by Pam Dixon

It is important to circulate a resume when looking for work, but these days criminals and identity thieves are all too interested in finding and using resumes for all the wrong reasons. In the information economy, your resume has a “street value.” It’s sad to say, but unfortunately your name, home address, telephone number, even your detailed work history can have value to identity thieves and fraudsters. It is also important to protect your resume from people and businesses who want to use it primarily to make a profit instead of primarily to help you find employment.

To minimize your risk factors while you look for a job, it is important to learn when and where to post a resume. It’s also important to know what kind of job offers to respond to and what ones are best to ignore. The key is to attract legitimate employers while at the same time avoiding the people and fraudulent businesses that can potentially harm you. Circulate your resume by all means, but take care to avoid exposure to bad actors who don’t have your best interests at heart.

Truth #1: If you’re going to post a resume online, post your resume “privately.”

Most job sites offer anonymous or quasi-anonymous posting that lets you mask your contact information and email address when you post a resume. This resume posting option allows you to decide who sees your real information, such as your home address. Masking this information is perhaps the single most important step job seekers who want to post a resume online can take to protect themselves.

Unfortunately, few job seekers take advantage of this option. Most job seekers are concerned that they are hurting their chances with legitimate employers by making them take an extra step. But at this point, it is simply not a good idea to post your resume openly — there are known risks at this point. If you are going to post a resume online, private posting should be the only way you post it.

The goal is to avoid having your full legal name, your home address, your phone number, and your detailed work history, hobbies, and perhaps even references floating around online and eventually getting into the wrong hands. This is information only a legitimate employer should receive, and you can help by taking advantage of private posting options job sites usually offer.

If you still want to post a resume openly, read Tip #7 about using a P.O. Box and a disposable email address and Tip # 8 about what information you may want to leave off of your resume.

Truth #2: Not everyone who has access to a resume database should.

It’s not just employers that access your resume on resume databases. Criminals and fraudsters posing as recruiters can gain illicit access to resume databases, among others. I was at a large conference listening to a presentation when I saw on the screen that one of the main resources for private investigators and law firms looking for people to subpoena was the resume database of a well-known job site.  I had heard this anecdotally for many years, but to see it in black and white and discussed openly was another reminder that when you post your resume online, you are taking a risk. Before you put your resume online anywhere, remember that many kinds of people other than people who want to employ you may gain access to resume databases.

Posting your resume privately, with your contact information hidden from view, is a good way to lessen your risk. However, data breaches have occurred at online job sites where thieves have inappropriately accessed databases. Posting a resume privately will not be adequate protection from a data breach. (See Truth #7).

Truth #3: Not every job offer you see is for a real job — some jobs are just scams.

After you post your resume, you may hear from a person offering you a job that is a scam. Fake job scams have become a very serious problem in online job searching, as detailed in the World Privacy Forum “Job Fraud” report. There are usually some clear tip-offs that a job may be a scam. For example:

• Does the job ask you to scan your ID or drivers’ license and send it in?
• Does the job ask you to transfer money as part of your duties?
• Does the job description mention e-Bay, Pay Pal, or Western Union money transfers?
• Does the potential employer ask you for bank account numbers, or your Social Security number?

If any of the above are true, please understand that you may be looking at a fraudulent job. See the WPF detailed consumer tips on avoiding job fraud <https://www.worldprivacyforum.org/2008/07/jobscamtipspayforwarding/> for more information about job scams and how to avoid them.

Truth #4: The more general the email “job” offer, the less valid it usually is.

So you posted your resume, and now you are getting responses. Be wise and discerning. Not every offer is worth your time. Some job offers are outright scams (see truth #3) and some job offers are just attempts to get you to post your resume on a new job site. Other job offers are simply marketing emails to get you to spend money on “help” finding a job.

Private resume posting will cut down on these kinds of emails, but it will not cure the entire problem. Even if you post your resume privately, you will have to be smart about what emails you choose to respond to.

