How to Protect Your Identity During Remote Job Applications

This matters more for remote jobs than office jobs because you may never meet anyone in person. Scammers know Nigerians apply to foreign companies in large numbers, and a fake "onboarding form" asking for your passport scan and bank login is cheaper to run than a fake vacancy that wants a fee. A stolen identity can be used to open accounts, take over your phone line or pass identity checks in your name.

This guide covers what each type of data can be used for, what to share at each stage of hiring, how to check a remote job before you send anything personal, how to send your CV safely to employers abroad, and what to do if you have already shared too much.

Quick answer

Apply with only your name, a job-search email, your phone number, your city and a CV with no date of birth, home address or ID numbers. Before you send any ID, check that the role is on the company's own careers page, that emails come from the company's domain and that you have a written offer. Never share OTPs, PINs, passwords or your BVN with a recruiter, and never pay to be hired.

What identity thieves want from remote job seekers

Most job-scam identity theft is not about one big leak. It works by collecting pieces: your CV gives a full name and phone number, a "verification form" adds your date of birth and NIN, and a fake payroll step adds your bank details. Put together, those pieces are enough to pass identity checks somewhere else.

The FBI has warned that criminals pose as employers, sometimes by copying real company websites, to collect identity documents and bank details, which they then use to take over accounts, open financial accounts or make fake IDs (FBI IC3 public service announcement on fake job postings). The US Federal Trade Commission (FTC) says job scammers want two things, your money and your personal information (FTC guide to job scams).

Here is how the Nigerian versions of those details can be misused, and when a real employer actually needs them.

The last row is the one to remember. No employer, payroll provider or bank needs your one-time password (OTP), card PIN or account password.

What to share at each stage of a remote hiring process

A legitimate hiring process asks for more information as it goes, and the sensitive items come only after you have accepted an offer. When a request comes earlier than this table suggests, slow down.

The FBI's guidance puts it the same way: legitimate employers collect bank and identity details after hiring, not before (FBI IC3).

Why onboarding through a platform is safer than email

Many foreign companies hire Nigerians through an employer of record (EOR) or a contractor payments platform such as Deel or Remote.com. In that case you upload your ID and payout details into the platform's own account, not into an email or a Google Form. That is safer, as long as you reach the platform by typing its address yourself rather than clicking a link in a chat message. If you want to understand what those platforms are and how being a contractor differs from being an employee, read our guide to contractor versus EOR employee arrangements.

How to verify a remote job before sharing personal information

You don't need to investigate every job you apply to. You need to check the employer properly before the first time it asks for something sensitive. These checks take about ten minutes.

1. Find the job on the company's own website. Go to the company's careers page by typing its address, not by clicking a link someone sent you. The FBI lists a job that appears on job boards but not on the company's own site as a red flag (FBI IC3).
2. Check where the application form lives. Real companies often use applicant tracking systems such as Greenhouse, Lever, Ashby or Workable, with the company's name in the link. A Google Form, a Telegram bot or a lookalike domain is a warning sign.
3. Match the email domain. A recruiter at a company called Example Ltd should write from an address ending in the company's own domain, not from Gmail, Outlook or a lookalike such as "example-careers". The FBI names messages from non-company domains as a red flag. The FBI also says that seeing "https" or a padlock at the start of a web address does not prove the site is genuine.
4. Look for lookalike websites. Search the company name on its own. Several similar domains can point to fraud (FBI IC3).
5. Search the company and the recruiter with "scam", "review" or "complaint". The FTC suggests exactly this (FTC).
6. Check the recruiter. Their LinkedIn profile should exist, be more than a few weeks old, list the company they claim to work for, and show colleagues at that company. A profile that doesn't match the role they claim is another red flag the FBI lists.
7. Confirm through a channel you found yourself. If you're unsure, email the company through the contact address on its official website and ask whether the recruiter and the role are real.
8. Get a written offer before any ID request. The offer should name the role, pay, start date and the legal entity hiring you. If someone wants your passport "to start the process", the process is not real yet.

