Mintz On Air: Practical Policies — Taking Your Candidates to the Vet

AI-generated applications, deepfakes, and new background check requirements are changing how employers vet candidates, but the stakes remain the same: identifying qualified hires while managing legal and business risk.

In this episode of the Mintz On Air: Practical Policies podcast, host Jen Rubin is joined by Mintz Associate and employment attorney Joyce Dos Santos to discuss:

• Common vetting mistakes, from failing to verify credentials to misusing criminal history information
• Compliance considerations under the FCRA, EEOC guidance, and state and local laws
• How inadequate or inconsistent screening can create unnecessary enterprise risk
• Why it’s important to tailor background checks to each position, but at same time ensure individualized assessment of employment candidates

Whether you’re an HR professional, in-house counsel, business leader, or board member, this episode offers practical guidance for understanding and implementing effective background check processes and managing legal risk arising from candidate vetting.

Mintz On Air: Practical Policies — Taking Your Candidates to the Vet Transcript

Jen Rubin (JR): Welcome to the Mintz On Air: Practical Policies podcast. Today’s topic: Taking Your Candidates to the Vet. I’m Jen Rubin, a Member of the Mintz Employment Group with the San Diego–based Bicoastal Employment Practice, representing management executives and corporate boards. I am in the business of providing creative and business-centered solutions to workplace legal problems. Thank you for joining our Mintz On Air podcast. If you have not tuned in to our previous episodes and would like to access our content, please visit the Insights Center at Mintz.com, or you can find us on Spotify. 

Today I’m pleased to be joined by my Employment Practice colleague, Joyce Dos Santos, a Boston-based management-side employment lawyer. Joyce represents employers in state and federal courts and before administrative agencies in matters involving discrimination, retaliation, harassment, whistleblower claims, wage and hour matters, and restrictive covenant disputes. Joyce is fairly new to Mintz, and I can’t think of a better way to roll out the welcome mat than to put Joyce in the hotseat to talk about everyone’s favorite topic, the background vetting process. Welcome, Joyce, and thanks for being here today. 

Joyce Dos Santos (JD): Greetings. Like you said, I’m brand new to Mintz but I am not new to labor and employment. It’s my absolute pleasure to be here with you today. 

Credentials for a Pug: Exploring the Legal Framework

JR: The inspiration for this episode goes back over a decade, when I tried a case relating to resume fraud. An executive my client had hired fluffed up his resume, and my client didn’t pick up on some red flags that would have disclosed that the executive had a degree from a diploma mill. (A diploma mill basically sells educational credentials to willing buyers.) I want my listeners to know that in the course of that case, I learned about the story of one Chester Ludlow, who had an MBA and a certificate of distinction in finance from Rochville University. Now, Rochville University turned out to be a diploma mill operating out of a post office in Dubai; and Chester Ludlow, it turned out, was a pug dog whose owners had purchased the degrees for him. Chester’s story is amusing, but the underlying problem is anything but, because credentials fraud has brought down senior executives at companies like Yahoo, RadioShack, Bausch & Lomb, and others.

If CEO-level hires slip through the cracks, what can employers do to protect themselves with respect to ensuring their employment candidates are vetted properly? And toward that vetting end, how do you verify credentials and backgrounds for employment candidates in a legally compliant manner? And importantly, are background checks even relevant to performance? 

Let’s start with the legal framework. Joyce, what laws govern how employers can and cannot screen job candidates?

JD: This will not come as a surprise to anyone who even dabbles in employment law, but there is a patchwork of federal, state, and local laws that regulate the employee background check process. If there’s one takeaway for employers from our conversation today, it’s that compliance is not optional, and the consequences of noncompliance can be severe.

In terms of regulations, first you have the big honcho, the Fair Credit Reporting Act. The FCRA is the foundational federal statute governing the use of consumer reports. That includes criminal background checks, credit reports, and other similar investigative reports used in employment decisions. The FCRA’s key requirements include providing written disclosure and getting an authorization before obtaining a report. There’s a notice process to the candidate if you’re going to take adverse action based on those results, and the candidate has a right to dispute inaccurate information.

