a Status Page for hiring. Something like 'Check your hiring status'.

1. Enter your email address, receive 2FA token.

2. Enter the token, show the hiring status.

> …but in large population there will always be gullible/oblivious people.

Probably why they’re targeting students as it is quite common for them to never have a job before graduation college. On top of that if they have no friends or family who work in tech they won’t know what is standard practice or not.

It sounds like they baited them by paying off the existing balance of the card from the linked “corporate account” to gain their confidence then went in for the kill. Hustle season 1 episode 1 level stuff.

> It sounds like they baited them by paying off the existing balance of the card from the linked “corporate account” to gain their confidence

I'm confused by this, in what universe would a company want to pay off a prospective employee's credit card balance? How would that even be booked by their accountant... Boggles the mind.

It's easy to see red flags as a dead give away in retrospect and we all want to feel like something like this would never happen to us. But this is biased thinking. We all ignore massive amounts of supposed red flags on a daily basis, otherwise we would be permanently paralyzed by fear. But the ones we ignores with no consequence are not recorded anywhere.

Getting scammed could happen to anyone, no matter how careful you are.

Sorry, I am not following: “Skype chat interview”. A “chat” interview, not even a call?

I had an interview on IRC once.

10 yellow/red flags in the story that young people can use to avoid this:

1. Multiple small grammar issues like spaces and capitaliation: the screenshot at the bottom shows the original Linkedin ping. It shows multiple small grammar issues like too many exclamation points, missing spaces between sentences, a randomly capitalized word like "New", and unnatural phrasing, like "Therefore..." which is more at home a mathematical proof than a recruitment email. A lot of scammers are not native english speakers and/or often the message is translated to english from another language using something like Google Translate. But the HR person of a US/western company will always ping you with a templated message which was probably written by a native speaker and/or proof-read (since it's a template re-used 1000s of times). It still may have a typo, but not multiple obvious ones like random capitalization.

2. Email address: when a recruiter emails you, it'll be from their real work email, like john.smith@example.com. This is because HR people know that more personalized pings have higher open and response rates. Companies never send outgoing recruitment emails from an address like info@example.com.

3. Job title: the job title here is "Remote Product Design Manager". In real life it's more likely to be "Product Design Manager" with remote being not capitalized and mentioned elsewhere. Here the "Remote" is part of the bait.

4. Domain name: doesn't match. Domain names are part of a company's identity, so recruiters will definitely use one of the "main" domain names of the company.

5. Recruitment loops usually takes several weeks, rarely less than a month. So being asked to be online at a specific time for updates is unheard of (to me), because recruiters know that they may take anywhere from 1 to 4 weeks to get any sort of feedback.

6. Too good to be true: no serious company will offer you a job based on 1 interview.

7. CIO: why would the CIO of a large 7000+ person company like Splunk talk to a fresh-out-of-school new hire?

8. Apple Watch Series 7: why would a company buy you a watch? (Unless you're working on the watch product.)

9. Send hardware to the company: this rarely happens like this. Companies procure the hardware themselves (they get volume pricing, and usually have their own stock), install corporate software like VPN software, and then give/send it to new employees. This is true for laptops, phones, etc.

10. Linking cards: I don't understand what happened, but companies never ask you to link your personal stuff (whether it's a bank card or your personal gmail) to company stuff. Your personal stuff is like poison to them, they want to keep it away from corporate stuff.

> 5. Recruitment loops usually takes several weeks, rarely less than a month. So being asked to be online at a specific time for updates is unheard of (to me), because recruiters know that they may take anywhere from 1 to 4 weeks to get any sort of feedback.

I'd agree to most of your points, but here is some anecdata:

I went from recruiting message to initial call, CTO interview, team interview, HR call and offer in less than two weeks at a very legit company earlier this year.

Some companies can be quite fast at hiring.

!!! = warning sign.

I agree. The language used by this scammer was extremely unprofessional, and, frankly, very scammy.

Reply on news.ycombinator.com