Home › Guides

Asked for your ID, Social Security number or a verification code “for onboarding”? What employers really need, and when

Published October 28, 2026 · Example messages are made up.

Some job scams never ask you for a cent. What they want is you: a photo of your driver's license or passport, your Social Security or National Insurance number, a selfie holding your ID, your bank details, or the code that just arrived by text. With that, someone can pass as you. The tricky part is that a real employer will also ask for some of these things, eventually. This guide is about telling the two apart: what is needed, when, and what you should never hand over.

Why your documents are worth more than a fake fee

A fake “training fee” gets a scammer a few hundred dollars once. A photo ID, a Social Security number and a bank account, put together, can be used to open accounts, apply for credit or file paperwork in your name, sometimes long after the fake job has vanished. That is why the Federal Trade Commission's page on job scams (last updated March 2023) warns that if you gave personal information to a fake employer, thinking it was for payroll, you may now have an identity theft problem.

These requests often come dressed up as normal onboarding. A “recruiter” you have never spoken to by phone says you are hired and just needs your details “to set up payroll”. Because the request sounds administrative, it does not trigger the same alarm as being asked for money.

What a real employer needs, and at what stage

Legitimate hiring follows an order. Identity documents come at the end, not the beginning.

When you apply

Your résumé and a way to reach you. Sometimes a cover letter, or proof of a license the job specifically requires. Not a photo of your ID, not your Social Security or National Insurance number, not your bank account.

During interviews

Questions about your experience and skills. An interview is for assessing you as a candidate, not for collecting your full personal details.

After you accept an offer

This is where documents legitimately come in, and both the US and the UK have clear rules about it.

• In the US, employers verify that you can work using Form I-9. According to the USCIS Handbook for Employers (reviewed April 2, 2025), you complete your section no later than your first day of work, and an employer may not ask someone who has not accepted a job offer to fill it in. The same page says providing your Social Security number on the form is voluntary unless the employer uses E-Verify. The handbook section on employer review (updated July 15, 2025) adds that you choose which acceptable documents to present from the official lists; the employer cannot specify which ones.
• In the UK, employers must check your right to work before you start. GOV.UK describes doing this by looking at your original documents with you present, or online with a share code you generate yourself, or through an identity service provider. None of these involves texting photos of your passport to a stranger on WhatsApp.

Bank details for payroll and your tax number are also normal at this stage, given to an employer you have verified, through its HR system or official email, after a written offer.

What no employer ever needs

• Codes sent to your phone or email. One-time passcodes and verification codes exist to prove that you are you. Whoever gets the code from you can act as you. The FTC's advice is never to give your verification code to anyone. The WhatsApp version of this trick is covered in the guide on fake recruiters who send files, apps and links.
• Logins for your government or bank accounts, such as Login.gov, GOV.UK One Login or your online banking. No employer needs to sign in as you to hire you.
• PINs, card numbers or security codes. Payroll pays money into your account. It never needs your card.
• A selfie holding your ID, or a video of your face “to verify your profile”, sent to a person in a chat. That is exactly what is used to pass identity checks at banks and apps in your name.
• Opening a new bank account, card or crypto wallet following their instructions. If other people's money then flows through it, you are the one it traces back to. See the guide on jobs that ask you to receive and forward money or packages.

Common versions, and how to spot them

The “quick application” selfie

Hi! To confirm your application for the event staff role, please send a selfie holding your driver's license, a photo of the front and back, and your SSN for payroll. We'll get back to you today!

No interview, no offer letter, no company you can check, but everything needed to identify you. That combination is the tell: ID plus selfie plus hurry.

“We'll register you in our system”

To finish onboarding we need to add you to our portal. You'll get a 6-digit code by text. Send it here within 10 minutes or the process will expire.

A company that registers you somewhere uses the details you gave it. It does not need codes that land on your phone. The code is the key that confirms an action as if you had done it.

“Sign the contract with this code”

E-signing a contract is real, and sometimes involves a code sent to you. The difference is where you type it: on an official page you opened yourself, from the e-signature service or the employer's own site. Never in a chat and never on a link from someone you cannot verify. If someone asks you to tell them the code, stop.

The fake check plus your bank details

They ask for your bank details “for direct deposit”, then send a check for equipment and ask you to forward part of it. The FTC page on job scams explains that the check will bounce and the bank can make you repay it, while the scammer keeps what you sent.

How to hand over documents safely when the request is real

1. Verify the company and the person contacting you first, using the steps in how to verify a company before a job interview.
2. Wait for a written offer naming the company, the role and the terms. Before that, documents are not needed.
3. Use the company's own channels: HR, an email address on the company domain, or an onboarding portal you reach from the official website. Not an unknown number on WhatsApp or Telegram. See recruiter on WhatsApp or Telegram.
4. Send only what the job needs. Selfies and verification codes are never on that list.
5. If they also want money for training, background checks or equipment, that is another clear sign: read asked to pay before you start a job?.

If you already sent documents, codes or logins

1. Stop the conversation and send nothing more, even if they say there is “just one last step”.
2. If you shared a login or a code, change that password right away from the official site or app, turn on two-factor authentication, and check the account for changes you did not make, such as a new phone number, email or bank account.
3. Call your bank if you shared bank details together with a code, or any card details, and ask them to watch for or block suspicious activity.
4. In the US, go to IdentityTheft.gov, the FTC's site, which gives you a personal recovery plan depending on what was exposed, and check your credit reports for accounts you do not recognize.
5. In the UK, consider Cifas protective registration, which adds extra checks when someone applies for credit in your name, and check your credit file.
6. Keep the evidence: chats, numbers, usernames, and a list of exactly which documents you sent. It helps if you later need to dispute something done in your name.
7. Report it. In the US, file a report with the Federal Trade Commission at ReportFraud.ftc.gov, and with the FBI's Internet Crime Complaint Center at ic3.gov if the scam happened online or involved crypto. In the UK, report it to Report Fraud, the national service that replaced Action Fraud, at reportfraud.police.uk (England, Wales and Northern Ireland; in Scotland, call Police Scotland on 101).

If the job ad that started it all is still online, run it through the job scam checker: asking for ID before any interview is one of the signals that often shows up in the text itself.