Red flags to look out for include:

• Any email where someone promises to “help you find your dream job” …. but only after you have paid a fancy fee.
• Email from self-help gurus or entrepreneurs who promise to help you “fulfill your potential” ….. but only after you have paid to attend their expensive workshop.
• Email from a recruiter who “has a great opportunity at a major company” …….. but can’t seem to come up with a specific company name or a specific job.
• Email from anyone claiming that they have a great opportunity for a “responsible financial manager” …… but they only want to interview you by phone before they hire you. (See truth #3 about job scams.)
• Email from a person who wants you to “post your resume here” …. but doesn’t tell you that they may be getting paid a small referral fee for getting you to do this.

Of course, you can get a legitimate job offer after you post a resume. In the World Privacy Forum year-long Job Search Study, research showed that the best job offers usually came within the first month of the resume being posted. After that, the quality of the responses dropped fairly dramatically. If your resume has been posted online for several months, it is a good idea to just take it down and start over.

Truth #5: Even the most careful, conscientious sites cannot control your resume after someone has downloaded it. 

After you have posted your resume, it can be downloaded and used in ways you may never have imagined, and may not like. Job sites do not have the ability to control how a recruiter or employer uses your resume after it is has been downloaded. Most sites watch for problems ­ such as rapid resume downloads  — and enforce terms of use agreements with employers and recruiters. But let the job seeker beware. When it comes to resume databases, the job sites put the responsibility on the job seeker to understand the risks involved in posting a resume online.

The bottom line: after you have posted your resume openly, you have almost no control over how it will be used, by whom, or for how long. You can ease this problem by posting your resume privately, with your contact information hidden.

Truth #6: Unless you are applying to the Federal or State government, never put a Social Security Number on your resume.

Please, keep your SSN off of your resume, and be very cautious about emailing it to people who ask for it. You should only give your SSN to an employer after you have fully validated them as a legitimate employer. Beware of fake job offers, especially those for “work at home” offers.

The most common situation is that a fake employer will get your resume, then ask you for your SSN or a scan of your driver’s license saying that they need a background check before they can hire you. Unless you have physically visited the place of employment or have fully validated the employer by checking with the Better Business Bureau and other agencies, then do not send your SSN, especially through email.

Remember, most legitimate employers will move slowly in the hiring process and will want to interview you one, two, or more times before they officially sign you on as an employee. A fake employer will try to rush you through the process, so you don’t have time to think through possible consequences.

Truth #7: Using a disposable email address and a P.O. Box can save you from many headaches later on.

It is not a good idea to post a resume openly online. But if you decide to post your resume to a site that does not allow you to mask your identity, then mask it yourself. Use an email address that you can cancel if you start getting spam, and don’t give out your full name, phone number, or home address. Use a post office box, and do not give your street address to an employer until you have verified them fully.

Even if you post your resume privately, it is still a good idea to use “disposable” contact information that does not tie back to your street address or place of residence. If a data breach occurs at an online job site, disposable contact information may help mitigate some of the potential risk, depending on the type of breach.

Truth #8: Things to omit from your resumes if you post it online…your references, for sure. Your school name, possibly.

When you post a resume online, there are some categories of information you need to think about leaving off. First, references. If you put your references’ names and phone numbers on your resume, you are giving their information away without their consent in what can be a very public forum. Omit this information, in particular when you put your resume online in any fashion. Be nice to your references: leave them off of your online resumes.

School information is tricky. Education is a necessary category on a resume. The problem is that anyone can call up your school and get what is called “directory information” without your consent. This can include your name, date of birth, home address, and other vital information. If you are a current college student, you can sign what is called a FERPA form to stop your school from giving this information out to just anyone. (FERPA stands for Family Educational Rights and Privacy Act.) If you have a FERPA form on file, only legitimate employers or law enforcement professionals or others with a legitimate interest should be able to access your information. Usually school records offices will have FERPA information for you, or will know where to send you to find that information.

If you attended college many moons ago, you have a couple of options. Some people simply list their degree and date, and let the employer ask for the name of the college in the interview. But if you graduated from a big-name school, you may want to brag about it. If so, fine, but understand the risks and mitigate what you can. Make sure the school has a P.O. Box address on file for you, not your home street address.

Special note for high school students and parents: FERPA applies to high school students, too, but for students under 18 who are in high school, parents have to sign the FERPA forms. It is crucial for parents to protect their high schoolers’ home address and directory information during job searches for summer work or part-time work.

For more information about FERPA, see the U.S. Department of Education’s site: http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.

Truth #9: Some resume databases are better than others.

