I. Introduction

A fake HR email asking for an ID is a common form of phishing, identity theft, recruitment scam, employment fraud, and data privacy risk in the Philippines. It usually involves a message pretending to come from a company’s human resources department, recruiter, hiring manager, payroll officer, benefits administrator, government liaison, or outsourced HR provider. The email asks the recipient to submit a valid government ID, selfie, resume, bank details, tax information, SSS, PhilHealth, Pag-IBIG, TIN, birth certificate, proof of address, or other personal data.

The email may look legitimate. It may use the company logo, a real employee’s name, a job posting, a fake offer letter, a forged onboarding form, or a domain name that looks similar to the real company email. The recipient may believe they are applying for a job, completing pre-employment requirements, verifying payroll, updating employee records, or complying with a background check.

In the Philippine context, this conduct may involve identity theft, computer-related fraud, phishing, estafa, illegal access, data privacy violations, falsification, recruitment fraud, and other offenses depending on the facts. It may also expose the victim to future risks such as loan fraud, SIM registration misuse, e-wallet takeover, bank account opening, fake employment contracts, social media impersonation, money mule schemes, and unauthorized use of identity documents.

This article discusses what a fake HR email asking for ID means, the legal issues involved, possible crimes and liabilities, what evidence to preserve, what to do if an ID was already sent, how to report the incident, and how individuals and employers can reduce risk.

II. Nature of a Fake HR Email Asking for ID

A fake HR email is an email that falsely claims to be from a legitimate employer, recruiter, HR department, agency, or company representative. Its purpose may be to obtain personal information, identity documents, money, account access, or trust.

The request for ID may be framed as:

pre-employment verification;
applicant screening;
job offer processing;
background check;
payroll enrollment;
work-from-home equipment release;
company ID issuance;
contract preparation;
government benefits registration;
visa or overseas deployment processing;
training access;
remote onboarding;
urgent HR compliance;
employee record update;
salary account opening;
tax or benefits validation; or
security verification.

The danger is that a government ID contains highly valuable personal information. Once submitted to a scammer, it may be used to impersonate the victim, open accounts, obtain loans, register SIMs, bypass verification checks, or commit fraud against others.

III. Why IDs Are Valuable to Scammers

A valid ID can be used as a building block for identity fraud. Depending on the quality of the copy and the information visible, scammers may use it to:

create fake online accounts;
pass e-wallet verification;
apply for digital loans;
open bank or finance accounts;
register SIM cards;
impersonate the victim to relatives, employers, or clients;
create fake employment or recruitment records;
commit marketplace scams;
receive scam proceeds as a money mule;
access personal accounts through social engineering;
forge documents;
bypass know-your-customer requirements;
create fake company or payroll records;
apply for credit;
harass the victim through threats or extortion;
sell the data to other scammers; or
combine the ID with other leaked information for more serious fraud.

The risk increases if the victim also submitted a selfie holding the ID, specimen signature, bank account details, proof of billing, payslip, SSS number, TIN, PhilHealth number, Pag-IBIG number, birth date, address, phone number, or emergency contact.

IV. Common Forms of Fake HR Email Scams

A. Fake Job Offer

The victim receives an email saying they have been shortlisted, accepted, or selected for a job. The email asks for a government ID to prepare the employment contract.

B. Fake Remote Work Onboarding

The scammer claims the victim will work from home and must submit ID to receive equipment, training access, or payroll credentials.

C. Fake Payroll Verification

The email claims that payroll needs a valid ID, bank details, or e-wallet information to process salary.

D. Fake Benefits Update

The email pretends to update SSS, PhilHealth, Pag-IBIG, HMO, insurance, or tax records.

E. Fake Recruitment Agency

The email claims to be from a recruiter or manpower agency and asks for ID, placement fees, medical fees, uniform fees, training fees, or processing fees.

F. Fake Company Domain

The email address resembles a legitimate company domain but contains slight changes, such as missing letters, extra hyphens, unusual extensions, free email accounts, or lookalike characters.

G. Fake Background Check

The scammer asks the victim to upload ID to a supposed background-check portal or cloud form.

H. Fake Interview Confirmation

The victim is asked to submit ID before an interview, often through a suspicious link or attachment.

I. Fake Government Compliance

The email claims that IDs are needed for DOLE, BIR, SSS, PhilHealth, Pag-IBIG, immigration, or labor compliance.