My poor sweet older sister, who has never broken a rule in her life, had a doppelganger out there with her same name who was committing all sorts of shenanigans. And thanks to laws like the FCRA, my sister was able to dispute the fact and prove that it wasn’t her, it was actually her evil twin. Shout-out to her wherever that doppelganger is, probably still committing light crimes. 

Another thing employers can use is EEOC guidance. The EEOC has enforcement guidance on the use of arrests and conviction records in employment decisions, like for example blanket policies disqualifying applicants based on criminal history that may constitute disparate impact discrimination under Title 7. Employers should conduct individualized assessments that consider the nature of the offense, the time elapsed since the offense, and the nature of the job itself. There are also “ban the box” and fair chance laws that are growing rapidly across the country. And there are a growing number of state and local laws that are restricting when in the hiring process an employer can inquire about criminal history. Over 35 states and 150-plus municipalities have enacted some form of “ban the box” legislation. In addition to that, there are state-specific variations and state consumer reporting laws that impose requirements above and beyond the FCRA in restrictions on the use of credit checks in employment.

JR: It almost seems like it’s better to know nothing with this framework. There are so many laws that govern what information you can take in, and making hiring decisions and going through this background vetting process. But we do know that many employers have a good reason to use background checks, especially employers who hire employees who will have access to sensitive financial information, protected health information, even employee information that might include Social Security numbers and banking information. There’s a whole host of information we have to be careful about protecting in the workplace. 

Common Employer Mistakes in the Vetting Process

JR: What are employees typically being screened for, and why? What type of mistakes do you see when employers are doing the screening process?

JD: The first thing employers have to keep in mind is that the goal is not to find perfect candidates. The goal is to make reasonable, documented hiring decisions. One of the first mistakes I see employers make is failing to make sure they’re in compliance with criminal history check regulations, or properly analyzing the results they receive. There are county, state, and federal database searches. There are sex offender registry checks. Employers need to understand the difference between an arrest and a conviction. An arrest does not establish wrongdoing and generally shouldn’t be used as a standalone basis to exclude a candidate. An arrest is an allegation. A conviction is evidence that a legal process reached a conclusion. There’s also the risk of false positives and common name mismatches.

Other mistakes I see employers making include not confirming degrees and certifications in professional licenses directly with institutions. This is a robust area for fraudsters these days who are thriving on lax verification procedures. In addition to education and credential verification, employers should do a full employment history verification, confirming prior titles, dates of employment, and reasons for departure. There can be some challenges with that because some employers, as a matter of policy, will only confirm titles and last dates. But you should do as much due diligence as you can. Some employers will do a credit check as part of their vetting process — and there are growing restrictions under state law of when that is permissible. There’s also social media screening. Employers who are screening their candidates’ social media may expose themselves to claims that they considered protected class information that they wouldn’t have seen during a normal vetting process — information about the candidate’s race, religion, disability, pregnancy. 

These checks should be done by humans — and not just humans rubber-stamping AI, but humans conducting the verification process. 

JR: Indeed, because a human in the loop might have figured out that Chester Ludlow was a pug, right? That’s part of the problem with relying on documents and not going to the next level. Of course, that relates specifically to the educational and credential verification you just mentioned, which is a robust area for fraudsters. They know they can take advantage of procedures that aren’t properly followed through on. At the same time, we have some mistakes relating to not following many of these regulations that restrict, for example, use of criminal history in certain circumstances, relying on things like arrests, or even — and I’ve had this happen to at least one of my clients — a situation where a report comes back that says an individual was convicted of X crime, and it turns out it wasn’t even the right person. You mentioned your sister was the victim of fraud, right? These are real things that go on. It’s important that a human do that verification based on the information assembled, and ask some of those questions. 

Negligent Hiring

JR: We talked about the laws governing screening — what to do when screening, what not to do when screening. Are there any issues if an employer decides not to screen at all? 

JD: It’s a two sided liability trap, right? Employers face risk both from failing to screen adequately and from screening in ways that violate the laws.

That’s the negligent hiring risk if you fail to uncover information that would have been relevant, and the legal compliance risk if you overreached in background screening or used that information improperly. And if you don’t screen, you might miss the Chester Ludlows of the world and those bogus credentials. I similarly had a case like that — it was a Fortune 100 company who missed a bogus credential. And that causes embarrassment, distraction, even humiliation for the duped entities. But the consequences can extend well beyond reputational harm. There’s business harm, there’s a cost to your brand, to your share price, to your credibility before the board, and also to your organizational morale. They’re going to be picking up the pieces from a poor hiring decision.

