The Fair Credit Reporting Act (FCRA) is a federal law that imposes certain requirements on employers that use a third party to conduct background checks. Under the FCRA, these third parties are known as credit reporting agencies, or “CRAs.” Note: The FCRA extends to all types of background checks obtained using a third party.

Consumer reports include any written, oral or other type of communication issued by a CRA bearing one or more of the following: (1) credit worthiness, credit standing, or credit capacity; (2) character, general reputation, or personal characteristics; or (3) mode of living. Examples include, but are not limited to, criminal and civil records, credit reports, driving records, workers’ compensation records, and reference checks performed by a CRA.

Before Obtaining a Background Check from a CRA:

  1. Provide notification. Notify the individual, in writing, that a background check will be conducted for employment purposes and that the report may include information about the individual’s character, general reputation, personal characteristics, and mode of living. The notice must also include a statement informing the individual of his or her right to request a disclosure pertaining to the nature and scope of investigation and to receive a written Summary of Rights. The notice may NOT be included in an employment application, it must be a separate document.
  2. Obtain consent. Obtain the individual’s written authorization. The authorization may be part of the notification.
  3. Provide certification to the CRA that you: notified the applicant or employee and obtained their permission; complied with all FCRA requirements; and will not discriminate against the applicant or employee or misuse the information.

Before Taking Adverse Action:

Before taking adverse action based in whole, or in part, on a consumer report, an employer must provide the individual with:

  • A copy of his or her consumer report;
  • A Preliminary Notice of Adverse Action; and
  • A copy of “A Summary of Your Rights under the Fair Credit Reporting Act.”

Adverse action is defined broadly and includes, but is not limited to, denying a job application, reassigning or terminating an employee, or denying a promotion.

After Deciding to Take Adverse Action:

If you decide to take adverse action, the FCRA requires you to provide a final notice to the individual that:

  • Identifies the action taken;
  • Lists the name, address, and phone number of the CRA that supplied the report;
  • Includes a statement that the CRA did not make the decision to take adverse action and is unable to give specific reasons for it; and
  • Notifies the individual of his or her right to dispute the accuracy or completeness of any information the agency furnished, and his or her right to an additional report from the CRA within 60 days of a request.

Misconduct Investigations:

The FCRA provides special procedures for investigations of suspected misconduct relating to employment, violation of company policy, or compliance with federal, state, or local laws and regulations. As long as the employer complies with these procedures, there is no requirement to obtain employee consent before conducting an investigation into an employee’s misconduct (provided the employer gives the employee a summary describing the nature and scope of the inquiry if an adverse action is taken based on the results of the investigation).

To fall under this exception, the report may not be made for the purpose of investigating the employee’s credit worthiness, credit standing, or credit capacity, and the report may not be provided to any party besides the employer, its agent, or a legal or regulatory authority.

State Impact:

Several states have passed their own background screening laws, which may require additional notice requirements and/or restrict the use of certain types of background information in connection with employment decisions. For example, a number of states prohibit most employers from using an applicant’s or an employee’s credit history for employment purposes unless the credit information is “substantially job-related.” Check your state law to ensure compliance.


Social Security Number Validation:

Generally, when conducting background checks employers start with a Social Security Number (SSN) validation. The Social Security Administration (SSA) operates a program called the Consent-Based Social Security Number Verification Service (CBSV). With the consent of the SSN holder, background screening providers may use the CBSV to verify whether a name and SSN combination match the SSA’s records. The CBSV returns a “yes” or “no” verification indicating that the submission either matches or does not match records. The service doesn’t verify identity; it only determines whether the name and SSN combination is a match in the database.

Note: The Administration also operates the Social Security Number Verification Service (SSNVS). However, employers are prohibited from using it to verify an applicant’s SSN or to screen an applicant. Use of the SSNVS is limited to IRS Form W-2 purposes only, after an employment relationship has been established.

Education and Credential Verification:

Many employers require applicants for certain positions to meet minimum education requirements in order to be considered for employment. Additionally, some positions and/or state regulations require that an individual hold a current professional license (e.g., lawyer, certified public accountant, doctor, etc.).

Education and credential verifications are intended to:

  • Verify if a degree or credential was obtained;
  • Confirm the date a degree or credential was awarded; and
  • Identify any fictitious school or diploma the applicant has listed

While the Internet may be a valuable tool for identifying candidates for an open position, employers should exercise caution in this area. Employers cannot make employment decisions on the basis of protected characteristics. However, characteristics, such as race, age, religion, and disability, may be revealed on social media. Likewise, certain states protect workers from discrimination based on legal off-duty conduct, such as smoking or the consumption of alcohol, which may also be revealed on social media sites. Employers cannot use this information when making employment decisions.

Here are some guidelines to consider when conducting Internet searches:

  • Designate a search person. To avoid the potential misuse of information obtained from the Internet, employers may want to consider having a third party or designated individual within the company who is not involved in hiring decisions review information that is publicly available on social media.
  • Don’t take the information at face value. While some of the information you discover about a candidate may seem pertinent, such as the college where the candidate received their degree or the professional organizations to which he or she belongs, it’s important to realize that this information may not be accurate. Applicants and even other parties posing as the applicant may post erroneous information online. For these reasons, never make an employment decision based solely on information that was obtained online.
  • Be consistent. Employers who decide they want to perform social media searches should conduct these searches on a consistent basis. For example, it is a good idea to perform the searches at the same point in the hiring process every time, conduct searches on all candidates who made it to that point in the hiring process, and use the same search sites every time.

Note: A number of states prohibit employers from asking applicants and employees for login credentials to their social media and other personal online accounts. Even if your state does not expressly prohibit this practice, the likelihood of uncovering private and potentially protected information increases if an employer accesses an individual’s private accounts.