Hacker News Reader

Comment by kstenerud | Hacker News Reader

It's important to become versed in scamming techniques no matter who you are. There are a number of red flags that you would catch:

The email came from info@splunkcareers.us. The first thing to do when receiving such an email is search for the company home page (in this case: splunk.com). If the second and top level domains don't match, you have a scammer. Companies never use addresses outside of their domain.

They asked the person to buy things and then send them somewhere via UPS. This is THE hallmark of a scam.

Next is the linking of a "company" account to your personal card. This NEVER happens.

Finally, asking you to buy things on your personal card and expense them is almost never done before you've actually started work (I say "almost" because some very small 1-2 person startups who don't know any better might do this even though they shouldn't).

View on HN

> Companies never use addresses outside of their domain.

As others already pointed out, this is outright wrong and very bad advise.

Some companies do have their recruitment effort assigned to divisions within the company which do not share the company's institutional domain.

Also, some companies also subcontract their recruitment effort to recruitment companies.

> Companies never use addresses outside of their domain.

    att-mail.com (not att.com)
    vectrenmail.com (not vectren.com)
    discoursemail.com (not discourse.org)
    facebookmail.com (not facebook.com)
    emailbcbsma.com (not bluecrossma.org)
    lyftmail.com (not lyft.com)
    redditmail.com (not reddit.com)

I've twice emailed a complaint (once each) to a bank and a credit card issuer that switched to something like this - and without warning too, my suggestion was they should at least email from bank.co.uk to say that thenceforth mail would come from bankmail.com or whatever it was - they're just teaching people to be over-trusting, and they're the last organisations that should be doing it, makes a mockery of the 'we want you to recognise fraud' spiel they all have in the template.

it's actually a recommended best practice to not send your marketing/comms emails through your main domain, apparently helps with deliverability

It’s in case your marketing domain gets nailed for spamming, you don’t want your regular employees work email blacklisted.

In AT&T's case, it's because @att.com addresses were (are?) given to AT&T residential Internet customers, so they needed a separate domain so it's "clear" if an email is from AT&T itself or from a rando residential AT&T customer.

Definitely linking the card and sending stuff via UPS are glaring red flags.

Ignoring that part, even if they just stick to collecting the background information, SSN, copies of drivers license - that is just good enough information for full-blown ID theft.

Even legitimate companies use varieties of third-parties that help with hiring, background checks, payroll etc. I remember entering data to Workday, some background check provider's site, jobvite, {mycompany}benefits.com etc. the last time I went through hiring process. It's just easy to scam candidates unless they pay close attention to smallest details.

> Companies never use addresses outside of their domain.

Sadly not always true. If they use bulk mailers like MailChimp or SendGrid for newsletters, I've seen links in the mail with the domain $company.newsletters.blah.blah, which are controlled by MailChimp/SendGrid.

Reply on news.ycombinator.com