Fake HR Email Requesting Personal Documents Philippines

I. Introduction

A fake HR email requesting personal documents is a common form of phishing, identity theft, recruitment scam, employment fraud, or data-harvesting scheme. In the Philippines, this may happen when a person receives an email, text, chat message, social media message, job-platform message, or online form that appears to come from a company’s Human Resources department but is actually sent by a scammer.

The message may ask the recipient to submit personal documents such as a valid ID, passport, birth certificate, résumé, tax identification number, SSS number, PhilHealth number, Pag-IBIG number, bank account details, specimen signature, selfie with ID, proof of billing, school records, employment certificates, police clearance, NBI clearance, medical records, vaccination records, or digital copies of government-issued documents.

The danger is serious. These documents can be used for identity theft, fake employment contracts, unauthorized loans, bank or e-wallet account opening, SIM registration misuse, online lending fraud, money mule recruitment, credit card applications, social engineering, account takeover, or impersonation. The victim may later discover that their name, IDs, address, or signature were used without consent.

In the Philippine context, this issue involves the Data Privacy Act, Cybercrime Prevention Act, Revised Penal Code, labor recruitment rules, consumer protection, banking and e-wallet risks, and possible employer or platform responsibility. The central principle is clear: a person should not submit sensitive personal documents unless the request is verified, lawful, necessary, and made through a legitimate channel.

II. What Is a Fake HR Email?

A fake HR email is a message falsely claiming to be from a company’s HR department, recruiter, hiring manager, payroll officer, onboarding team, benefits administrator, or employment agency. It may use the company’s name, logo, email signature, job title, website link, or even the name of a real employee.

It may appear in several forms:

1. A fake job offer requiring documents before any interview;
2. A fake onboarding email asking for IDs and bank details;
3. A fake background-check request;
4. A false payroll update request;
5. A fake benefits enrollment request;
6. A fake work-from-home equipment request;
7. A fake pre-employment medical or insurance form;
8. A fake government compliance request for SSS, PhilHealth, Pag-IBIG, or BIR details;
9. A fake request to “verify employment records”;
10. A fake request from someone pretending to be HR of the victim’s actual employer.

The scam may target applicants, employees, former employees, freelancers, contractors, OFWs, fresh graduates, or jobseekers.

III. Why Fake HR Emails Are Dangerous

Fake HR emails are dangerous because employment processes naturally involve sensitive data. Applicants and employees expect to submit documents for hiring, payroll, tax, benefits, identification, background checks, and compliance. Scammers exploit this trust.

The documents requested may contain:

1. Full name;
2. Address;
3. Birthdate;
4. Civil status;
5. Signature;
6. Photo;
7. Government ID numbers;
8. Biometrics or facial image;
9. Family details;
10. Employment history;
11. Educational records;
12. Bank details;
13. Tax details;
14. Health information;
15. Emergency contact information.

Once these are disclosed, the victim may face long-term risks. Unlike a password, a birthdate, signature, address, or government ID number cannot easily be changed.

IV. Common Documents Requested by Fake HR Scammers

Scammers may ask for:

1. Passport;
2. Driver’s license;
3. UMID;
4. PhilSys ID or national ID;
5. PRC ID;
6. Postal ID;
7. Voter’s ID;
8. NBI clearance;
9. Police clearance;
10. Birth certificate;
11. Marriage certificate;
12. Résumé or curriculum vitae;
13. Transcript of records;
14. Diploma;
15. Certificate of employment;
16. BIR Form 1902, 1905, or TIN details;
17. SSS number or E-1/E-4 form;
18. PhilHealth number or MDR;
19. Pag-IBIG number or MDF;
20. Bank account details;
21. E-wallet number;
22. Selfie holding ID;
23. Specimen signature;
24. Proof of billing;
25. Medical certificate;
26. Vaccination card;
27. Barangay clearance;
28. Authorization letter.

Some documents are normal in legitimate hiring. The problem is not that HR requests documents. The problem is when the request is fake, premature, excessive, unsecured, suspicious, or unverifiable.

