I have just been contacted back by a client who I have sent a proposal to. He sent me a link to answer some questions, this link went to a website just like Upworks that asked for the email, password and the security question's answer. If it was not for the last question I would not have noticed the difference, always check that the url of the website is Upwork's.
Thankfully Upwork has the feature of reporting a suspicios message easily, by clicking the cog wheel on the right hand side of the message. The user was removed almost instantly from upwork and his access was revoked.
Be careful and report any suspicious activity to upwork.
HR is a flag in general. You're providing a service not looking for a job.
In all of these scammer communications they have so many red flags. People are just either too desperate or too naive to see them. Like with the check scammers. Anyone in the US should know that nobody introduces themselves as "Mr" or "Mrs" and then tells you their age and the college they went to. That's so freakin stupid and obvious, but I guess you would only know this if you interviewed a lot through the years. I've done tons of interviews. I used to do it for practice back in the day just to see what happens and if I could get the job. Nobody does what they do. As a matter of fact, a phone conversations is always preliminary in my world, so a chat session is just too stupid.