Skip to content Skip to footer

Table of contents

This Federal Human Resources Manual is offered to you for free. Find state specific laws and regulations below.

Background checks — Federal

Because employers face increasing risk of liability for negligent hiring and for the conduct of their employees, employers are increasingly turning to the use of background checks to screen applicants for employment. An employer may be liable for negligently hiring or retaining an incompetent or unfit employee if the employer knew or reasonably should have known that the employee was a potential risk to others.

Background checks not only assist employers in hiring the most qualified candidate, but also help to protect other employees and third parties with whom the employer does business from employees who may be dangerous or have a record of criminal behavior. Employers have been sued for negligently hiring an employee who later injures someone as a result of his or her employment. For instance, if an employer hires someone with a criminal record to service products sold to customers, in their home and the worker commits a crime against the customer, the customer may bring a negligent hiring claim against the employer.

There is a “ban the box” movement that has taken place in several states and cities across the United States. This trend involves removal of questions regarding criminal history on an employee’s initial employment documents. Proponents of the movement argue that by removing questions regarding criminal history, employers are more likely to make unbiased judgments on a perspective employee’s qualifications without the stigma of a criminal record. In many places, the movement has cut across political and geographic lines. In some jurisdictions, these laws are only applicable to public employees.

Checking an applicant’s credit history

Credit checks may be performed for positions that involve financial responsibilities. However, the EEOC takes the position that credit checks may have an adverse impact on minorities. Thus, it is a good employment practice to limit the use of credit checks to positions for which there is a legitimate business necessity. Moreover, credit checks only should be performed where such checks are conducted for all applicants for a particular position.

Typically, credit reports can only be obtained through third-party entities that prepare such reports for a fee. As a result, the provisions of the Fair Credit Reporting Act (FCRA) usually apply to employers that obtain credit reports.

The FCRA (FCRA) has compliance requirements for employers who use consumer reports in making employment-related hiring, promotion and termination decisions. The term “consumer report” is defined very broadly by the FCRA as any written oral or other communication from a consumer reporting agency bearing upon the consumer’s credit worthiness, standing, credit capacity, character, reputation, personal characteristics or mode of living. It includes, among other things, motor vehicle, criminal background, bankruptcy and medical and credit history records that are used “in whole or in part” to assess an individual’s qualifications for employment. These consumer reports must be generated by a consumer-reporting agency for the FCRA to apply. Generally, the FCRA does not apply to an employer’s ability to conduct its own reference checks by contacting former employers or otherwise checking public records or documents. In other words, employers are allowed to obtain consumer credit reports on potential job applicants in order to determine an applicant’s eligibility for employment.

Employers may also obtain consumer credit reports on current employees who are being considered for promotion, demotion, reassignment or retention.

An investigative consumer report may include the same types of information – character, general reputation, mode of living. This type of information is obtained through interviews or discussions with co-workers, associates, relatives or others who know the individual personally.

There are three disclosure provisions under FCRA:

  1. An employer must obtain a written authorization form from applicant or employee before running a consumer report. This authorization must be a stand-alone form, not a notice or clause in an application.
  1. There must be a pre-adverse action notice when negative information is found. This requirement is often ignored because it can hamstring or slow the employer’s attempt to fill an open position. The law intends that the applicant or employee will have an opportunity to learn the negative information and respond to it.
  1. An employer must provide a post-adverse action notice if a decision was based on the negative consumer report. Then, the applicant or employee has a reasonable time to dispute and correct the information.

Prohibited decisions based on credit reports

The FCRA allows employers to use consumer credit reports for consideration or evaluation of an individual for employment, promotion, reassignment or retention by the employer. However, any other use is strictly prohibited. Also, even if an employer uses a credit report for legitimate employment purposes, the employer may still face liability if the extensive notification requirements are not met.

Notification requirements

Employers have to notify job applicants or employees in writing that the employer intends to review the applicant’s credit report to determine his or her eligibility for employment or promotion or other employment action. The written notice of the employer’s intention to obtain a consumer report must generally be in a document that consists solely of this notice. The employer must also obtain written consent from the applicant or employee that grants permission to the employer to obtain such a report.

Note: Federal Trade Commission (FTC) opinion letters indicate that an employer may combine the written notice and permission described in the above paragraphs on a single form, but nothing else may be included on this form.