V. Red Flags of a Fake HR Email

A fake HR email may show one or more red flags:

1. The sender uses a free email address instead of a company domain;
2. The domain is misspelled or slightly altered;
3. The email creates urgency or pressure;
4. The recipient never applied to the company;
5. The email offers a job without interview or assessment;
6. The salary is unusually high for the role;
7. The email asks for IDs before verifying the recruiter;
8. The email requests a selfie with ID;
9. The email asks for bank details too early;
10. The email links to a suspicious form;
11. The email asks for payment, processing fee, training fee, medical fee, or equipment fee;
12. The grammar, formatting, or logo looks suspicious;
13. The sender refuses a video call or official confirmation;
14. The email uses generic greetings like “Dear Applicant”;
15. The job description is vague;
16. The message asks the applicant to communicate only through Telegram, WhatsApp, Viber, Messenger, or personal email;
17. The sender discourages contacting the company directly;
18. The request is inconsistent with the company’s official hiring process;
19. The email asks for OTPs, passwords, PINs, or login credentials;
20. The sender asks to use the applicant’s bank account to receive company funds.

The presence of even one serious red flag should prompt verification before submission.

VI. Legitimate HR Request Versus Fake HR Request

A legitimate HR request usually comes after a traceable hiring process: application, screening, interview, assessment, offer, acceptance, onboarding, and company verification. It normally uses official company email, official HR portals, secure document submission channels, privacy notices, and identifiable contact persons.

A fake HR request often skips normal steps. It may demand sensitive documents immediately, before any interview or written offer. It may use urgency: “Submit within two hours or your application will be cancelled.” It may ask for documents through a public form, personal email, or messaging app.

A legitimate employer should be able to explain:

1. Why each document is needed;
2. When it is needed;
3. How it will be used;
4. Who will access it;
5. How it will be protected;
6. How long it will be retained;
7. Whether submission is required by law, contract, or company policy;
8. What official channel should be used.

If the supposed HR sender cannot answer these questions, the recipient should not submit documents.

VII. Data Privacy Act Issues

Personal documents contain personal information, sensitive personal information, and privileged information. Under Philippine data privacy principles, collection must be lawful, fair, transparent, specific, necessary, proportionate, and secure.

A legitimate employer or recruiter should collect only the information necessary for a lawful employment purpose. It should not collect excessive documents too early. It should provide a privacy notice or explain how the data will be processed. It should use secure channels and limit access.

A fake HR email violates these principles because the collection is deceptive, unauthorized, and without lawful basis. The scammer may be liable for unauthorized processing, unauthorized access, improper disposal or use, identity fraud, and related acts, depending on the facts.

A legitimate company may also have responsibilities if the scam arises from compromised company email, negligent handling of applicant data, weak security, or failure to respond to known impersonation.

VIII. Cybercrime Issues

A fake HR email may involve cybercrime if it uses computer systems, online platforms, fake domains, hacked accounts, phishing links, malware, unauthorized access, computer-related fraud, identity theft, or electronic falsification.

Common cybercrime elements include:

1. Phishing through email or messaging;
2. Fake websites or forms;
3. Use of malware or credential-harvesting links;
4. Unauthorized access to email or cloud drives;
5. Identity theft using submitted documents;
6. Computer-related fraud;
7. Fake electronic documents;
8. Spoofing or impersonation;
9. Account takeover;
10. Use of stolen credentials.

The victim should preserve digital evidence before deleting the message.

IX. Possible Criminal Offenses

Depending on the facts, the scammer may be liable for offenses such as:

1. Estafa or swindling;
2. Attempted estafa;
3. Falsification of documents;
4. Use of falsified documents;
5. Identity theft;
6. Computer-related fraud;
7. Computer-related identity theft;
8. Unauthorized access;
9. Data privacy violations;
10. Illegal recruitment, if the fake job offer involves recruitment without authority;
11. Unlawful use of personal information;
12. Other offenses under special laws.

If the fake HR email asks for money, placement fees, training fees, medical fees, or processing fees, the situation may also involve recruitment fraud or illegal recruitment concerns.

X. Illegal Recruitment Concerns

Some fake HR emails are actually job scams. The supposed employer may promise local or overseas employment and require documents, fees, medical exams, training payments, visa processing payments, or travel deposits.

For overseas jobs, legitimate recruitment must comply with Philippine overseas employment rules and authorized recruitment channels. A person or entity offering overseas employment without authority may expose applicants to illegal recruitment risks.

