NearSeal

2026-08-28

Job applications ask for your ID, your SSN, and your bank details. Should you encrypt what you send?

Job hunting puts you in the most lopsided documentation relationship most adults ever enter. Somewhere between the offer letter and the first paycheck, someone you have never met asks for a photo of your driver's license or passport, your Social Security number for the background check, sometimes your bank details for direct deposit — and often the channel is plain email, at exactly the moment you least want to seem difficult. A mortgage applicant can shop lenders; a job applicant who pushes back on paperwork worries about looking like a problem before day one. That asymmetry deserves a clear-eyed look, because the two things that can go wrong with those documents are well documented and surprisingly different: the screening industry that legitimately processes them has suffered breaches at enormous scale, and a fast-growing category of scam asks for the same documents while never having a job to offer at all. This post walks through both, then is specific about which of the two problems encrypting your files can actually address — because the honest answer is: only one of them.

The screening industry that ends up holding your file

When an employer runs a background check or a drug screen, your data usually flows to a third-party vendor you didn't choose and may never have heard of. In February 2025, one of the biggest of those vendors — DISA Global Solutions, which provides drug and alcohol testing and background checks — began notifying 3.3 million people that an intruder had been inside its network from February 9 to April 22, 2024, with access to data that potentially included Social Security numbers, driver's license numbers, government ID numbers, and financial account information. Two details are worth sitting with. First, DISA said it could not definitively conclude exactly what the attacker took — the people affected will simply never know. Second, notification went out roughly ten months after the breach was discovered — most of a year in which affected job applicants and employees had no idea their identity documents might be circulating. And the industry's problem runs deeper than any one vendor's network security: in 2024, a data broker called National Public Data, which sold background-check searches built on scraped public records, was breached by a hacker who offered what they claimed were billions of records covering around 300 million people — security researchers estimated the leaked database held about 270 million Social Security numbers. By October 2024 the company's parent had filed for Chapter 11, telling the court it could not plausibly pay for credit monitoring for the hundreds of millions potentially affected; the bankruptcy filings valued the stolen SSN database at one million dollars. As CBS News noted in its coverage of the leak, most of the people in that database had never knowingly interacted with the company at all. You don't get to pick your employer's screening vendor, and NPD proves the aggregation happens with or without your participation. What you do control is narrower but real: the form your documents take on the hops you personally send, and in the copies that stay behind.

You can't always tell who's asking

The second problem is worse than a leaky pipeline: sometimes the request itself is the attack. The FTC's consumer guidance reports that reports about job scams tripled from 2020 to 2024, while reported losses jumped from 90 million to 501 million dollars over the same period. The variant relevant to your documents is the one the FTC described in an alert about fake recruiters on LinkedIn and other job platforms: scammers impersonate real, well-known companies and real recruiters, send official-looking offer letters — and then ask for your driver's license, Social Security number, or bank account number to fill out "employment paperwork." The ask arrives exactly where a legitimate ask would, dressed exactly the way a legitimate ask is dressed, at the point in the process where refusing feels like torching the offer. That's what makes onboarding paperwork such effective camouflage: unlike "pay us a fee," which the FTC flatly says no real employer does, "send us your ID for the employment forms" is something real employers genuinely require.

Two failure modes, two different defenses Real employer, leaky pipeline Recruiter inbox, HR forwards, your sent folder, a screening vendor's systems — copies accumulate for years Encryption helps: every copy on the way is ciphertext; the passphrase travels by phone, not in the thread Fake employer, real-looking ask A scammer posing as a recruiter asks for your ID and SSN as "employment paperwork" — and you'd hand them the passphrase along with the file Encryption cannot help here — only independently verifying the company can
Encrypting a document protects it from everyone except its intended recipient — so it matters enormously whether the intended recipient is who they claim to be. The two failure modes need two different defenses.

What encrypting your documents actually changes

Take the legitimate case first, because it's most of the time. HR or a recruiting coordinator says: email us a copy of your ID, or your signed forms with your SSN on them. If you encrypt the file before attaching it and pass the passphrase over a different channel — a phone call is cleanest, and by the offer stage you almost always have a real phone number for someone — then every place that email lands holds ciphertext instead of your passport. That matters because onboarding email doesn't stay put: the coordinator forwards it to HR operations, someone uploads it to the screening vendor, a copy sits in your own sent folder and in the recruiter's inbox indefinitely. If any of those mailboxes is compromised next year — and mailbox compromises are mundane — the attacker's haul from your thread is a file they can't read. The same logic covers the copies on your side of the fence: the ID scan and the completed forms sitting in your Downloads folder from the last job hunt are exactly the files a stolen or resold laptop serves up, and an encrypted archive is the version of them that's safe to keep. Two practical notes. If the employer or its screening vendor offers a genuine secure-upload portal, use it — that's the right tool for that hop, and this whole section is about the hops where somebody insists on plain email. And nothing about this requires the other side to install anything: the recipient opens the same website, drops the file in, and types the passphrase you told them.

What it honestly can't do

Now the limits, plainly. First, the far end of a legitimate hop decrypts your documents and stores them in its own systems, and from that moment your encryption no longer protects those copies. Nothing any DISA-screened applicant did or could have done on their side would have changed what the intruder inside DISA's network could reach — and National Public Data is the sharper version of the same point, since its database was assembled from records nobody sent it. Encrypting what you transmit shrinks your personal exposure surface — the email hops and the leftover copies — and that is all it does. Second, and this is the part too many privacy tools gloss over: encryption is zero defense against the fake-recruiter scenario, because you would be handing the attacker the passphrase along with the file. The defense there is procedural, and it's the one the FTC's alert spells out: before sending documents or money to anyone who recruited you, contact the company through a phone number or website you found independently — not one supplied by the person who contacted you — and treat requests for your SSN, ID, or bank details that arrive before a real interview and a verified offer as the red flag they are. There is one pleasant alignment, though: the habit of encrypting your documents comes with a built-in verification step, because reading someone a passphrase means making the kind of direct, out-of-band contact that scams structurally avoid.

Where NearSeal fits

NearSeal encrypts files entirely in your browser. The file and the passphrase never leave your device — there's no account, no upload, and you can watch the network tab confirm that nothing is transmitted. Encryption is AES-256-GCM with a key derived from your passphrase via PBKDF2-SHA256 at 220 iterations, and on decryption the file is recognized by its actual bytes, not its name or extension — so the HR coordinator on the receiving end just opens the same website, drops the file in, and types the passphrase you read them over the phone. That nothing-to-install property matters here for the same reason it does everywhere: you can't ask a company's HR department to adopt software for your sake, but you can ask one person to open a web page. For the personal archive you'll keep — the ID scans and signed forms that outlast any one job search — the opt-in age-encryption.org format is worth considering: age files open in the official age CLI, rage, and every other age-compatible tool, so your archive's future isn't tied to this website's. One caveat applies with full force: there is no recovery. Nobody, NearSeal included, stores your passphrase, so a forgotten passphrase means an unreadable file — write it in a password manager before you send anything. Then the documents that prove who you are stop being the readable payload in a stranger's inbox, and become ciphertext everywhere except the two ends of a phone call — with the one company you took a day to verify is real.