An employer need only get one written consent from the applicant or employee during the employee’s tenure. The employer may obtain a credit report any time after the applicant or employee signs the disclosure and provides consent. In the event the applicant or employee refuses to give such written permission, the employer is prohibited from obtaining a credit report. Employers should discuss with counsel appropriate language to be used to notify the job applicants of the need for the report and the consent obtaining permission.

Employers must also certify to the consumer reporting agency that provides the report that the employer is complying with the notice requirements of the FCRA. If the employer fails to make these disclosures to the agency, the agency is prohibited under the FCRA from furnishing any credit report to the employer.

Adverse action notice

If an employer refuses to hire an applicant or takes other adverse action (for instance, declining to promote or retain an employee) against an employee based on information contained in the credit report, the employer must provide the applicant with a copy of the consumer report and make further disclosures to the applicant or employee. Such disclosures include notifying the applicant of the following:

  • adverse action has been taken (that is, declined to hire, retain or promote the individual)
  • the name, address and telephone number (including a toll-free number)  of the consumer reporting agency that furnished the report
  • the consumer reporting agency did not make the decision to take the adverse employment action and is unable to explain the reasons for such a decision
  • the applicant has the right to a free copy of the consumer report in question from the consumer reporting agency that provided the report if the request is made within 60 days from the date the action is taken
  • the applicant has a right to dispute the accuracy or completeness of any information contained in the report with the consumer reporting agency that issued the report.

Penalties for violations

Under the FCRA, both civil and criminal penalties may be imposed for violations. Violators may be held liable for actual damages, attorney’s fees and all court costs. Willful violators of the FCRA can be held liable for punitive damages.

The Consumer Financial Protection Act of 2010 added provisions to FCRA. The federal government launched the Consumer Financial Protection Bureau during the summer of 2011 after passage of the Act. More information is available at:

Employers should consult with counsel if they intend to use consumer credit reports as a background check tool in order to ensure full compliance with the complicated provisions of the FCRA.

Disposal of credit report documents

Employers need to be cautious in handling and disposing of employee and applicant documents that contain sensitive financial or personal information, such as:

  • Social Security number
  • address
  • phone number
  • date of birth.

Regulations passed incompliance with the Fair and Accurate Credit Transactions Act require every employer to take reasonable steps to dispose of documents containing information derived from consumer reports (as defined by the FCRA) to prevent unauthorized access to or use of consumer information. If an employer conducts credit checks or background checks on applicants or employees, the employer must comply with the “Disposal Rule” in regard to that information.

The Disposal Rule does not require any specific method of disposal, as long as it is reasonable and appropriate to prevent unauthorized access to and use of sensitive financial and personal information. Reasonable measures include shredding or burning. The regulations also contemplate that the employer will conduct due diligence if it hires an outside contractor to do its document destruction. Electronically stored data should be overwritten or erased in a manner that will prevent its retrieval or reconstruction.

The Disposal Rule also does not address when an employer should destroy information and does not require an employer to maintain or destroy any particular records. It merely regulates how the records are to be disposed of once an employer decides to dispose of them. An employer needs to be mindful to keep records for review if the employer is under investigation by the government or involved in litigation.

Failure to use reasonable care to dispose of covered documents could result in federal fines of up to $1,785,651. Companies also face the threat of lawsuits from employees whose information is obtained because the company failed to properly dispose of confidential information.

Although the Disposal Rule applies only to information derived from consumer reports, employers should take appropriate steps in the disposal of all records containing sensitive personal or financial information to prevent unauthorized access and use of such information, in order to reduce the risks of fraud and identity theft.

Other forms of background checks

An employer may turn to a variety of other sources of information in order to conduct a background check. Such sources include not only the consumer credit report discussed above, but also the following: reference checks, driving records, criminal records, polygraphs and drug tests. Applicants should be notified during the job application process that the employer will be conducting a background check to determine their eligibility for employment. Employers should notify applicants of the types of checks that will be conducted. As of 2016, if an employer requires the completion of background checks, they must put a notice of such information in their announcement for employment.