A fake HR email offering deployment abroad, cruise ship work, hotel jobs, factory work, caregiving, domestic work, or work-from-home international employment should be carefully verified before any document or payment is sent.

XI. Employment Scam Patterns in the Philippines

Common patterns include:

1. Fake local corporate hiring;
2. Fake BPO or work-from-home onboarding;
3. Fake government job openings;
4. Fake overseas job recruitment;
5. Fake cruise ship hiring;
6. Fake online assistant or data entry job;
7. Fake payroll setup asking for bank details;
8. Fake equipment delivery requiring deposit;
9. Fake training program requiring payment;
10. Fake background check collecting IDs;
11. Fake HR using a real company name;
12. Fake recruiter copying LinkedIn profiles of real HR staff;
13. Fake offer letter with company logo;
14. Fake employment contract requiring notarized documents;
15. Fake job portals collecting resumes and IDs.

The victim should remember that a convincing logo or letterhead does not prove legitimacy.

XII. What To Do Before Sending Documents

Before sending personal documents, the recipient should verify:

1. Did I apply to this company?
2. Is the email domain exactly the official company domain?
3. Is the recruiter listed on the company website or official job post?
4. Can I contact the company through its official phone number or website?
5. Is there a formal interview process?
6. Is there a written job offer?
7. Does the company have a privacy notice?
8. Is the document request necessary at this stage?
9. Is the submission channel secure?
10. Are they asking for payment?
11. Are they asking for OTPs, passwords, PINs, or bank login credentials?
12. Are they asking me to receive or transfer money?
13. Are they rushing me?
14. Are there spelling, domain, or formatting irregularities?
15. Can the request be verified independently?

The safest rule is: verify through a separate official channel, not by replying to the suspicious email.

XIII. What To Do If You Already Sent Documents

If documents were already sent to a fake HR email, the victim should act quickly.

1. Preserve Evidence

Do not delete the email. Save:

• Email headers if possible;
• Sender address;
• Subject line;
• Date and time;
• Attachments sent;
• Links clicked;
• Screenshots;
• Chat messages;
• Form URLs;
• Phone numbers;
• Bank or e-wallet details used;
• Proof of payment, if any.

2. Notify the Real Company

If the scammer impersonated a real company, notify the company through its official website, hotline, or verified email. Ask whether the sender is legitimate and request that the company confirm if it is aware of impersonation.

3. Warn Your Bank and E-Wallet Providers

If bank details, IDs, or selfies were submitted, inform your bank and e-wallet providers. Ask them to monitor for account opening, password reset attempts, unauthorized transactions, or suspicious changes.

4. Change Passwords

If the victim clicked a link or entered credentials, change passwords immediately. Use strong unique passwords and enable multi-factor authentication.

5. Monitor Accounts

Watch for unauthorized loans, e-wallet accounts, SIM registrations, bank transactions, credit applications, online shopping accounts, or suspicious messages.

6. Report the Incident

The victim may report to appropriate authorities, especially if money was lost, IDs were used, or the scammer continues contacting them.

7. Execute an Affidavit

An affidavit of incident may help document that the victim did not authorize use of their documents. It may be useful for banks, law enforcement, employers, and government agencies.

8. Replace or Secure Compromised IDs

If the document is highly sensitive, consider whether replacement, annotation, or additional monitoring is necessary. Replacement may not fully eliminate risk, but it helps when a specific ID number, card image, or signature was compromised.

XIV. What If the Victim Clicked a Link?

If the victim clicked a suspicious link, they should:

1. Disconnect from the internet if malware is suspected;
2. Run security scans;
3. Change passwords from a clean device;
4. Enable multi-factor authentication;
5. Check email forwarding rules;
6. Check account recovery email and phone numbers;
7. Review login history;
8. Revoke suspicious app permissions;
9. Contact banks if financial accounts may be affected;
10. Preserve the link and screenshot for reporting.

A phishing link may steal credentials even if no document was uploaded.

XV. What If the Victim Sent a Selfie With ID?

A selfie with ID is especially dangerous because it can be used for identity verification, e-wallet opening, online lending, SIM-related processes, cryptocurrency exchange accounts, and account recovery fraud.

The victim should immediately notify banks, e-wallets, telcos, and financial platforms where they have accounts. They should request enhanced monitoring and note the incident in customer records where possible.

