Dualoo accepts no liability whatsoever for the completeness or accuracy of this article, nor for any incidents that may arise. The responsibility for protecting themselves against these risks lies with our customers themselves. However, Dualoo will support you in this as best it can.

We do our utmost to ensure you have the highest level of security against viruses, spam, etc., in the various areas associated with Dualoo. For example, we only allow applicants to upload PDF files. We scan files for viruses, and Dualoo administrators can activate additional security measures for converting email attachments. Further information on this can be found here.

This article provides general information on spam, phishing and blackmail emails.

Unusual email addresses are detected as soon as they are entered.

If a suspicious or potentially faulty email address is detected, applicants are notified directly in the input mask and can check or correct the address.

This allows, for example, typos or unusual spellings to be detected at an early stage.

In addition, a note is displayed in the relevant dossier. This alerts recruiters that the email address provided may need to be verified.

Note: A suspicious-looking email address does not automatically mean that it is invalid or being misused. The note serves as additional guidance during the verification process.

New registrations are also checked for unwanted freemail domains.

This allows certain registrations to be restricted if they originate from email domains that are frequently used for unwanted or automated registrations.

In addition, Friendly Captcha protects the registration process from automated spam requests and makes it more difficult for bots to carry out automated registrations.

Dualoo’s login and password management are also secured via a dedicated authentication service.

The following processes are handled centrally via this service:

Among other things, modern security mechanisms such as an OAuth flow and HttpOnly cookies are utilised.

This ensures that security-critical login processes are managed centrally and are technically better protected against unauthorised access.

Dualoo also implements various security measures when handling files.

When submitting an online application, applicants can only upload supported file formats. Files are also scanned for potential threats.

Administrators can also activate a more restrictive approach to handling received email attachments. Potentially dangerous file formats can thus be automatically converted into a safer format or blocked.

Technical security measures can reduce the risk, but they are no substitute for carefully checking emails.

Particular caution is required if a message appears unexpectedly, comes from an unknown sender or contains unusual requests.

Suspicious emails often attempt to create a sense of urgency or uncertainty.

Typical notes may include, for example:

A single characteristic does not automatically mean that an email is dangerous. However, if several of these points apply, the message should be examined with particular care.

Do not open unexpected attachments if you cannot clearly identify the sender or the reason for the email.

In recruitment, you will naturally receive documents from applicants you have not previously met. This makes it all the more important to be cautious when dealing with unusual file formats or unexpected attachments.

PDF files are displayed directly in Dualoo. However, you should always exercise caution when handling PDF files.

If a file appears suspicious, do not open or download it; instead, contact your IT team in accordance with internal security guidelines.

Do not click on links if the message or the link’s destination appears suspicious.

Particular caution is required if a link prompts you to:

If in doubt, access familiar services directly via the website you know, rather than using a link from the email.

Do not reply to messages whose authenticity you cannot verify.

If an email purports to be from someone you know but seems unusual to you, contact that person via another known channel of communication, such as by telephone.

In isolated cases, applicants’ personal email accounts may be compromised.

In the past, for example, there have been cases where spam messages were sent automatically from a compromised email account to various contacts in the inbox.

As applicants had previously received emails from Dualoo – such as an automatic confirmation of receipt of the application – this meant that Dualoo email addresses and the corresponding correspondence history could also have been affected.

An example of such an email:

image

In the cases known to date, the messages in question did not contain any attachments or links. Nevertheless, similar messages should always be treated with caution.

Important: The sending of a suspicious message does not automatically mean that Dualoo or the Dualoo user account is affected. The cause may, for example, be a compromised email account belonging to the sender.

If you have received a suspicious email via Dualoo:

If you have already opened a suspicious link, downloaded a file or entered your login details, inform your IT team immediately and, if necessary, change the relevant login details.

If you have any questions or concerns, Dualoo Support will be happy to assist you.