J. Fake Internal HR Notice

Employees may receive an email pretending to be from their actual company HR, asking them to update ID records through a link. This may be business email compromise or internal phishing.

V. Warning Signs of a Fake HR Email

A fake HR email may show one or more red flags:

sender uses Gmail, Yahoo, Outlook, or another free email for a supposed company HR function;
email domain is misspelled or different from the official company domain;
urgent request for ID before any proper interview;
request for payment, processing fee, reservation fee, or equipment deposit;
poor grammar, unusual formatting, or generic greeting;
job offer without application or interview;
salary offer that is unusually high for the role;
request to click a suspicious link;
request to upload ID to an unknown form or file-sharing site;
request for OTP, password, PIN, or recovery code;
refusal to conduct a video call using official company channels;
no verifiable recruiter profile;
mismatch between company name, website, domain, and signature block;
attachments with unusual file types;
pressure to respond immediately;
request for front and back of ID plus selfie;
request for bank or e-wallet account before a formal employment process;
email copied to suspicious addresses;
email claims confidentiality to prevent verification; or
the supposed HR representative cannot be found through official company channels.

Not every red flag proves a crime, but multiple red flags should trigger verification before submitting any document.

VI. Applicable Philippine Laws

Several laws may apply depending on what the scammer did and what information was obtained.

A. Cybercrime Prevention Act

The Cybercrime Prevention Act may apply because the scheme uses email, online forms, websites, messaging platforms, or computer systems.

Possible cybercrime offenses include:

computer-related identity theft;
computer-related fraud;
illegal access, if an email account or company system was hacked;
data interference, if data was altered or deleted;
system interference, if systems were disrupted;
misuse of devices, if credentials or tools were used;
cyber libel, if defamatory content was involved; and
aiding or abetting cybercrime.

B. Computer-Related Identity Theft

This may apply when a person intentionally obtains, uses, possesses, transfers, or misuses identifying information belonging to another person without right.

A government ID, ID number, name, birth date, address, photo, signature, email address, phone number, and employment details may be identifying information. If the fake HR email was used to collect these details, identity theft may be implicated.

C. Computer-Related Fraud

Computer-related fraud may apply when deception through a computer system causes damage or results in an unlawful benefit. A fake HR email asking for ID may be part of fraud if the scammer uses it to obtain data, money, account access, or other benefit.

D. Estafa

Estafa may apply if the scammer deceives the victim into giving money, documents, property, or value. In a fake HR scheme, estafa may arise if the victim pays processing fees, training fees, placement fees, medical fees, equipment deposits, or other amounts based on false representations.

E. Data Privacy Act

The Data Privacy Act is relevant because the scam involves personal information and possibly sensitive personal information. Unauthorized collection, use, disclosure, storage, or processing of personal data may result in liability.

The victim’s ID contains personal data. If the scammer collected it without lawful basis or used it for fraudulent purposes, privacy violations may be involved. If a legitimate employer negligently exposed applicant or employee data, the employer may also face data protection issues.

F. Revised Penal Code

Other offenses under the Revised Penal Code may apply depending on the facts, such as:

estafa;
falsification of documents;
use of falsified documents;
usurpation of authority or official functions, if pretending to be a public officer;
unjust vexation;
threats or coercion;
libel, if reputational harm is involved;
theft or qualified theft, if account access or funds are taken; and
other fraud-related offenses.

G. Illegal Recruitment and Labor-Related Offenses

If the fake HR email is connected with job placement, recruitment, overseas employment, collection of fees, or promises of deployment, illegal recruitment laws may be relevant. This is especially serious when the scam involves overseas work, placement fees, fake agencies, or unauthorized recruiters.

H. SIM Registration and Financial Account Misuse

If the stolen ID is used to register SIMs, open e-wallets, verify financial accounts, or obtain digital loans, additional laws and regulations may be implicated. The person whose ID was used may need to dispute fraudulent accounts and file reports to avoid being blamed.

I. Anti-Money Laundering Concerns

If the victim’s identity is used to open or verify accounts that receive scam proceeds, the victim may be dragged into money mule or suspicious transaction issues. Prompt reporting helps show that the victim did not authorize the use of the ID.

VII. Who May Be Liable?

Possible liable persons may include:

the sender of the fake HR email;
the person who created the fake email account;
the person who controls the phishing website or form;
the person who receives and uses the ID;
the person who sells the personal data;
the person who opens accounts using the ID;
the person who receives money through the fraud;
accomplices or recruiters who knowingly participate;
money mules who knowingly receive proceeds;
insiders who leaked applicant or employee data;
company employees who negligently mishandle data, in appropriate cases; and
entities that fail to protect personal data when legally responsible.