The victim should also be alert for OTP requests. A scammer with ID documents may still need OTPs to complete account takeover or registration.

XVI. What If the Victim Sent Bank Details?

If only an account number was sent, risk exists but may be limited. If the victim sent online banking credentials, debit card details, CVV, PIN, OTP, or mobile banking access, the risk is urgent.

The victim should:

1. Change online banking password;
2. Call the bank immediately;
3. Lock cards if possible;
4. Disable online transactions temporarily if necessary;
5. Review transaction history;
6. Report unauthorized transactions;
7. Replace compromised cards;
8. Monitor for account takeover attempts;
9. Never provide OTPs to anyone.

No legitimate HR department should ask for online banking password, PIN, OTP, CVV, or full card security details.

XVII. What If the Victim Paid a Fee?

If the fake HR email required payment for processing, training, medical exam, background check, equipment, visa, placement, or uniform, the victim should preserve proof of payment and report the receiving account, e-wallet, or remittance details.

The victim should notify the bank or payment provider quickly. Reversal may be difficult, but prompt reporting improves the chance of freezing remaining funds.

The victim may also file a complaint for fraud, cybercrime, or illegal recruitment depending on the facts.

XVIII. Employer Responsibility When Its Name Is Used

A company whose name is used by scammers is not automatically liable for every impersonation. However, it should act responsibly when notified.

The company should:

1. Confirm whether the recruiter is legitimate;
2. Warn applicants and the public if impersonation is ongoing;
3. Report fake domains or accounts;
4. Coordinate with platforms to remove fake posts;
5. Strengthen recruitment verification;
6. Provide official channels for applicants;
7. Investigate whether internal systems were compromised;
8. Notify affected persons if there was a data breach;
9. Comply with data privacy obligations if applicant data was leaked.

If the fake HR email came from a compromised official company email, or if the scam used data that only the company should have had, the company may have deeper responsibilities.

XIX. Recruitment Platform Responsibility

If the fake HR contact came through a job platform, social media site, messaging app, or online marketplace, the victim should report the listing or account. Platforms may remove fake posts, preserve records, suspend accounts, or assist investigations according to their policies and legal obligations.

The victim should take screenshots before the post disappears.

XX. Data Breach Considerations

If a fake HR email appears to use personal information from a prior application, there may be a data breach. Examples:

1. The scammer knows the exact role applied for;
2. The scammer has the applicant’s résumé;
3. The scammer knows interview details;
4. The scammer uses internal HR language;
5. The email comes after a real application;
6. The scammer uses a compromised recruiter account;
7. Multiple applicants receive similar messages.

In such cases, the real company may need to investigate whether applicant data was exposed.

XXI. How to Verify an HR Email

A recipient can verify by:

1. Checking the sender’s domain carefully;
2. Looking up the company’s official website independently;
3. Calling the company’s published number;
4. Messaging the official company page, not the sender’s link;
5. Checking whether the recruiter’s profile is real and consistent;
6. Asking for a company landline or official HR email;
7. Confirming the job posting on the official careers page;
8. Checking whether the email headers show suspicious routing;
9. Avoiding links and manually typing the company website;
10. Asking for a formal interview through official channels.

Do not verify by clicking links provided in the suspicious email.

XXII. Document Protection Techniques

When submitting documents to legitimate HR, the applicant may reduce risk by:

1. Submitting only through official secure channels;
2. Watermarking copies with “For [Company Name] employment application only”;
3. Adding the date of submission;
4. Redacting unnecessary numbers where allowed;
5. Avoiding unnecessary selfie-with-ID submissions;
6. Asking whether physical submission is possible;
7. Keeping a list of documents submitted;
8. Saving the privacy notice;
9. Asking how long documents will be retained;
10. Requesting deletion if application does not proceed, where appropriate.

Watermarking can discourage reuse, though it does not fully prevent fraud.

XXIII. Sample Watermark Text

For ID copies, the applicant may place a visible but non-obstructive watermark such as:

“Submitted only to [Company Name] for employment application, [date]. Not valid for loans, account opening, SIM registration, or other transactions.”

The watermark should not cover security features if the legitimate recipient needs to verify the document. The goal is to reduce misuse while keeping the document readable.

