[iamahunter]

I want to share an experience and thoughts on it.

Recently, I received a call from a consulting firm for an "opportunity".

The opportunity was for a company near to my place and I was happy to receive the call. The person on the other side asked some general initial questions about my experience and stuff. Later, he requested my PAN and Aadhaar number to update in the company profile.

Somehow instincts kicked in and I got a little suspicious, so I asked him to read out the exact role described by the company and here the person fumbled. I understand that non-technical people do fumble while going thru the technology names, but this was a different type of fumbling, as if he did not have any description. So I insisted on emailing the Company Information, exact location, JD and the requisition ID.
At the same time that person kept on asking for my PAN and Aadhaar details for profile creation. On insisting that I shall only confirm the same on email and not on call he agreed to send an email with the information. It has been 4 days and I am yet to receive any email from that consulting firm.


In the recent times there has been bulk hiring and equal quitting of jobs in India.

As a part of the hiring process, a candidate not just shares his/her resume but also other critical information. Documents which are linked to financial and personal assets, such as your PAN, Aadhar, Form 16, bank statements(at times), mobile number and primary and alternate email ids, etc.

Many times all this infortmaion is asked over the call itself on some or the other pretext and one never receives any confirmation email.

The worse being all the documents now a days are scanned/originally downloaded copies from the website (Aadhar card). Unlike earlier, when a copy was submitted to the company and original was required only for verification. That too was a hard paper which could be shredded later. The softcopies stay there forever.

A candidate looking out for opportunities would easily give out such information without second thoughts. All that the caller on the other side needs to say "Hello, I am calling from xyz firm and we have an opportunity, would you be interested?".

How many of us do a serious research on those consulting firms before giving out the information?

After the "just saved" kind off incident with me, I am glad that I did not give out the information. May be it was not all that serious, may be it was, but who knows.

[gischethans]

You did the right thing by asking the person to send an email. An email would allow us to check a few more things like the originating domain, professional language etc. Consultants (even seemingly genuine ones) who approach on LinkedIn keep following up until we share resumes but go missing without a trace once it is shared. Wonder if they get paid for the number of resumes submitted.

As you rightly stated, people eager to land a new opportunity would have given out all the information in one shot. Identity theft is a real possibility with the kind of documents being sought.

[mtnrajdeep]

Why would a consulting org require PAN and Aadhaar numbers for job opening updates? I have never been requested for these and I have only given these to the HR after joining the org, never before.

We should never provide these details which are not relevant for the position till the time we join the organization.

[for_cars1]

Originally Posted by iamahunter

..May be it was not all that serious, may be it was, but who knows.

Once the profile is out on career websites, it is often picked up by unscrupulus/fake job agencies who generally call and ask for a payment in the name of "paid/premium" services. Some of them while on the call to the extent of asking the person to open their website and guiding them to make the payment. A common modus-operendi and have experienced it personally and there are numerous such reports online.

[TrackDay]

Don't remember the sites now, but sometime back I did come across job/consultancy webpages where they asked for Aadhar and PAN number along with a host of other documents. This was during a job hunting phase and I did find it weird back then.

[Everlearner]

No documents are required for hiring process except your resume. Especially financial documents like pan, adhar or pay slips. These are required only during the onboarding process once selected.

[am1m]

Great topic, very relevant. I would never share my PAN or Aadhaar details with a consultant or third-party recruiter. But I'm also very worried about the agencies that companies contract to carry out background verification after we have joined the company. What is the guarantee that the agency is taking the required information security measures with our data? None at all.

Frankly, I don't see why even the company needs one's Aadhaar details? Any sort of government ID proof should be sufficient, right?

[VW2010]

Frankly, I don't see why even the company needs one's Aadhaar details? Any sort of government ID proof should be sufficient, right?

Companies do not need it but they are also forced into getting this detail for PF reasons. PF-Aadhar seeding is mandatory and unless the individual can do it on their own it forces the companies to seed it for the employees as there is a huge fine levied on companies for not paying PF. This is something that is debated even today by big companies. In the end, employees also feel it is easier to share this data and get the formalities going. In reality, if an employee can seed their own PF with Aadhar, they can deny sharing Aadhar with any employer.

We are scared to lose a good offer and end up complying with whatever is imposed. Ask a question and most probably the HR will avoid pushing you further for personal information. We, in general, do not ask the question, and 100% of the time when you ask the right question you can push the companies back to collect this information. HR plays a huge role and unfortunately, most HR's do not even push back management when it comes to labor law and stand up for what is the right thing to do.

[sunnsood]

Pre offer release process: at times I have seen companies asking for pan card, aadhar card and even passport in some cases. Initially I use to share it but now with more experience, I know these are just data hoarders looking to sell your details for laon and card processing.

Post offer release process: here I have seen all kinds of documents being asked for which I find is reasonable. As mentioned earlier, Pan card must be linked to Aadhar either by employees or companies would do it on their own. Also for UAN account number, they need the aadhar card details.

[DevilzzzzOwn]

I have made it a rule of thumb.

If anyone as much as utters the words PAN and/or Aadhaar on a phone call, I ask him/her to send the request through the official email. Unless that is given, I do not utter even the first alphabet or number of either, even though they sometimes have it and need the prospect to say it.