In many cases, the first visible sender is not the final user of the stolen ID. Investigation may follow the email account, domain registration, payment trail, IP records, phone numbers, uploaded forms, and financial accounts.

VIII. Victim Scenarios

A. Applicant Sent ID but No Money

The victim may still face identity theft risk. The main concern is misuse of personal information.

B. Applicant Sent ID and Selfie

This is more serious because ID selfies may be used for account verification, loan applications, and e-wallet registration.

C. Applicant Sent ID, Bank Details, and Signature

The risk of financial impersonation increases.

D. Applicant Paid a Fee

This may support fraud, estafa, or illegal recruitment claims.

E. Employee Received Fake Internal HR Email

This may indicate phishing, business email compromise, or attempted access to company systems.

F. Company’s Real HR Email Was Hacked

If the email came from a real HR account that was compromised, illegal access and data breach issues may arise. The company may need to investigate and notify affected persons or authorities when required.

G. Applicant Uploaded ID to a Fake Portal

The portal may have collected data from many victims. Evidence should include the URL, screenshots, confirmation emails, and uploaded fields.

H. Victim Later Receives Loan Collection Notices

This may mean the ID was used for fraudulent loans or accounts. The victim should immediately dispute the account and file police, cybercrime, and data privacy reports.

IX. Immediate Steps Before Sending Any ID

Before submitting ID to a supposed HR contact, the recipient should verify the request.

Practical verification steps include:

check the sender’s email domain carefully;
compare with the company’s official website domain;
call the company using an official phone number from its website;
contact the recruiter through LinkedIn or official channels;
ask for a video interview through official company tools;
avoid clicking suspicious links;
check whether the job posting exists on the official careers page;
confirm whether ID is required at that stage;
ask why the ID is needed and how it will be protected;
refuse to provide OTPs, passwords, PINs, or recovery codes;
do not pay fees to get hired;
verify whether the recruiter is licensed, if a recruitment agency is involved;
check if the form is hosted on a legitimate company domain;
avoid sending complete IDs through unsecured email if unnecessary; and
consider watermarking documents when appropriate.

Verification should be done independently, not by replying to the suspicious email.

X. What to Do If You Already Sent Your ID

If the ID was already sent, act quickly.

A. Stop Further Communication

Do not send more documents, money, selfies, OTPs, passwords, bank details, or signatures.

B. Preserve Evidence

Do not delete the email. Preserve headers, sender details, attachments, links, and all communications.

C. Warn the Real Company

If the email used a company’s name, notify the real company’s HR, security, or data protection office. They may issue a warning and confirm whether the email was fake.

D. Report the Email as Phishing

Report it in your email provider and, if applicable, to your employer’s IT or security team.

E. Monitor Financial and Online Accounts

Watch for loan applications, e-wallet verification attempts, SIM registration issues, bank alerts, suspicious calls, password reset messages, or OTP requests.

F. Change Passwords

If you clicked a link or entered credentials, immediately change passwords for email, job portal, banking, e-wallet, and social media accounts. Enable two-factor authentication.

G. Contact Banks and E-Wallets

If bank details or e-wallet information were submitted, notify providers and ask what protective measures are available.

H. File Reports

Consider reporting to PNP Anti-Cybercrime Group, NBI Cybercrime Division, the prosecutor’s office, or the National Privacy Commission depending on the facts.

I. Prepare an Affidavit of Non-Authorization

If the ID may be misused, an affidavit may help document that the victim did not authorize the use of the ID for loans, SIMs, accounts, or transactions.

J. Monitor Credit and Collection Notices

If digital loans or accounts later appear under the victim’s name, dispute them immediately and provide the report and affidavit.

XI. Evidence to Preserve

Evidence should be preserved before links disappear, emails are deleted, or scammers change accounts.

A. Email Evidence

Save:

full email message;
sender address;
reply-to address;
subject line;
date and time received;
full email headers;
attachments;
embedded links;
signature block;
company logo used;
IP or routing information in headers, if available;
screenshots of the email;
exported email file, if possible; and
any follow-up emails.

Full headers are important because the visible sender name may be fake.