XXIV. Sample Reply to Suspicious HR Email

Subject: Verification of Document Request

Dear [Name],

Before I submit any personal documents, kindly confirm the legitimacy of this request through an official company email address and provide the following:

1. The official job posting or application reference number;
2. The company privacy notice for applicant data;
3. The purpose of each requested document;
4. The secure submission channel;
5. The official company contact person and landline or verified HR email.

For security reasons, I will also verify this request directly through the company’s official website or published contact information.

Thank you.

[Name]

XXV. Sample Notice to the Real Company

Subject: Report of Possible Fake HR Email Using Your Company Name

Dear [Company Name] HR/Compliance Team:

I received an email from [sender email] claiming to represent your HR department and requesting personal documents for employment processing. I would like to verify whether this request is legitimate.

The email asked for [list documents] and provided [link/contact details]. I have attached or included screenshots for your verification.

Please confirm whether this person or email address is authorized to collect applicant documents on your behalf. If this is fraudulent, kindly take appropriate action and advise affected applicants.

Thank you.

[Name]

XXVI. Sample Incident Report or Affidavit Outline

An affidavit or incident report may include:

1. Full name of victim;
2. Date and time the fake HR email was received;
3. Sender email address and display name;
4. Company impersonated;
5. Documents requested;
6. Documents actually submitted, if any;
7. Links clicked or forms filled out;
8. Payments made, if any;
9. Communications with the sender;
10. Discovery that the email was fake;
11. Steps taken to mitigate harm;
12. Statement that any use of the documents beyond the intended verified employment purpose is unauthorized;
13. Attachments, screenshots, and proof.

The affidavit should be truthful, detailed, and supported by evidence.

XXVII. Reporting Options

Depending on the facts, the victim may report to:

1. The real company being impersonated;
2. The job platform or social media platform;
3. The bank or e-wallet provider involved;
4. Law enforcement cybercrime units;
5. Data privacy authorities if personal data misuse or breach is involved;
6. Labor or recruitment authorities if employment or overseas recruitment fraud is involved;
7. The victim’s employer if workplace credentials or employee records are affected.

The correct reporting path depends on whether the incident involves phishing, identity theft, unauthorized transactions, illegal recruitment, data breach, or employment fraud.

XXVIII. Evidence Checklist

Preserve:

1. Original email;
2. Full email headers if possible;
3. Sender address and reply-to address;
4. Links and URLs;
5. Attachments;
6. Screenshots of forms;
7. Chat messages;
8. Job posts;
9. Social media profiles;
10. Phone numbers;
11. Bank or e-wallet receiving details;
12. Payment receipts;
13. Documents submitted;
14. Time and date stamps;
15. Device logs if malware is suspected;
16. Correspondence with the real company;
17. Reports filed with platforms, banks, or authorities.

The more complete the evidence, the easier it is to investigate.

XXIX. Liability of the Victim

A victim is generally not liable merely for being deceived into sending documents. However, the victim may face complications if they knowingly allowed others to use their bank account, submitted false documents, participated in suspicious transactions, or ignored obvious signs of illegal recruitment or money mule activity.

A victim should act promptly once the fraud is discovered. Delay may allow further misuse.

XXX. False Documents Created Using the Victim’s Data

If scammers use the victim’s documents to create fake contracts, bank accounts, loans, e-wallets, SIM registrations, or transactions, the victim should dispute them immediately in writing.

The victim should send notices stating that:

1. The documents were obtained through a fake HR scam;
2. The victim did not authorize the transaction;
3. The victim did not apply for the loan/account/service;
4. The victim requests investigation and blocking;
5. The victim is willing to submit an affidavit and evidence.

Prompt written dispute helps establish non-consent.

XXXI. Special Risk: Online Lending and Harassment

Stolen IDs are sometimes used in online lending schemes. Victims may later receive collection messages for loans they did not take. They should not ignore these messages. Instead, they should dispute the debt in writing, request proof of application, deny authorization, and file complaints where appropriate.

If collectors harass contacts, shame the victim, or misuse personal data, additional legal issues may arise.

XXXII. Special Risk: SIM and E-Wallet Abuse

Personal documents may be used to attempt SIM registration, e-wallet verification, or account recovery. The victim should be alert for unexpected OTPs, account alerts, SIM replacement attempts, or messages that their number is being registered elsewhere.