Many real employers say on their own websites what they will and won't ask for, so read the careers page notice. Greenhouse, which makes hiring software used by many remote employers, says its own recruiters contact candidates only from Greenhouse company email addresses and that it would never ask for passport information, banking details, card numbers or account passwords during its interview process (Greenhouse notice on candidate phishing scams). That notice covers Greenhouse's own hiring, not every company that uses its software, but it shows the kind of statement to look for.

For a full check of whether a company exists, is registered and actually hires abroad, see our guide to checking whether an international employer is legitimate. If you are unsure whether a role is even open to people in Nigeria, our guide on verifying that a remote job accepts Nigerian residents covers location rules.

Red flags that should stop you sending anything

• The "interview" is a text chat on Telegram or WhatsApp with no video call and no named interviewer.
• You are offered the job without speaking to anyone.
• You are asked to pay for training, equipment, a background check or a "work permit". The FTC is clear that honest employers never charge you to get a job.
• You get a cheque or transfer and are told to send part of it on. The FTC describes this as a fake cheque scam, and you end up owing the bank.
• The pay is very high for simple tasks such as rating products or "optimising" apps.

If any of these appear, read how to spot remote job scams in Nigeria and our guide to what to do when a recruiter asks for money.

How to safely share your CV with international employers

Your CV is the document you share most often, so it leaks most often. Many Nigerian CV templates still include details that foreign employers don't need and that a scammer would love to have.

Take these off your CV before you apply abroad

• Date of birth and age. UK and US employers don't expect them, and they help with identity checks.
• Full street address. "Lagos, Nigeria" or "Ibadan, Oyo State, Nigeria" is enough. Adding your time zone (WAT, UTC+1) helps recruiters more than your street name does.
• State of origin, LGA, religion, marital status, number of children. These are not relevant to a remote role abroad.
• NIN, passport number, NYSC certificate number, BVN. None of these belong on a CV.
• A photo. UK and US CVs usually leave it out. Your LinkedIn profile can carry a photo if you want one.
• Referees' phone numbers. Write "references available on request" and give contact details only to an employer you have verified, after telling your referees.

Example (hypothetical): a safe CV header for a remote applicant.

For layout and wording, see our guides on writing a CV for international remote jobs, adapting a CV for UK remote jobs and adapting a CV for US remote jobs.

Share the file carefully

• Use a separate job-search email. Keep one address only for applications. If it starts getting phishing messages, you will know where they came from, and your banking email stays out of the mix.
• Send a PDF, not a Word file. Name it simply, such as "Adaeze-Okafor-CV.pdf". Check the file properties and remove any author details you don't want to share.
• Be careful with cloud links. If you send a Google Drive or Dropbox link, set it to "view only", keep it to the one file, and turn off sharing once the role closes. Don't share a folder that also holds your NIN slip or certificates.
• Upload only to the employer's application system or a job board you trust. Avoid "drop your CV" posts in Facebook, WhatsApp and Telegram groups. Those posts collect phone numbers and names that scammers then message with fake offers.
• Mark portfolio samples. For design, writing or code samples, add your name to the file, or share a read-only link rather than the source file.

What to keep off LinkedIn

LinkedIn is public, so the same rules apply. Show your city and country, not your address. Leave out your personal phone number and date of birth. Keep the "open to work" setting visible to recruiters if you like, but treat every message that says "you've been selected" with the checks above. Our guide to spotting fake recruiters on LinkedIn covers what those profiles usually look like.

Nigerian ID documents: what to share, and how

NIN: use a virtual NIN where it is accepted

The National Identity Management Commission (NIMC) offers a virtual NIN (vNIN): a temporary code you generate for one named organisation, so that organisation can verify you without keeping your actual 11-digit NIN. According to a guide from Youverify, a Nigerian identity verification company, a vNIN is generated in the NIMC Mobile ID app or by USSD from the phone number linked to your NIN, needs the requesting organisation's enterprise ID or agent code, and expires 72 hours after it is generated (Youverify guide to generating a vNIN). Confirm the current process with NIMC or the organisation asking, as of October 2026.

In practice, a foreign employer rarely asks for your NIN at all. Nigerian banks, fintech payout apps and some local EOR providers do. When an organisation that can accept a vNIN asks for your NIN, give it a vNIN. If a "recruiter" wants a photo of your NIN slip on WhatsApp, say no.