And I mentioned earlier, negligent hiring. 

JR: And what is negligent hiring? 

JD: An employer may be liable in tort if it knew or should have known that an employee posed an unreasonable risk of harm to others. Failure to conduct a reasonable background check can be evidence of negligence. And on the flip side, if you conducted the background check, that could be evidence that you were not negligent.

This is really only applicable in situations where an employee is in a position where the employee is performing sensitive tasks such as driving, caring for the elderly, caring for children — though it can be relevant in the discrimination context when claims of harassment are asserted. I had a negligent hiring case where one employee assaulted another, and the assaulted employee brought a case saying that the employer was negligent in hiring the other employee because, had the employer done a more thorough background check, it would have shown that this person had a minor event like over a decade ago. But it really wasn’t a case of negligent hiring there because this was a front-desk position. It wasn’t one of those situations like I mentioned where it was more sensitive, or they were caring for a vulnerable population. Also, improper or inconsistent use of background check information can lead to Title 7 disparate impact claims.

JR: To me, one of the interesting aspects of negligent hiring — and I would say one of the mistakes I see committed by many employers — is applying a one-size-fits-all background check. I mentioned the type of employee who might have access to sensitive financial information or an otherwise sensitive position. You can see why doing a thorough vetting on that individual makes sense. But if you’re hiring somebody to sit at the front desk, for example, or you’re hiring somebody who’s doing marketing or some other type of office work, you wouldn’t necessarily need to go through that same analysis. And that is directly relevant to the negligent hiring issue. But I would go a step further and say it would also avoid some potentially thorny compliance issues if, in fact, you take in information you shouldn’t have taken in or didn’t use properly. So it’s important for employers to think about why they’re doing this vetting and what it’s aimed at, in addition to making sure it’s done properly. 

Background Checks: To Screen or Not to Screen

JR: We talked about how this is like a “darned if you do, darned if you don’t” scenario. You know, you do the background check, maybe you make mistakes or you disclose information, or the information turns out to not be accurate. And so you decide you’re not going to do background checks at all anymore because it’s expensive, it’s difficult, there are too many mistakes that are made. But then you don’t learn some information that would have disclosed the Chester Ludlows of the world. What should employers do under the circumstances if they want to have a legally compliant background check program that makes sense for their business? 

JD: I think you hit on a great point. Background checks can be expensive. They can be burdensome. A lot of employers will say that background checks are not a predictor of excellence, they’re not going to tell me if someone is innovative, whether they can lead, whether they will perform well. But they really are a risk management tool. They may help identify fraud risk, theft, violence concerns, fiduciary issues, regulatory disqualifications. And the key is job relevance. To have all the tools in your belt that you need, the first thing I always recommend is to use a qualified third-party vendor. I highly recommend it. It’s worth the money. Hire expert recruiters or investigators who are trained to conduct detailed background investigations. And you need to vet that company. Don’t hire just anybody. Ensure that they are FCRA compliant. You cannot fully abdicate the responsibility, unfortunately. Hiring a third-party vendor isn’t going to get you off the hook if something happens down the road. You can’t relieve yourself of the basic due diligence obligations regarding your candidates, including meeting candidates in person and exploring each individual’s skills and credentials, especially rather than having AI do all the work these days. The same principles should apply at every level of the conversation. Supervisors in HR should exercise independent judgment and not blindly outsource these tasks. 

Like you mentioned, you need to tailor background checks. This is not a one-size-fits-all model. Not every position requires the same level of scrutiny. You want to match the depth and type of screening to the risk profile of the position. So if you’re a chief financial officer, that may warrant a credit check because that person is in a fiduciary role. Roles involving vulnerable populations might warrant a more extensive criminal history check. And so on. 

With regard to policies, follow a consistent process. Inconsistency leads to sloppy practices, and sloppy practices lead to liability. You want to apply the same background check criteria to all candidates for the same role to minimize any claims of disparate treatment. 

Document, Document, Document

JD: Now you’ve done all this work, you’ve created a background check policy, you’ve gotten the third-party vendor. Now document your policy and implement an individualized assessment. For criminal history in particular, follow the EEOC’s guidance. Consider the nature and gravity of the criminal offense, the time elapsed, and the nature of the job before you make an adverse decision. 