Never share OTPs. OTPs are often the final step scammers need.

XXXIII. Special Risk: Money Mule Recruitment

Some fake HR scams offer “finance assistant,” “payment processor,” “crypto assistant,” “online cashier,” or “account handler” jobs. The victim is asked to receive money into their own bank or e-wallet account and forward it elsewhere.

This is extremely risky. Even if presented as employment, it may be money laundering or fraud proceeds movement. No legitimate employer should require an employee to use a personal bank account to process company funds.

XXXIV. Employer Best Practices

Employers should protect applicants and employees by:

1. Using official recruitment domains;
2. Publishing verified HR contact channels;
3. Warning against fake recruiters;
4. Avoiding excessive early document collection;
5. Providing privacy notices;
6. Using secure applicant portals;
7. Training HR staff on phishing and data protection;
8. Monitoring fake job posts using the company name;
9. Responding quickly to reports;
10. Reporting fake accounts and domains;
11. Limiting access to applicant data;
12. Implementing breach response procedures.

Good recruitment security protects both the company and applicants.

XXXV. Applicant Best Practices

Applicants should:

1. Verify before submitting documents;
2. Never pay employment processing fees to unverified recruiters;
3. Never send OTPs, passwords, PINs, or banking credentials;
4. Avoid sending selfie-with-ID unless absolutely necessary and verified;
5. Use watermarks on document copies;
6. Keep records of submissions;
7. Use a dedicated email for job applications;
8. Be cautious with remote jobs offering high pay for simple tasks;
9. Check official company career pages;
10. Report fake recruiters promptly.

XXXVI. Employee Best Practices

Employees should be cautious when receiving HR emails that ask for updated records, payroll details, tax forms, or benefit documents. Even existing employees can be targeted.

Employees should verify unusual HR requests through internal channels, especially if the message asks for:

1. Password reset;
2. Payroll bank change;
3. Updated ID;
4. Emergency contact list;
5. Tax documents;
6. Benefits enrollment;
7. Medical information;
8. OTP;
9. Immediate response outside office hours.

Business email compromise often targets employees through fake HR or payroll messages.

XXXVII. What HR Should Never Ask For by Email

A legitimate HR department should generally avoid asking through ordinary unsecured email for:

1. Passwords;
2. OTPs;
3. PINs;
4. Full debit card details;
5. CVV;
6. Online banking credentials;
7. Personal account use for company money transfers;
8. Excessive identity documents without privacy notice;
9. Medical records unrelated to employment;
10. Blank signed forms;
11. Unwatermarked ID copies when safer methods are available.

If such information is requested, the recipient should treat the message as suspicious.

XXXVIII. Practical Legal Assessment

To assess the case, ask:

1. Who sent the email?
2. Was the email domain official?
3. Did the recipient apply to the company?
4. What documents were requested?
5. What documents were sent?
6. Was money paid?
7. Was a link clicked?
8. Was an account created or accessed?
9. Was there identity theft or unauthorized transaction?
10. Was the real company’s system compromised?
11. Did the scammer use confidential applicant information?
12. Were other applicants affected?
13. Has the victim reported to the bank, company, platform, or authorities?
14. Is there continuing harm?

The answers determine whether the matter is primarily a phishing incident, data privacy violation, recruitment scam, cybercrime, fraud case, or employer-security issue.

XXXIX. Conclusion

A fake HR email requesting personal documents is not a harmless message. In the Philippines, it may involve phishing, identity theft, recruitment fraud, cybercrime, data privacy violations, and financial fraud. Because employment processes legitimately require personal documents, scammers exploit the trust applicants and employees place in HR communications.

The safest approach is verification before submission. A recipient should check the sender’s domain, confirm through official company channels, avoid suspicious links, refuse requests for OTPs or passwords, and question any demand for payment or premature submission of sensitive IDs.

If documents were already submitted, the victim should preserve evidence, notify the real company, alert banks and e-wallets, change passwords, monitor accounts, report the incident, and consider an affidavit documenting unauthorized use. Where money was lost, identity was misused, or a fake recruiter continues operating, formal complaints and legal assistance may be necessary.

The controlling rule is clear: personal documents should be released only to a verified recipient, for a lawful and specific purpose, through a secure channel, and with a clear explanation of how the information will be used and protected.