B. Link and Website Evidence

If the email contains a link, preserve:

URL;
screenshots of the page;
form fields requested;
company logos used;
domain name;
upload confirmation page;
privacy notice or lack of one;
payment instructions, if any;
downloadable forms;
contact details listed; and
date and time accessed.

Do not continue using a suspicious site if it asks for credentials or downloads files.

C. Documents Sent

Keep copies of what was sent:

front and back of ID;
selfie with ID;
resume;
application form;
transcript;
birth certificate;
proof of address;
bank details;
signature specimen;
SSS, PhilHealth, Pag-IBIG, and TIN details;
certificates;
payslips; and
other attachments.

D. Money Transfer Evidence

If money was paid, preserve:

payment instructions;
bank or e-wallet recipient name;
account number or mobile number;
QR code;
receipt;
transaction reference number;
amount;
date and time;
customer service complaint ticket;
failed reversal request; and
any communication after payment.

E. Communications Outside Email

Scammers may continue through Messenger, Viber, WhatsApp, Telegram, SMS, or phone calls. Preserve all messages, numbers, usernames, call logs, and voice notes where lawfully available.

XII. Importance of Email Headers

Email headers can show technical details that are not visible in the ordinary email view. These may include routing information, originating servers, authentication results, and possible spoofing indicators.

For a legal complaint or IT investigation, full headers may help determine whether:

the sender spoofed a domain;
the email passed or failed authentication checks;
a legitimate account was compromised;
the email came from a suspicious service;
the reply-to address differs from the visible sender;
multiple victims received similar emails; and
the company’s domain was abused.

A layperson does not need to analyze headers alone, but should preserve them.

XIII. Reporting to the Real Company

If a fake HR email uses a company name, report it to the company through official channels.

The report should include:

the fake email address;
screenshots;
full email headers, if available;
links used;
documents requested;
whether ID was submitted;
whether money was requested;
whether payment was made;
job posting or offer details;
names used by the scammer;
phone numbers or messaging accounts; and
request for confirmation that the email is fake.

The company may issue an advisory, report the domain, warn applicants, and investigate whether its brand, employees, or systems were misused.

XIV. Reporting to PNP Anti-Cybercrime Group or NBI Cybercrime Division

A victim may report to cybercrime authorities when the email involves phishing, identity theft, fraud, or unauthorized use of data.

Bring or prepare:

valid government ID;
printed and digital copies of the email;
full email headers;
screenshots of the fake HR email;
URL of the form or website;
copy of documents submitted;
proof of payment, if any;
bank or e-wallet recipient details;
communication logs;
report to the real company;
report to email provider or platform;
chronology of events;
affidavit, if available; and
contact details of witnesses or other victims.

Cybercrime authorities may assist in technical documentation, investigation, and referral for prosecution.

XV. Reporting to the National Privacy Commission

A report to the National Privacy Commission may be considered when the matter involves misuse of personal data, data breach, unauthorized processing, or negligence by a personal information controller.

Possible situations include:

a legitimate company mishandled applicant data;
a company’s HR account was compromised and applicant data was exposed;
an entity collected IDs without proper privacy notice or lawful basis;
personal information was sold, shared, or misused;
many applicants were affected;
sensitive personal information was involved; or
the victim’s data was used for identity fraud.

If the fake HR email was purely from an unknown scammer pretending to be a company, cybercrime reporting may be the first practical step. If a real company or recruiter was involved in mishandling data, privacy remedies become more important.

XVI. Reporting to Banks, E-Wallets, and Loan Apps

If the victim submitted ID and financial details, they should be alert to unauthorized accounts or loans.

If a fraudulent account or loan appears, the victim should:

immediately dispute it in writing;
state that the ID was submitted to a fake HR email;
attach police or cybercrime report if available;
attach affidavit of non-authorization;
ask for account freeze or investigation;
request copies of application documents, subject to rules;
request correction of records;
demand cessation of wrongful collection if the loan is fraudulent;
preserve all collection messages; and
escalate to the proper regulator or authority if ignored.

Victims should not pay a fraudulent loan merely to stop harassment without first disputing it, because payment may be treated as acknowledgment.

XVII. If the ID Is Used for a Loan

A common consequence is receiving calls or messages from lending apps or collectors about a loan the victim never applied for.

The victim should:

ask for the loan account details;
deny authorization in writing;
request investigation;
provide proof of identity theft report;
ask for copies of the alleged application;
preserve collection messages;
do not admit liability;
do not provide more IDs unless verified and necessary;
file a complaint if collection becomes abusive;
report to cybercrime authorities; and
consider data privacy and consumer protection remedies.

