Job ad or scam? Check when not to provide data in recruitment: PESEL, ID scan, account number, SMS codes and other “verifications”. What is normal in the recruitment process and what should raise a red flag? We are checking.
Job advertisement or fraud: when should you not provide data?
In recruitment, it is normal for the employer to ask for your CV and contact details. However, a warning light should come on when someone asks you for information that is not necessary to evaluate your candidacy, or when the request looks like a pretext for extortion (SMS code, ID scan, “account verification”, etc.). A good rule of thumb: the earlier something strange appears in the recruitment process, the greater the chance that we have come across a fraud.
What data is “standard” in recruitment?
From the point of view of the practice and recommendations of the Personal Data Protection Office, the employer should process at the stage of candidate selection only necessary data to make an employment decision. These include: identification data (e.g. name, surname, date of birth), contact details (e.g. place of residence) and information about education and professional experience.
In practice: CV + phone number/e-mail + reasonable description of experience is the “core”. If the process is serious, the rest usually comes only when the talks are going well.
When is a request for data suspicious?
The most suspicious situations are when someone asks for… confidential data or used to confirm identity in other services at a very early stage – before you receive an offer, before you even verify the company, and sometimes even before the actual conversation.
If someone asks for the following data at the very beginning of the recruitment process, something may be wrong and you should be careful.
- Scan of ID/photos of documents “to verify recruitment” – this is typical material for abuse (identity theft, opening accounts, fraud).
- PESEL “because yes” – the PESEL number is not standard at the stage of collecting the CV itself; if someone wants it right away, watch out!
- Bank details before offer (“account number for withdrawal”, “confirm account”) – the payment makes sense only after establishing cooperation and formalities, not at the beginning.
- Place of residence as a condition for the conversation itself – it is sometimes needed later (documents, contract), but is rarely necessary to evaluate the candidate in the first step.
- SMS codes / authorizations in the application / tokens – this is no longer recruitment, but a classic account takeover scheme.
“Trial days” and recruitment tasks – when are they normal and when do they stink?
The recruiting task may be normal, but it should be proportional and serve to test skills, not to provide the company with ready-made work “for free”.
It becomes suspicious when:
- the task looks like full-value product for use (text for publication, graphics for campaigns, analysis “for the client”, code for implementation),
- you get real client data, a real brief, deadlines “as of yesterday” and the pressure of a commercial order,
- the company avoids a clear answer: is it a test or a job (and what do you get in return).
The Personal Data Protection Office reminds that the employer should not request excessive data and should only act within the scope of the recruitment purpose. If the “test” in practice turns into real work, and there are strange requests for data – this is a set that cannot be underestimated.
What about a “no criminal record” certificate?
This is one of the most common topics because it is sometimes overused. The Personal Data Protection Office indicates that the employer cannot demand data going beyond the legal basis, and information about a clean criminal record may be obtained only when it results directly from the regulations (e.g. for specific professions/positions).
In practice: if the recruitment is for a role where a clean criminal record is not a statutory requirement, and someone wants such documents “just in case” – this is a warning signal.
A simple safety rule
If at the beginning of the recruitment process they ask you for something more than: CV + contact + information about experiencethen stop and ask:
- why do they need this data?
- on what basis and at what stage,
- who is the data controller and how can you verify the company.
If the answers are vague and there is time pressure, it will often be better to give up applying for a given position.