True that our information is everywhere, what with Telecom companies and banks selling our info to their "third parties for business enhancement", but I don't believe in making the jobs of scammers/fraudsters any easier.
Infact, even when I need to send a virtual copy of any of my documents, I watermark them at all the critical places. Of course anyone with great photoshop skills can still remove it, they might be discouraged by the amount of effort required.

And this situation is set to get worse, what with C19 effecting jobs (especially the BPO types) and easy access to internet and phones and more gullible prospects. Unless strictest DPA is brought in, we can forget having a whiff of data protection.

[Lalvaz]

Originally Posted by iamahunter

he requested my PAN and Aadhaar number to update in the company profile.

Somehow instincts kicked in and I got a little suspicious...

After the "just saved" kind off incident with me, I am glad that I did not give out the information. May be it was not all that serious, may be it was, but who knows.

Great catch. Your instincts were spot on in detecting a potential phishing scam.

The absence of a privacy law in our country, coupled with the already overburdened and ineffective legal system means that our personal data is up for use by any and everyone.

I've seen so many cases where the PAN & AADHAR details are misused to avail of a loan, and the unsuspecting victim doesn't even come to know of it, until he applies for a loan and finds a low credit score.

Hope more people are vigilant like you in safeguarding their personal data. See so many people being callous thinking that its absolutely fine to share their PAN and AADHAR with anyone for a new sim card, loan, credit card etc, without even verifying what happens to it post that. Companies are equally guilty of asking for way more info than they legitimately require to provide the services.

[am1m]

Thinking about it a bit more, it come down to categories:

1. Governments, law-enforcement agencies: There is no privacy as far as these are concerned. If entities at this level want your data they will get it. Period. Now some may say there's nothing wrong with that, perhaps, but that is a whole other discussion.

2. Facebook, Google, Telecom companies, big tech: Again, if they want your data, they will get it/they already have it - you gave it to them and give it to them everyday, every hour that you spend on their platforms.

The only 'protection' from these is that most of us aren't important enough for them to want our individual, specific data. Apart from using it to analyze it for broad trends/targeted advertising.

3. Companies, banks, associations, professional services: They have a lot of our data, often collect more than what is required. By far, most will remain harmless, but varying systems, vendors means there is certainly a potential for leaks. This is one area we can exercise some control, ask why, is this document also strictly necessary, can I remove/mask some unnecessary bits, send a low resolution/black and white image instead? Basic steps like that.

4. Low-level scammers, fraudsters: Here we can exercise complete control, refuse to entertain calls, don't give out any information. Block numbers, spam mails. The issue often is that entities in category 3 sell your information to aggregators in category 4.


Overall, from an ideological standpoint data privacy is certainly a myth. But I think we can get a bit more aware and at least try to make things difficult for the category 4 scammers. Category 3 is a grey area. But it's worth it to at least make the effort, at the risk of coming across as "that guy" in the eyes of HR. Hopefully companies will also realize the potential for leaks and stop demanding each and every detail.

[neerajku]

Usually Aadhar and Pan are required at the time of joining and not for interview. But yes recruiters do seek confirmation on their availability else post joining there are numerous problems linked to remittance of Provident fund. One should be careful with such requests.

[som9729]

Originally Posted by am1m

Great topic, very relevant. I would never share my PAN or Aadhaar details with a consultant or third-party recruiter. But I'm also very worried about the agencies that companies contract to carry out background verification after we have joined the company. What is the guarantee that the agency is taking the required information security measures with our data? None at all.

Frankly, I don't see why even the company needs one's Aadhaar details? Any sort of government ID proof should be sufficient, right?

I used to closely work with the head of HR for a start-up.
Bear in mind, that there aren't serious laws around data protection /privacy in India.

Although our HR head would do her best, actually the only "protection" was a contract with the background verification agency, stating that they'll ensure employee data is handled as per "highest standards", which are conveniently undefined, and, said agency refuses work if we ask them to define it.

Also bear in mind, any mobile SIM dabba-walla has access to tons of KYC aadhar nos.

Like X-Files, the Truth (read: your aadhar no/bio etc) is "already out there".

The only control in your hand is to ensure you don't give out OTPs etc to unknown persons. That's all you can really do.

Example - a year back, someone attempted my aadhar authentication and failed.
Last week, someone attempted to open my flipkart account at 1:30 am.
FK sent me an OTP asking if it was me, which I only saw in the morning.

[Cyborg]

Originally Posted by iamahunter

The person on the other side asked some general initial questions about my experience and stuff. Later, he requested my PAN and Aadhaar number to update in the company profile.

Thanks for sharing iamahunter. You did the right thing by not giving out your details. Never heard of a headhunter or company asking for PAN and/or Aadhar details even before a preliminary meeting. Definitely something shady, you saved yourself trouble for sure.

In any case, if these details need to be given, it should never be over the phone. It’s always prudent to take a copy of the document or digitally write the date and only for “whatever the purpose may be” on the body of Pan or Aadhar card/in the middle. This will reasonably ensure the document will not be used for some other purpose.

Cheers