If the lender approved a loan based on stolen ID without adequate verification, the lender’s procedures may be questioned.

XVIII. If the ID Is Used for SIM Registration

If the victim suspects that their ID was used to register a SIM, they should report to the relevant telecommunications provider and authorities.

The victim should document:

the fake HR email;
the ID submitted;
date of submission;
suspicious calls or messages;
any number believed to be registered using the ID;
law enforcement report;
affidavit of non-authorization; and
request for investigation and deactivation if appropriate.

Private persons may not easily obtain SIM registration records, but authorities may request them through lawful process.

XIX. If the ID Is Used for an E-Wallet or Bank Account

If the stolen ID was used to open or verify a wallet or account, the victim should notify the financial institution immediately.

The victim should request:

account investigation;
freeze or restriction of fraudulent account, if applicable;
confirmation that the victim did not authorize the account;
protection from being treated as account owner or money mule;
preservation of records;
correction of customer data;
escalation to fraud department; and
written reference number for the report.

Financial institutions may not disclose all details due to privacy and banking laws, but the report creates a record that the victim is disputing unauthorized use.

XX. If the Fake Email Came From a Real Company Address

Sometimes a fake HR email appears to come from an actual company domain because:

the HR account was hacked;
the company email was spoofed;
an employee account was compromised;
an insider misused access;
a third-party recruiter was compromised;
the company’s domain security was weak;
forwarding rules were inserted by attackers;
the email display name was deceptive; or
the victim misread a lookalike domain.

If the email came from a real company address, the company should investigate immediately. It may need to secure accounts, notify affected persons, preserve logs, assess breach obligations, and coordinate with law enforcement.

The victim should still preserve the email headers because they may show whether the email truly came from the company system.

XXI. Employer Responsibilities

Employers and legitimate recruiters should protect applicants and employees from fake HR emails by:

using official domains only;
publishing official recruitment channels;
warning applicants against fake recruiters;
avoiding unnecessary collection of IDs too early;
using secure upload portals;
providing privacy notices;
limiting access to applicant documents;
verifying recruiter identities;
securing HR email accounts;
using multi-factor authentication;
training HR staff on phishing;
monitoring fake job posts;
issuing advisories when scams appear;
reporting impersonation to platforms;
responding to victim reports; and
complying with data protection obligations.

Employers should not casually ask applicants to email sensitive documents without proper safeguards.

XXII. Applicant Rights

Applicants have the right to ask:

why the ID is needed;
whether submission is mandatory;
what specific ID is acceptable;
how the ID will be stored;
who will access it;
how long it will be retained;
whether it will be shared with third parties;
what privacy notice applies;
whether there is a secure upload method;
how to verify the recruiter;
whether the job offer is legitimate; and
how to request deletion if not hired.

A legitimate employer should be able to explain why personal data is being collected and how it will be protected.

XXIII. Should Applicants Send IDs Before Being Hired?

Employers may need ID for legitimate recruitment, background checks, contract preparation, or onboarding. However, applicants should be cautious when asked for sensitive documents too early.

A safer approach is:

verify the company and recruiter first;
submit only the minimum necessary information;
use secure upload channels;
avoid sending unnecessary IDs;
avoid sending selfie-with-ID unless truly required and verified;
watermark copies when appropriate;
obscure unnecessary ID details when acceptable;
ask for a privacy notice;
keep a record of what was submitted; and
never submit OTPs, passwords, or banking credentials.

A request for ID is not automatically suspicious, but it must be verified and proportionate.

XXIV. Watermarking ID Copies

When submitting an ID to a verified recipient, a person may consider placing a watermark on the copy, such as:

“FOR [COMPANY NAME] JOB APPLICATION ONLY – [DATE]”

A watermark can reduce misuse, although some institutions may reject altered copies. The watermark should not cover essential details if the document is legitimately required.

The safest practice is to ask the legitimate recipient what format is acceptable.

XXV. Reducing Data Shared

If a verified employer only needs identity confirmation, the applicant may ask whether certain details may be masked, such as:

ID number;
address;
signature;
QR code or barcode;
birth date;
secondary details;
back side of ID; or
other unnecessary information.

However, some legitimate verification processes require complete copies. The key is to confirm legitimacy first.

