Employment verification request — real inquiry or scam?

Default: employment verification should go through HR or an official vendor, not through you. Your job is to verify who’s asking and share the minimum via an official channel.

Routes A/B/C (start here) What you can safely share High risk: asks for ID/bank/login

Stop. Answer this first

Fail-fast classification

  • Who is requesting verification? (prospective employer / landlord / lender / background-check vendor / unknown)
  • Are they asking you or your employer? (default: it should go through HR/vendor, not you)
  • How did it arrive? (portal request / official-domain email / phone call / personal email)
  • What exact data are they asking for? (dates/title/status only vs pay/SSN/ID/bank)
  • Do you have a known official channel? (HR portal, HR email on company domain, switchboard)

If you can’t independently confirm the requester and the channel, treat it as Route C and stop sharing.

Routes A/B/C

Hard rules

  • Don’t click verification links in emails until you’ve verified the requester independently.
  • Never send ID, SSN, bank details, or login codes as “employment verification.”
  • If it’s screening/background check: route it through the official vendor/HR process (not email attachments).

What to capture (20 seconds)

  • Requester name + company + email domain + phone number
  • What they claim they need (one line)
  • Exactly what data they request (copy/paste)

Route A — official request via known HR/vendor channel (likely legitimate; still share the minimum)

  • Verify the channel (HR portal + internal directory/known HR contact; don’t trust “just an email”).
  • If they need consent/authorization: use the official portal/vendor flow — don’t email documents.
  • Share only required fields (dates employed, title, employment status) unless you explicitly consent to more.
  • Use the employer’s process (HR handles verification; you don’t “self-verify” pay).

Route B — “maybe real” but unclear / you’re being asked directly (convert to official channel)

  • Don’t answer from the thread. Ask for their official verification method (HR email, portal, vendor).
  • Ask for a phone number listed on their official website and call that (not the number in the email signature).
  • Offer a safe alternative: “Please contact my HR at [official HR address] / use [vendor portal].”
  • If they insist you must provide documents/pay info → stop and treat as high risk.

Route C — high risk (oversharing / identity / payroll diversion) (default: treat as scam until proven otherwise)

  • Default: treat as scam until verified.
  • Never upload ID, SSN, or bank details as “verification.”
  • Never sign via a link from the email thread. Only sign after you open the official HR/vendor portal manually.
  • If it mentions “payroll”, “direct deposit”, “W-2”, “SSN”, “fee”, or urgency → stop.
  • If it asks for payroll/bank changes → go to Payroll email: scam or real?

Most losses here come from one mistake: replying directly and attaching documents. Convert the request into an official HR/vendor path.

Safe sharing rules (minimum disclosure)

Safe basics (usually enough)

  • Employment status (currently employed / former employee)
  • Employment dates (start/end)
  • Job title / department
  • Employer name (if needed)
  • Work location (optional)
  • Employment type (full-time/part-time/contract) — if required

Sensitive data (only with explicit consent + official channel)

  • Salary/pay rate, paystubs, tax forms
  • Government ID, SSN, bank details
  • Login codes / OTPs

If anyone asks for the above by email attachment or “quick form” link, assume Route C.

Reply templates (copy-ready)

Template 1 — redirect to official HR channel 
Hi,

For employment verification, please use our official HR channel:
[HR email on company domain / HR portal / verification vendor].

I’m not able to provide documents or sensitive information directly by email.

Thanks,
[Your name]
Template 2 — request validation of the requester (no-links stance) 
Hi,

Before I respond, please share:
1) Your company name and official website domain
2) A phone number listed on your official website (I will call that number to confirm)
3) Exactly which fields you need verified (dates/title/status only, etc.)

Until I confirm via that phone number, I won’t open any links or provide any data.

Thanks,
[Your name]
Template 3 — “Background check” handoff (NO links/paths) 
Hi,

If this is a screening/background check, please route it through the official HR or vendor process.
I will not upload ID or sensitive information via email links or attachments.

If needed, please confirm the official HR contact email on your company domain or the vendor name and the official verification method.

Thanks,
[Your name]

Red flags (stop signals)

  • They want ID/SSN/bank details as “verification.”
  • They want you to reply with paystub/ID to an email address.
  • Email-only process with “urgent” links or attachments.
  • Lookalike domains (extra characters, odd TLDs).
  • Fees (“pay to process verification”).
  • They refuse the official channel (HR portal, switchboard, known vendor).

Hard rule

If they refuse an official-channel verification path and still push for documents → treat as scam and stop.

FAQ

Is an employment verification request the same as a background check?

No. Verification is often just dates/title/status. Background checks usually include consent/authorization and a vendor workflow.

What’s the safest default response?

Redirect them to your employer’s official HR/vendor channel and refuse to send documents directly by email.

Should I send my paystubs to “prove employment”?

Only if you explicitly agree and it’s through an official secure channel. Email attachments are a common failure mode.

Can I “verify myself” if they asked me directly?

You can share basics (dates/title/status). For anything beyond that, route through HR/vendor.

How do I verify the requester safely?

Use independent confirmation: phone number from their official website, known vendor portal, or HR guidance. Don’t trust the email signature.

What if it’s my future employer and they insist I must respond personally?

Still route it through HR/vendor. You can respond personally to confirm your HR contact email on your company domain and ask them to use that official path.

What info is usually safe to share?

Employment status, dates, job title/department, and employer name (if needed). Keep it minimal.

What info is high risk?

ID/SSN, bank details, paystubs/tax forms, and any login codes. Those should never be requested “for verification” via email.

What if they ask for consent/authorization forms?

Legitimate flows exist — but use the official portal/vendor process. Don’t email completed forms or IDs from a random thread.

What are the biggest scam tells?

“Reply with documents,” urgency, fees, lookalike domains, and refusal to use official channels.

What if they say “we can only do this by email”?

That’s a red flag. Official verification has an HR mailbox, vendor process, or verifiable phone confirmation route.

What should I do if I already sent something sensitive?

Stop the thread, contact your HR/security team, and if bank/payroll data was involved, secure your accounts and monitor for changes immediately.

External security references

These are general safety references. For verification specifics, follow your employer’s HR/vendor process.

ClearExplained — simple pages that remove panic and reduce mistakes.