Before posting a resume to any database, take the time to look for and read the privacy policy of that site and query the site owner with any privacy concerns . Be sure to look for specific privacy policy statements about resumes, registration information, and statements about how that information is used, stored, and shared. If the site does not have a privacy policy posted, that should be a signal that you should be especially cautious about posting a resume there, if at all. And if you cannot delete your resume, don’t post it.

One word about job sites: some job sites share resumes between themselves. Don’t be surprised if after posting your resume at one site, if it shows up at another. Sometimes, resumes can also be stolen from one site and reposted illegally at another. This has happened to one job seeker who has not been able to get his resume offline after 6 months of emails to the secondary sites that posted his resume.

Truth #10: Delete does not always mean delete.

Make sure the job site or resume site lets you delete your resume whenever you want to. Also, look for information about how long a site says it will keep or store your resume. This information can usually be found in the privacy policy or terms of use section.

Job and resume sites should state that they promise to let you delete your resume whenever you want to, and will only keep your resume for a limited, specific amount of time, such as one to six months, after which the site will delete your resume. Without specific, written statements about how long your resume may be kept, your resume can be archived for years, legally . Most job seekers do not want resumes circulating after they have gotten a job. Before you post a resume, check to make sure you can delete your resume after you have posted it .

Look in the job site’s privacy policy for resume deletion instructions. If you don’t find any such instructions on the site, write an email to the site and ask how or if you can delete your resume. If you are not satisfied with the reply, do not post your resume to that site. You must be able to delete your resume when you want to. After all, it belongs to you.

A note about resume writing services:

If you plan on using a resume writing service in your job search efforts, get an agreement in writing that the service will not sell or share your resume with any third parties or partners. Unfortunately, this does happen at some resume writing services.

Also, ask to see the privacy policy of any resume writing services you may use and ask specifically about how the service handles and stores your resume. This applies to traditional and online resume writing services.

Truth #11: Keeping good records is crucial for online job searching

Be sure to keep a record of where you have posted your resume online. Sometimes, you will not have an email record because you will have posted your resume into a form on a Web site. Print all of these out when you post your resume, and keep copies.

These copies will help you to remember where you have posted, and will allow you to go back and follow up, or delete your resume from the sites where you have posted it after you have finished your job search. And if you run into any problems on a site, the copies will allow you to prove what it is that you posted on the site.

Truth #12: Prevention is better than the cure.

If you believe your resume or personal job search data, including your email address or your name, has been shared or used in a way inconsistent with a job site’s posted privacy policy, you have little ability if any to fix the problem after the fact. This is an unfortunate reality today. Perhaps this will change in the future, but for now, it is much better to prevent problems than to try and fix them afterward. See Recourse section below for tips if you have had a problem.

Recourse for Job Seekers

You may file a consumer complaint with the FTC by calling (1-877-FTC-HELP ) or by using the FTC’s online filing system, located at http://www.ftc.gov/ . Click on “File a Complaint Online.”

If you discover that you have been the victim of a job scam, it is crucial that you take immediate action to stop any further payment (or shipping) transfers. There is a chance you may have unwittingly committed a crime, for example, if you have transferred money that is stolen, you may have committed wire fraud. Because of this, you will need to take steps to file a police report and make restitution where appropriate. Please see <https://www.worldprivacyforum.org/2008/07/jobscamtipspayforwarding/> for detailed tips on how to deal with the aftermath of a job scam. Some job seekers have had serious legal problems, including arrest and indictment, due to job scams.

If you have identity theft problems resulting from your resume posting, you can find helpful information at the Privacy Rights Clearinghouse www.privacyrights.org/identity.htm and the Identity Theft Resource Center www.idtheftcenter.org . There, you will find fact sheets and detailed information about specific steps you need to take. The Privacy Rights Clearinghouse also has guides on SSNs and other workplace privacy issues.

Publication history: Updated 2/ 2009, 7/2008, 8/2007, 2/2006, 7/2005, 7/2004. Originally posted 2/20/2003.

Pam Dixon is the author of seven books, including the award-winning Job Searching Online for Dummies. Pam Dixon and the World Privacy Forum gratefully acknowledge the Rose Foundation Consumer Privacy Rights Fund, whose financial support made this research possible .