Background checks: questions to answer before you apply

Two very different activities share this name. One is a defined check, made for a stated purpose, with the subject's knowledge, using sources that can be verified and corrected. The other is quietly assembling a picture of someone who has no idea it is happening.

The first is ordinary and often required. The second is intrusive, frequently inaccurate, and in a number of situations unlawful. This page is about the first, and about the line between them, because most of the harm in this area comes from people who thought they were doing the first.

What to take away

• If you are an employer, this is regulated, the details differ by country and by state, and the cost of getting it wrong is not theoretical.
• Do not compile a profile on a private individual who has not consented and has no idea it is happening.
• You are generally entitled to know a report is being obtained about you for employment, and to authorize it.

What makes a check legitimate

Three things, together. Missing any one of them and you are doing something else.

A purpose. A specific decision that the check informs: hiring for a defined role, letting a property, engaging a contractor, extending credit, entering a contract. "Curiosity", "due diligence" as a general feeling, and "I want to know who I am dealing with" are not purposes; they are moods.

The subject's knowledge and, where the law requires it, their written consent. For employment and tenancy screening in most jurisdictions, this is not a courtesy. It is the condition on which you are allowed to obtain the report at all.

Scope tied to the purpose. A check for a driving role looks at driving. A check for a finance role looks at financial conduct. Collecting everything available because it is available is the definition of the thing you are trying not to do.

Add a fourth in practice: a route for the person to see and correct what came back, because these records get things wrong more often than people expect.

Employment screening, done properly

If you are an employer, this is regulated, the details differ by country and by state, and the cost of getting it wrong is not theoretical. What follows is the shape of the process, not legal advice: check the current rules with the relevant regulator or an employment lawyer before you run anything, starting from the EEOC's guidance for employers on background checks.

The sequence in outline:

1. Decide what the role actually requires, in writing, before you look at any candidate. Which checks, and why each one is relevant to this job. Doing it in this order is what stops the check from becoming a search for a reason.
2. Disclose and obtain written authorization. In the US, where a third-party screening company produces the report, the disclosure that you may obtain it generally has to stand on its own rather than be buried inside an application form, and the candidate has to authorize it.
3. Use a screening provider that operates as a regulated consumer reporting agency, not a general search service. This matters because the regulated route carries accuracy obligations and a dispute process; the unregulated one carries neither.
4. Apply the results consistently, using criteria set in advance for every candidate for that role, and record the reasoning.
5. If the result may cost someone the job, tell them before you decide. The point of a pre-decision notice, with a copy of the report and a statement of their rights, is to give a real opportunity to correct an error, and identity mismatches are common enough that this step earns its keep.
6. Give the final notice if you still decline, including how to dispute the report with the agency that produced it.
7. Retain and dispose of the data properly. Restrict who can see it, keep it only as long as the purpose and the law require, and destroy it securely. Handling personal data you have collected is its own obligation, and the consumer reporting file most checks draw on, along with the dispute route attached to it, is described by the Consumer Financial Protection Bureau.

On criminal records specifically. Many jurisdictions restrict when you may ask, which records may be considered, and how far back you may go. Where a record can be considered, the defensible approach weighs the nature of the offense, how long ago it was, and its actual relationship to the duties of the job: rather than treating any record as automatically disqualifying. Rules on this move, so confirm the current position locally.

Things that turn a lawful check into a liability: running a search yourself instead of using the regulated process because it is faster; browsing a candidate's social media and letting what you see there influence a decision you cannot document; checking one candidate and not the others; and collecting information that reveals characteristics you are not permitted to consider.

Verifying a contractor, a tradesperson, or a professional

This is different work, and most of it is not about the person at all. You are checking credentials and a business, both of which are supposed to be checkable.