One more thing that all employers can do is add representation to your employment agreements and your company handbook that misstatements about an employee’s background or credentials may result in termination. This creates a clear contractual basis for action if fraud is later discovered.

JR: I really appreciate that last piece because that’s something every employer can do. You can embed that right into a job offer letter so that when the new employee signs it, they understand that a condition of the offer is that they are making an appropriate representation about their background and credentials, and are verifying that to the employer. And of course, in formal employment agreements as well. There are certainly appropriate places to put those types of representations.

I think it’s easier, if something is unfortunately discovered later, to take action under those circumstances. 

Using AI in Background Checks

JR: No conversation can take place among employment lawyers these days without touching on AI. We’ve touched on it a little bit, but I want to drill down because everybody is aware of how AI is changing our workplace — particularly in AI-driven screening, remote hiring practices, AI sorting through credentials. All of these things present issues for employers, particularly given the rapidly changing regulatory landscape. How do these trends complicate the background check picture, Joyce? 

JD: You’ve hit on a bunch of topics that I’m seeing on a daily basis. There is increasing use of automated background check platforms in AI-based screening tools and a growing trend among states of increasing regulations of AI in employment tools, especially in screening tools.

The EEOC and the FTC have flagged concerns that algorithmic screening may impact protected classes, so employers may be liable for the outputs of the AI tools they use, even if they didn’t design the tools. New York City in particular has a local law that’s a bellwether for AI bias auditing requirements. And with the rise in remote work, when these candidates are hired remotely and may never set foot in the office, the traditional touchpoints for catching fraud are reduced.

So, Chester Ludlow would have been unmasked in his initial interview if this had been an in-person interview, which is an important fraud detection mechanism. There’s also continuous monitoring that’s complicating the background check process. There’s been a shift from these point-in-time background checks in hiring toward ongoing monitoring of criminal records, professional licenses, and other credentials throughout the employment relationship. That may not be legal in all states. Finally too there are the deepfakes in synthetic identity fraud, there are emerging risks where candidates use AI-generated deepfakes in video interviews, or fabricate entire professional identities. 

JR: So some people are going well beyond the Chester Ludlows of the world and creating entire histories. It almost causes you to lose faith. But don’t lose faith, I say to our listeners.

Key Takeaways from this Episode

JR:  I want to do a sum-up, because we’ve covered quite a bit of ground, and I think these points bear emphasizing.

Number one, background checks are not a check-the-box exercise. They require thoughtful design that is compliant with the applicable legal framework, and ongoing attention. It’s not something that just gets put in place once, it’s something people need to think about continuously. 

Along those lines, background checks should be tailored to the role. A one-size-fits-all approach is both over-inclusive and under-inclusive, and could lead to real liability. 

Employers should delegate to experts where appropriate, but that doesn’t mean the employer can abdicate responsibility. Somebody in the organization needs to own the process and exercise independent judgment. 

Employers need to know their legal obligations under the FCRA, EEOC guidance, and any applicable state and local laws. Employers need to keep current because that landscape is shifting rapidly. 

Document everything: policies, vendor agreements, and individualized assessments of candidates, including with respect to criminal background checks. It’s very important that employers go through the right steps. Those steps are heavily regulated. Consult your friendly employment lawyer for help in that regard.

Build contractual protections into your employment agreement so that credentials fraud might be unmasked earlier. Likewise, there could be a clear basis for termination if in fact a misrepresentation is made. 

Finally, and probably the most difficult: Stay ahead of emerging issues. AI screening, continuous monitoring of existing employees, gig worker vetting — there’s a constant change in these regulations at the federal, state, and municipal levels. It’s very important that you stay current with these regulations and that you change your processes as needed.

Joyce, thanks for joining me today. I really appreciate you stepping in. You’re so new to the firm, and you got put in the hotseat. But it was great to speak with you today. 

JD: My pleasure. Thanks for having me.

JR: For more information about our Employment Practice here at Mintz and to review other thought leadership, visit the Insights Center at Mintz.com, or you can look for our Mintz On Air: Practical Policies podcast on Spotify. Thanks again for joining us.

Subscribe To Viewpoints