XXVI. Links, Attachments, and Malware

A fake HR email may be designed not only to collect IDs but also to infect the device or steal credentials.

Be cautious with:

.exe files;
password-protected archives;
macro-enabled documents;
suspicious PDF links;
fake DocuSign links;
fake Google Forms;
fake Microsoft login pages;
shortened URLs;
QR codes;
attachments requiring password entry;
links asking for email login;
forms asking for OTPs; and
mobile apps to install.

If a suspicious attachment was opened or credentials were entered, the victim should change passwords, enable two-factor authentication, scan devices, and notify IT if using a work device.

XXVII. What If the Victim Clicked a Link but Did Not Submit ID?

There may still be risk if the link led to malware, credential theft, or tracking.

The victim should:

close the website;
avoid downloading files;
change passwords if credentials were entered;
run security scans;
check email forwarding rules;
check logged-in devices;
enable two-factor authentication;
monitor accounts;
report the phishing email; and
preserve evidence.

If no information was submitted and no file was downloaded, risk may be lower, but caution is still appropriate.

XXVIII. What If the Victim Entered Email Password or OTP?

This is urgent. The victim should immediately:

change the email password from a safe device;
log out all sessions;
enable two-factor authentication;
change recovery email and phone if altered;
check forwarding and filter rules;
check sent items and deleted items;
notify contacts if scam emails were sent;
change passwords for accounts linked to the email;
contact bank and e-wallet providers if linked;
preserve evidence; and
report the incident.

An email account can be used to reset passwords for many other services, so securing it is a priority.

XXIX. What If Money Was Paid for a Job?

Payment for a job, training, equipment, medical exam, uniform, placement, or processing should be treated with caution.

If money was paid:

preserve payment receipt;
contact bank or e-wallet immediately;
request freeze or reversal if possible;
report to cybercrime authorities;
report to the real company whose name was used;
report to labor or recruitment authorities if employment or overseas work is involved;
execute an affidavit;
preserve all job offer documents;
warn other applicants; and
do not pay additional amounts.

A legitimate job process should not rely on suspicious payments to personal accounts.

XXX. Recruitment and Overseas Employment Scams

Fake HR emails may be connected with overseas job scams. These are especially dangerous because scammers may collect IDs, passports, medical fees, visa fees, placement fees, training fees, and travel documents.

Warning signs include:

promise of overseas deployment without proper process;
no valid recruitment license;
personal bank account for payment;
urgent demand for visa or processing fee;
fake embassy documents;
fake work permits;
fake job orders;
communication only through email or chat;
refusal to provide official office address;
request for passport and ID copies;
unrealistic salary and benefits;
no interview with employer;
no verifiable contract; and
pressure to keep the offer confidential.

Victims should report suspected illegal recruitment or overseas employment scams to appropriate authorities.

XXXI. Company Impersonation and Brand Abuse

When scammers impersonate a company’s HR department, the company may also be a victim. The scam damages its name and may expose applicants to harm.

The company should:

issue an official warning;
publish legitimate recruitment channels;
report fake domains and emails;
report fake job posts;
coordinate with law enforcement;
help victims verify legitimacy;
preserve reports from victims;
secure its own systems;
investigate possible insider leaks; and
review recruitment data protection controls.

Companies should avoid ignoring reports from applicants because delayed response may allow scams to spread.

XXXII. Possible Complaints and Remedies

Depending on the facts, a victim may pursue:

cybercrime complaint for identity theft or fraud;
estafa complaint if money was paid;
illegal recruitment complaint if job placement or overseas work is involved;
data privacy complaint if personal data was misused or mishandled;
complaint to bank or e-wallet provider;
complaint to email provider or hosting provider;
report to the real company;
civil action for damages if offender is identified;
request for takedown of fake site or email domain;
dispute of fraudulent loans or accounts;
affidavit of non-authorization; and
protective monitoring of accounts.

The correct combination depends on whether only data was taken, money was lost, accounts were opened, or the victim’s identity was later misused.

XXXIII. Complaint-Affidavit Structure

A complaint-affidavit may be organized as follows:

personal circumstances of complainant;
how the email was received;
sender address, subject, and date;
why the email appeared to be from HR;
what the email requested;
what documents or data were submitted;
whether money was paid;
links, forms, and attachments involved;
later discovery that the email was fake;
confirmation from the real company, if any;
harm suffered;
risk of identity theft;
steps taken to secure accounts;
attached screenshots, headers, receipts, and documents;
known respondent details, if any;
request for investigation and prosecution; and
oath.

