@RealFakeNews
I'm not sure which is worse: the procedures at the hiring company, or the actions of the attacker.
It's hardly the only kind of employment fraud someone in HR should be prepared for. They're paid to act in the best interests of the company, and they clearly didn't do that. The biggest problem is that things like this usually get swept under the rug, so we don't know how often it occurs, who the attackers are likely to be, or how many employees get hired under fraudulent circumstances. HR is usually a company's most vulnerable department/process.
@Clive Robinson
Like most Internet protocols that started befor 1990/2000 the level of security in them is realisticaly to small to be of any real use.
Nah, the fact that email is involved is a red herring. This was basic social engineering, plain and simple. There's just nothing new out there that does a universal job establishing identity/trust between two random online parties. If there were, we wouldn't have all these 2FA, security questions, and password reset procedures.
@Tatütata
Job recruiting sites with candidates pictures are an invitation to discrimination.
I've had one recruiting agency (Robert Half) insist on doing a video chat before they would even add me to their system. Most places these days just ask for a link to a social media account (that includes sites like LinkedIn and GitHub) where they can mine all sorts of discriminatory info without much fuss.
And some of these "pre-select" candidates before presenting results to customers. How exactly? This is more worrying than the occasional impersonation.
It seems to be based on trivial keyword matching. Even claims of machine learning by places like ZipRecruiter are essentially lies; they say they "find candidates", but I don't know anyone who has been proactively contacted by them. The modern HR process is so unscientific that it's surprising that companies are only as bad as they are these days.
@Theo
It would appear that this was caught by the normal social convention of following up when you don't hear from somebody as expected. (Assuming the employer followed the normal social convention of fixing errors when you learn of them.)
You clearly haven't dealt with the open hiring process in a long time. Companies regularly treat candidates poorly, and are downright unprofessional when that person is determined not to be a fit. This is even true for recruiters, who should realize that they might have a different job you're perfect for next week. Heck, I've even had experiences where I was getting jerked around when I tried to volunteer at a local organization. Don't underestimate how poorly people can behave when the "social convention" is based on their power to rule over a tiny kingdom.
f9f839824cd3e7f437144f97664eff16a09ef94ccd7fc2dfe73872830bf93193