BVN: a foreign employer has no reason to ask

Your Bank Verification Number (BVN) is a Nigerian banking identifier. A company abroad paying you through Deel, Remote.com, Payoneer, Wise or a domiciliary account does not need it from you. Banks and fintech apps may need it when you open an account in their own app. A recruiter does not. Treat any request for your BVN during hiring as a reason to stop. For how dollar payments actually reach Nigerian accounts, see how to receive dollar payments in Nigeria.

Passport: only to a verified employer, and marked

A passport scan is the most valuable document you own for an identity thief, because it works internationally. Send it only after a written offer, only through the employer's or EOR's official system, and if you must email it, add a visible note across the copy such as "For onboarding with [company], 27 October 2026 only". Our guide on sending your passport to a recruiter covers this in more detail.

Bank details, OTPs and PINs

An employer needs your account name, account number and bank or payout details to pay you. It never needs your internet banking login, card PIN or the OTP your bank sends you. If someone asks you to "read out the code we just sent" to "confirm your payroll", you are talking to a fraudster.

Interview traps that expose your data

Some identity theft happens during the "interview" itself, especially on video calls set up by scammers.

• Fake interview platforms. The FBI warns that some fake interviews are not on a secure video platform and use teleconference apps where the scammer contacts you by email address rather than phone number (FBI IC3). Real employers usually use Zoom, Google Meet or Microsoft Teams links sent from a company address.
• Software downloads. If you're asked to install an unknown app, a remote-control tool such as AnyDesk, or a "skills test" file, decline. The FBI advises against clicking links, downloading files or opening attachments in unsolicited job offers (FBI IC3 warning on work-from-home task scams).
• Screen sharing. Coding and design tests sometimes involve sharing your screen, which is normal. Before you share, close your email, banking tabs and file folders, and share one window rather than your whole desktop. Never hand over remote control of your computer.
• Task scams. The FBI describes fake jobs where you "optimise" or rate things, see earnings on a dashboard, and are then asked to pay cryptocurrency before you can get more work. None of the money can be withdrawn (FBI IC3).

For more on telling a real interview from a staged one, see how to recognise fake remote job interviews and avoiding scams on Telegram and WhatsApp.

Protect the accounts behind your identity

Your documents are only part of the picture. Your email, phone line and banking apps are what a fraudster actually goes after.

• Turn on two-factor authentication for your email, LinkedIn and any payout app. The FTC recommends strong passwords and two-factor authentication as basic protection against identity theft (FTC guide to identity theft). Our guide to setting up two-factor authentication for work accounts walks through it.
• Use a different password for every account. A password manager makes that manageable.
• Protect your phone line. Your bank OTPs go to the number linked to your BVN, so a SIM swap is a serious risk. If your line suddenly loses service with no explanation, contact your network and your bank straight away.
• Use an authenticator app rather than SMS codes where the service allows it.
• Watch your bank and payout app alerts for transfers you didn't make. The FTC lists unexpected withdrawals and unfamiliar accounts in your name as signs of identity theft.

What to do if you have already shared too much

Act quickly. The steps depend on what you sent.

1. If you shared bank details, a card number or an OTP: call your bank's official line straight away and ask it to block the card or account and reverse anything suspicious. The FBI advises contacting your bank immediately to stop or reverse transactions (FBI IC3).
2. If you shared a password: change it, and change it anywhere else you used the same one. Turn on two-factor authentication.
3. If you shared your NIN, passport or date of birth: you can't change these, so watch for warning signs: loan or account alerts you don't recognise, SIM problems and messages from banks you don't use. Use a vNIN for future verifications.
4. Keep the evidence. Screenshot the job ad, chats, emails, phone numbers and any payment receipts before the scammer deletes them.
5. Report it. Report the listing to the job board or LinkedIn, and tell the real company if it was being impersonated. If the scam used a US company's name, you can also report to the FBI's Internet Crime Complaint Center (IC3) and to the FTC's ReportFraud website (FTC). In Nigeria, file a report with the police and keep a copy.
6. Warn your referees if you gave out their contact details, so they don't fall for follow-up calls.

Our guide to what to do after being scammed by a fake employer covers recovery and reporting in more depth.