The affidavit should be specific, chronological, and supported by evidence.

XXXIV. Documents to Attach to a Complaint

Useful attachments include:

printed copy of fake HR email;
full email headers;
screenshots of sender address and message;
suspicious links and forms;
screenshots of upload page;
copies of documents submitted;
proof of money transfer;
customer service reports;
confirmation from real company denying the email;
report to email provider;
report to bank or e-wallet;
report to company HR;
job post or advertisement;
fake offer letter or contract;
chat logs;
call logs;
affidavit of non-authorization;
valid ID of complainant; and
witness statements.

XXXV. Sample Message to Verify with a Company

An applicant may send the real company:

Good day. I received an email claiming to be from your HR/recruitment team regarding a job application and requesting a copy of my government ID. The sender used the email address [insert email]. Before I submit any document, may I confirm whether this email and request are legitimate?

I have attached a screenshot of the email for verification. Thank you.

XXXVI. Sample Warning to Contacts

If the victim believes the ID may be misused, they may post or send:

Please be advised that I may have been targeted by a fake HR/recruitment email that requested my ID. If you receive any message, account, job offer, loan request, or transaction using my name, photo, or ID, please verify with me directly through my known number before responding or sending money. I did not authorize anyone to use my identity for any transaction.

XXXVII. Sample Report to HR of the Real Company

A report may state:

Good day. I am reporting a possible fake HR email using your company name. The email was sent from [email address] on [date] with the subject [subject]. It requested that I submit my government ID for [reason stated].

I am concerned that this may be an impersonation or phishing attempt. Attached are screenshots and the full email details. Please confirm whether this email came from your company and whether there are other official recruitment channels I should use.

If this is fake, kindly consider issuing an advisory to protect other applicants.

XXXVIII. Sample Affidavit of Non-Authorization Points

An affidavit of non-authorization may state that:

the affiant received a fake HR email;
the affiant submitted a copy of ID because of the false representation;
the affiant did not authorize the sender to use the ID for any loan, SIM registration, bank account, e-wallet, contract, employment transaction, or financial transaction;
any account or transaction using the ID after the incident was not authorized unless separately confirmed by the affiant;
the affiant reported the matter to authorities or relevant institutions; and
the affidavit is executed to support reports, disputes, and investigations.

This should be customized and notarized if needed.

XXXIX. Common Mistakes to Avoid

A. Sending ID Before Verification

Always verify the recruiter and company through official channels.

B. Sending Selfie With ID Too Early

A selfie with ID can be used for account verification and loan fraud.

C. Paying “Processing Fees”

Job scams often begin with small fees that increase over time.

D. Deleting the Email

The email is evidence. Preserve it, including full headers.

E. Only Taking Cropped Screenshots

Keep the full email, sender details, links, attachments, and timestamps.

F. Replying Aggressively to the Scammer

This may alert them to delete evidence. Preserve first and report.

G. Ignoring the Risk After No Money Was Lost

Even if no money was paid, the ID may still be misused later.

H. Not Warning the Real Company

The company may need to warn other applicants.

I. Not Monitoring Loan or E-Wallet Activity

Identity misuse may happen days or months later.

J. Publicly Accusing a Suspect Without Proof

Unsupported accusations can create defamation risk.

XL. Practical Checklist Before Submitting ID to HR

Before sending any ID, check:

Did I apply to this company?
Is the sender’s email domain official?
Does the job exist on the official careers page?
Is the recruiter verifiable?
Is the request appropriate at this stage?
Is the upload link on an official domain?
Is there a privacy notice?
Are they asking for unnecessary details?
Are they asking for money?
Are they asking for OTP, password, or PIN?
Can I verify through official phone or website?
Can I watermark the ID?
Can I submit a less sensitive document first?
Do I have a record of what I submitted?
Am I being pressured to act immediately?

If several answers are suspicious, do not send the ID.

XLI. Practical Checklist After Sending ID to Fake HR

After sending ID, do the following:

stop sending more information;
save the email and full headers;
screenshot all messages;
save links and forms;
record what documents were sent;
notify the real company;
report the email as phishing;
change passwords if any link was clicked;
enable two-factor authentication;
monitor bank, e-wallet, and loan activity;
contact financial institutions if bank data was shared;
file a cybercrime report if there is fraud or identity theft risk;
prepare an affidavit of non-authorization;
dispute any unauthorized account or loan immediately;
warn contacts if identity misuse is likely; and
keep all reports and reference numbers.