Reference checks

In most cases, it is advisable that employers check the personal and prior employment references listed by an applicant and document the information received or, if not successful, the efforts made. While the law does not require a written authorization from the applicant, employers normally should obtain such a broad authorization before conducting these reference checks. Additionally, employers might consider requesting a waiver from an applicant that releases former employers and the requesting employer from any claims relating to the reference check. With this type of waiver in place, a former employer may be more willing to give more relevant information about his or her former employees. An employer also should make sure it has a fully completed application to use as a resource in the reference check, including past employment history, references, names of immediate supervisors and educational background.

When contacting references, prospective employers should request basic information such as dates of employment, job duties, performance assessments, wage history, discipline record, tendency for violence, circumstances surrounding discharge and eligibility for rehire. Although a former employer may not be willing to respond on all of these topics, a prospective employer may shield itself from negligent hiring and subsequent negligent retention claims simply by asking appropriate questions and making notes of the responses given. In addition to asking relevant questions and listening closely to the answers, a prospective employer should take careful notes of information given by a reference, as well as all unsuccessful attempts made to contact references.

When an employer is asked to provide information regarding a former employee, the employer should consider adopting a policy of providing only “name, rank and serial number” information about former employees. Under such a policy, employers should decline to volunteer any subjective, speculative and/or undocumented information and provide only the dates of employment and the positions held by the employee. Most employers provide only this limited information in connection with reference checks for fear of a later lawsuit by the former employee alleging claims of defamation, slander, breach of privacy and/or retaliation.

Driving records

Employers should review the driving record of applicants for positions that would require the use of a company vehicle. Driving record checks should be conducted before an applicant is hired and then periodically throughout employment. When checking the driving record of an applicant, employers should confirm that an applicant has a valid driver’s license and review any driving violations, particularly past violations involving reckless driving and driving under the influence of alcohol. However, keep in mind that under the ADA alcohol related convictions cannot be used to discriminate against an applicant perceived to be an alcoholic or with a record of alcoholism. As discussed below, if the employer uses a third-party company to obtain this information, the Fair Crediting Reporting Act (FCRA) may be implicated.

Arrest records

The courts and the Equal Employment Opportunity Commission (EEOC) have stated that without proof of business necessity, an employer’s use of arrest records to disqualify job applicants is unlawful discrimination.

Because members of some minority groups are arrested substantially more often than Caucasians in proportion to their numbers in the population, making personnel decisions on the basis of arrest information without subsequent conviction information has a disproportionate effect on the employment opportunities of members of these groups.

Social media

Postings on social media sites may reveal information that would be helpful to an employer’s hiring decision. However, employers must know the risks of obtaining that information.

While some information on social media is perfectly okay to consider, information related to legally protected classes or information that would be sensitive in an employer-employee relationship, like an employee’s political affiliation, religious faith, pregnancy, disability or serious health conditions, are problematic. An employer that decides to perform a social media check should take steps to ensure that the hiring decision is not based on protected or sensitive information. One method of doing that is having a designated social media researcher who reviews social media content and scrubs improper information before providing it to the hiring decision-makers. Sometimes, it is better to steer clear of any social media information.

Note: An employer should only review social media content that is in the public domain or voluntarily made available. An employer should never require an applicant to provide their username or password to restricted information or otherwise attempt to gain access to a private account.

Conducting background checks

Request background information only if truly necessary

When obtaining background information of any kind, employers should be careful to ensure that the information obtained has some relevance to the job in question. Also, employers should ensure that the information obtained does not create a disparate impact upon members of a protected classification. If an employer obtains information that has no relevance to the job and that creates a disparate impact upon members of a protected group, the employer may be subject to a claim of discrimination.  

Be consistent in employment decisions

If an employer disqualifies an applicant because of information learned during a background check, the employer should be consistent in taking similar actions against other applicants or employees based on equivalent information about them. For instance, if an employer rejects an applicant because of a criminal conviction, the employer should reject other applicants or discharge current employees if the employer learns that they have similar convictions. Similarly, if an employer learns that an employee fabricated part of his or her work or educational experience when applying for the job, the employer should terminate the employee. Otherwise, the employer may undermine its ability to terminate other employees when resume fraud is discovered, as it is difficult for employers to assert that dishonesty is tolerated in some employees but is grounds for termination of other employees.

Use of third parties

Many employers choose to use a service when conducting background checks. Employers should ensure that they understand the process that will be utilized and how those services collect information. The contract for services should indemnify the employer should the service use any improper methods to conduct the search.