Is this phishing? How can I be sure? And what can be gained?

Question

Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they said upon leaving the interview that I should hear back in two to three weeks. Yesterday was exactly three weeks and a day. The email address appeared authentic as it contained the domain name of the company, but the user threw me off (Resumes1@) as I hadn't received any correspondence from this address previously.

The email didn't contain any request to sign into anything or ask for personal information, but it did have a link to the original job posting on a recruiter website that also appeared to be legit (hovering over the link produced the same https address in the lower part of the browser window). My suspicion was raised when the email signature contained no phone number, email address link, or company website link and was simply from "company name, Human Resources Department". I did "show original" to view the header info and noticed a three hour delay from the time the message was sent which is also very suspicious, right?

Does anyone have any other tests or verifiers to determine if this is truly a phishing attempt? If it is, what can really be gained by merely replying that I was still interested in the position (the only question/request they had of me was if I was still interested and when I was free to discuss further)? Any insights would be greatly appreciated. :)

Answer 1

This appears to be valid. No single fool-proof answer exists, but it appears valid and safe for the following reasons:

1. You were expecting it from them. While it's possible someone trying to spearphish you knew this, it is one of several positive indicators. This alone is not enough, however.
2. The domain headers check out and having a generic email ([email protected]) is very common. See #4.
3. The URL checks out when hovering over it.
4. There is about a 90% chance someone is reviewing your resume and position from software like taleo or brass ring, which means the email sent will almost certainly NOT originate from their actual email. Probably a dozen or so recruiters share said software, so having it tailored to a specific Email signature is highly unlikely and the signature you received would not be out of character. It's also not uncommon (although it is unprofessional) to have several fields that are supposed to be filled out NOT filled out, leaving a generic term in it's place. Additionally, in a large, well-developed company it's not out of character to receive form letters with $variable_job posting that is filled in on the form letter. This is far more efficient for recruiters to work within their software - just like a salesman has an easier time integrating his email with salesforce than custom writing each email for each invoice.
5. A 3 hour delay does not necessarily indicate any serious risk. If it's a medium or large business (or poorly configured) the website may "batch out" emails or spool up several at once at a pre-determined period of time (e.g. every 3 hours). There are also other reasons an outgoing email may stall, without being risky.
6. Replying to an email will not get you "phished." Clicking on links will, or replying with PHI/PII will - but responding that you'd love to move forward and are excited for the opportunity poses no risk.

Anecdotally, I have been involved with phishing campaigns on the security side, and nothing is raising my hairs.

If you are ever unsure, it's still always best to open an attachment or click on the link in a sandboxed environment.