XLII. Practical Checklist for Employers

Employers should:

use official recruitment email addresses;
warn applicants against unofficial emails;
publish verified recruitment channels;
avoid collecting IDs too early;
use secure portals for sensitive documents;
provide a clear privacy notice;
limit access to applicant documents;
implement retention and deletion policies;
secure HR accounts with multi-factor authentication;
monitor fake job posts and fake domains;
train HR staff on phishing and impersonation;
respond to applicant verification requests;
report impersonation scams;
coordinate with law enforcement when needed;
notify affected persons if company systems are compromised; and
document all incident response actions.

XLIII. Frequently Asked Questions

1. I sent my ID to a fake HR email. What should I do first?

Stop communicating, preserve the email and headers, notify the real company, secure your accounts, monitor for unauthorized loans or accounts, and consider filing a cybercrime report.

2. Is it illegal for fake HR to ask for my ID?

If the request is made through deception to obtain identifying information, money, or access, it may involve identity theft, computer-related fraud, estafa, data privacy violations, or other offenses.

3. Can a scammer use my ID for loans?

Yes. Stolen IDs may be used for loan applications, e-wallet verification, SIM registration, or other fraudulent accounts, especially if accompanied by a selfie, signature, and personal details.

4. Should I change my ID?

Most government IDs cannot be casually changed just because a copy was exposed. But you should report the incident, monitor misuse, and dispute unauthorized accounts or transactions immediately.

5. Should I report even if no money was lost?

Yes, especially if you submitted a government ID or selfie. A report helps create a record in case your identity is later misused.

6. Can I ask the company if the recruiter is real?

Yes. Use official contact details from the company website or verified pages, not the contact details in the suspicious email.

7. What if the email used a real company logo?

A logo does not prove legitimacy. Scammers can copy logos from the internet.

8. What if the email came from a Gmail address?

Some small businesses use free email accounts, but a major company or formal HR department usually uses an official domain. Treat free-email HR requests for IDs with caution and verify independently.

9. What if I clicked the link but did not submit anything?

Risk may be lower, but you should still avoid further interaction, run security checks, and change passwords if you entered any credentials.

10. What if I entered my email password?

Change it immediately from a safe device, log out all sessions, enable two-factor authentication, check forwarding rules, and change passwords for accounts linked to that email.

11. Can I recover money paid to fake HR?

Possibly, if reported quickly to the bank or e-wallet before cash-out. Recovery becomes harder once funds are withdrawn or transferred.

12. Can the fake HR be traced?

Possibly. Investigators may trace email headers, domains, IP logs, payment accounts, phone numbers, hosting records, and platform data through lawful process.

13. Should I post the scammer’s email publicly?

A factual warning may help others, but avoid unsupported accusations against a specific person. Share enough information to warn others without exposing your own ID or private data.

14. Can I file a case if the sender is unknown?

Yes, you may file a report or complaint for investigation. Authorities may need to identify the person behind the email before prosecution.

15. Is this a data privacy case or a cybercrime case?

It can be both. If a scammer used email to steal ID, cybercrime and fraud issues are central. If personal data was mishandled by a real company or unauthorized processing occurred, data privacy remedies may also apply.

XLIV. Conclusion

A fake HR email asking for ID is not a harmless recruitment message. In the Philippines, it may be part of phishing, identity theft, computer-related fraud, estafa, illegal recruitment, data privacy violations, or financial account misuse. The risk continues even after the email exchange ends because a stolen ID can be used later for loans, e-wallets, SIM registration, impersonation, and other fraudulent transactions.

The safest approach is verification before submission. Applicants and employees should confirm the recruiter, email domain, job posting, upload link, and purpose of collection through official channels. They should never send OTPs, passwords, PINs, or payments to supposed HR contacts.

If an ID has already been sent, the victim should preserve evidence, report the fake email, notify the real company, secure accounts, monitor for misuse, and consider filing reports with cybercrime authorities, financial institutions, and data privacy regulators where appropriate. If money was paid or accounts were opened using the ID, the victim should act immediately to dispute the transaction and create a formal record of non-authorization.

In fake HR identity scams, speed and documentation matter. The faster the victim preserves evidence, reports the incident, and prevents further misuse, the better the chance of limiting damage and supporting future legal action.