Your rights under Nigeria's data protection law

Real employers and platforms that collect your data have obligations too. The Nigeria Data Protection Act 2023 set up the Nigeria Data Protection Commission (NDPC). The NDPC lists data subject rights under sections 34 to 38 of the Act, including the right to be told how your data is used, to access and correct it, to object to or restrict its processing, and to have it erased (Nigeria Data Protection Commission).

In practice this means that after an application process ends, you can write to a company and ask what personal data it holds about you and ask it to delete your ID copies. If you believe an organisation has mishandled or leaked your data, the NDPC runs a privacy breach reporting service linked from its website and lists its contact email there (as of October 2026). How far the Act reaches a company based abroad is a legal question. For a specific case, get advice or contact the NDPC directly.

Frequently asked questions

Should I give my NIN to a remote employer?

Only after a verified written offer, and only if there is a genuine onboarding reason, such as a Nigerian EOR or payroll provider needing it. Where the organisation accepts it, give a virtual NIN (vNIN) instead of your actual NIN. Never send a photo of your NIN slip to a recruiter on WhatsApp or Telegram.

Can a foreign employer ask for my BVN?

A foreign employer has no normal reason to ask for your BVN. Payment platforms and Nigerian banks verify it inside their own apps when you open an account. A recruiter or "HR officer" asking for your BVN during hiring is a strong sign of fraud.

What personal information should not be on my CV for remote jobs?

Leave out your date of birth, full street address, state of origin, religion, marital status, photo and any ID numbers. Your name, city and country, time zone, job-search email, phone number and LinkedIn link are enough for a foreign employer to contact you.

How can I tell if a remote job is real before sending documents?

Check that the job appears on the company's own careers page, that emails come from the company's domain, and that you had a real video interview and a written offer. Search the company name with "scam" or "review". If you still have doubts, email the company through the address on its official website and ask.

Is it safe to share my screen during a remote interview?

Sharing your screen for a coding or design test is normal and usually safe if you share a single window, not your whole desktop. Close email, banking and file windows first. Never install unknown software or give the interviewer remote control of your computer.

Is it safe to upload my CV to job boards?

It is reasonably safe on established job boards and on employers' own application systems, provided your CV carries no ID numbers, date of birth or home address. Avoid posting your CV in open social media groups, where anyone can collect your name and number.

What should I do if I sent my passport to a fake recruiter?

Stop all contact, keep the evidence, report the account to the platform where you met them and file a police report. Watch for accounts or loans opened in your name. If the recruiter claimed to work for a real company, let that company know so it can warn other applicants.

Key takeaways

• Apply with your name, a job-search email, your phone number, your city and a clean CV. Sensitive documents come after a verified written offer.
• Before the first request for ID, confirm the job on the company's own careers page, check the email domain and insist on a real video interview.
• OTPs, PINs and passwords are never part of hiring. A foreign employer has no reason to ask for your BVN.
• Use a virtual NIN where it is accepted, and mark any passport copy with the company's name and the date.
• Remove your date of birth, street address, state of origin and ID numbers from your CV before applying abroad.
• If you have already shared too much, call your bank first, then change passwords, keep the evidence and report.

Next steps

Start with your CV: take out anything from the "remove" list above and set up a separate job-search email this week. When you are ready to apply, browse remote jobs open to applicants in Nigeria. WorkRemote reviews listings and aims to publish genuine remote roles open to applicants from Nigeria, but it can't check every detail, so run the ten-minute check above before you send any documents. Each listing shows the company's website, which makes the first check quicker. After a search, you can turn on free daily email alerts for new matching jobs. If you want help with a CV that is safe to share and written for foreign employers, see what the team changes in a CV and LinkedIn review, which is part of Premium.

Sources

• Job Scams, Federal Trade Commission (consumer.ftc.gov)
• What To Know About Identity Theft, Federal Trade Commission
• Cyber Criminals Use Fake Job Listings to Target Applicants' Personally Identifiable Information, FBI IC3 PSA (January 2020)
• Scammers Defraud Victims via Fake Work-From-Home Jobs, FBI IC3 PSA (June 2024)
• Information on candidate phishing scams, Greenhouse
• Nigeria Data Protection Commission (ndpc.gov.ng)
• How to Generate Virtual NIN (vNIN) via NIMC App and USSD Code, Youverify