I'm fairly sure this would have tipped you off - they made the offer with no technical questions or onsite, after talking to only one person, and asked for bank account info before a start date. A little more effort and they might well have gotten me, though.

I can only imagine what a placement company or recruiter could do, just by doing the real job for a bit then bailing with the personal data obtained. It's not pretty, since job offers are such a standard reason to cough up PII.