I received an email, purportedly from WI state Department of Health Services, where I’ve interviewed for several jobs recently. The subject line said “Operations Program Associate” which is a specific job title I’ve applied for.
The message was:
This led me to what an image of a postcard, with a legit WI state logo on it,
labeled “Cisco Registered Envelop Service”. It asked me to create an account where I gave my first and last name, created a password, selected a security question from a list and answered the question. That’s it – nothing else was asked.
Then it told me I would need to follow more instructions when I received an “activation email”. I haven’t received one. Even after going back to the page and requesting it be sent again, I haven’t received it. And of course I checked my spam box too.
That set off all kinds of alarms for me. I got hold of someone in their HR department who says that no one by the name on the original email is listed in their staff directory.
But, I went to the Cisco website and they DO in fact have a service called “Cisco Registered Envelop Service”.
One other thing – there is in fact a real person with the same name as the sender (not a common one) living locally, and only one other person by that name in all of America, according to the phone lookup service I used.
So WTF is going on? Who would know I’m applying for work there? And what job I’ve applied for? Why all these hoops for essentially useless information? If they just wanted to be sure I had an active email address – shit – I would have just replied directly to an email with the specifics they had.
FYI, I used the contact info on the Cisco site to give them details, and the specific links I was led to, and asked if I’ve been scammed. I’m guessing it’s maybe 50/50 whether I’ll get a response from them.
However, here’s how this could work if it were a phishing scheme: many people use the same password at many different sites. So, a phisher might send a link for you to create a “userid” and “password”, hoping you use the same password as your email address. Bingo bango bongo.
Turns out it’s legit. Bizarre, and absolutely no reason for any of it to be encrypted, though. The “activation email” didn’t show up for hours, though the notice pretty much said it would show up in my in box within seconds of creating my account.
Turns out it was details of time and location for an interview that has already taken place. And this person must be brand new, not someone who’s already left, because it was sent today.
I have received hundreds of invitations to interview by state agencies through email, replied to and scheduled them and got confirmations back, and no one (myself included) thought it necessary to encrypt any of it. I thought that if it wasn’t a scam, it was an offer, the details of which might have been candidates for an encrypted communication. Bummer.