• The license, with the issuing body. Trade licensing boards, professional registers, and regulators publish verification tools. Check the license number against the register yourself; do not accept a photograph of a certificate.
• Insurance, from the insurer. Ask for the certificate and confirm it directly with the insurance company, including that it is current and covers the work in question.
• The legal entity. Look the business up in the companies or business registry for its jurisdiction: does it exist, is it in good standing, how long has it been registered, and does the name on the quote match the name that is registered?
• A real address and a real trading history. A registered address that is a mailbox, a website registered last month, and a phone number that only ever goes to voicemail are worth noticing together.
• References you actually call, chosen by you where possible from recent jobs of a similar type, with specific questions: what went wrong, how was it handled, was the final price the quoted price.
• Reviews, read for pattern rather than score. A run of short five-star reviews posted in the same week says less than one detailed complaint and how the business replied to it.
• The paperwork. A written scope, a written price, and a payment schedule that is not front-loaded. A demand for a large cash deposit up front is the most common warning in home improvement work.
• Complaint and disciplinary records where the regulator publishes them, and, where relevant to a large contract, whether the business has judgments or liens against it in the public court record.

None of this requires a report about a private individual. It is a check on a business's claims about itself.

Verifying a company you are about to transact with

Similar logic, shorter list: the registry entry, the registration or tax number on the invoice, a verifiable physical address, and, most importantly, bank details confirmed by calling a number you found yourself, never one supplied in the email carrying the invoice. Changed payment details arriving by message are the single most expensive fraud pattern in business, and no amount of background research substitutes for that one phone call. The message-level version of the same pattern is in phishing scams. The wider pattern is covered in impersonation scams.

The line, stated plainly

Do not compile a profile on a private individual who has not consented and has no idea it is happening. Not on a date, not on a neighbor, not on an ex, not on someone your relative is seeing, not on a person who annoyed you online.

The reasons are practical as well as ethical:

• It is often unlawful. Reports obtained through the regulated route may only be used for defined permissible purposes; personal curiosity is not one, and the general search services that sit outside that regime are not permitted to be used for decisions about employment, housing, or credit at all.
• It is unreliable. These compilations are aggregations of records matched on names and dates of birth. Common names get merged. Middle initials get dropped. Sealed and corrected records persist after they should have gone. People routinely find serious entries that belong to a stranger.
• It is dangerous to the subject. Address history, relatives, and workplace are precisely what is used to locate people who have deliberately made themselves hard to find. This is the machinery of stalking and of domestic abuse, whatever the intention of any individual user.
• It rarely tells you what you actually wanted to know. People turn to it about someone they already have doubts about. Doubts are enough. You can decline a date, end a conversation, or not do business without producing a dossier.

Do not use people-search or data-broker sites. They are not a shortcut to a regulated check, using them for a hiring or tenancy decision is a legal problem rather than a corner cut, and their data quality does not support the confidence people place in it. This site does not link to them.

Verifying that a person you met online is who they claim (a live video call, a reverse image search on a public profile photo), is a different and legitimate act, and it is covered in catfishing.

If you are the one being checked

• You are generally entitled to know a report is being obtained about you for employment, and to authorize it.
• If something in it costs you the job, tenancy, or credit, you are generally entitled to a copy and to be told which agency produced it.
• Dispute inaccuracies with the agency that produced the report, in writing, with documents. The agency has an obligation to investigate; the employer cannot fix it for you.
• Mixed files are common. If the report contains someone else's record, say so explicitly and give the identifying details that distinguish you.
• Check what is publicly visible about you before someone else does, not to hide anything, but because an old public post or a wrongly attributed record is easier to address when you know it is there. The visibility side of that is the work in privacy settings.

Specific rights, deadlines, and remedies vary by jurisdiction. Look them up with the relevant regulator rather than relying on a general description.

Common questions

Is it legal to look someone up before a first date?

Looking at what a person has chosen to make public is ordinary. Obtaining a background report about them, or building an address-and-relatives profile, is a different act: one that a regulated report is not permitted to be used for, and that can cause real harm if the person has reason to be hard to find. Verify that they are who they say they are, and decline the date if you are not satisfied.

Can I use a free search site to check a nanny or a cleaner?

Not for the decision. Where you are engaging someone in a position of trust and the law provides a proper vetting route (a regulated screening provider, an official criminal record check service, a professional register), use that route, with consent. It is more accurate, and it is the version that stands up.

How far back do checks go?

It depends on the jurisdiction, the type of record, and sometimes the salary or seniority of the role. There is no universal answer, and this is one to confirm with the relevant regulator rather than assume.

Something wrong is showing up about me. Where do I start?

With the agency that produced the report, not with the company that read it. Ask for your file, identify the specific entries that are wrong, and provide documents. If the entry belongs to a different person with a similar name, say that in those words.