Detective here. What this person is describing is a business email compromise (BEC). Definitely contact HR and verify the authenticity of the email. The lowest level BEC has legitimate emails forwarded to an outside account. Then at the appropriate time, emails that will look quasi legit, or expected, will be sent asking for personal info. These can be sent with same names, but from Gmail as opposed to the companies actual mail server. They usually hope the person just replies to their email and provides the info they want. This isn't to say they can't have access to a person at the companies email, or can be working nefariously within the company.

I've seen it target more lucrative businesses such as real estate offices to intercept wire transfers from customers, because they can get down payments wired to mule accounts with little scrutiny if they time their emails right. Not really to hit job applicants for bank info.

Long story short, always check what domain the email came from, don't be afraid to CC other people that you have had direct contact with at the company such as HR, and if you're still concerned, pick up the phone.