fraud awareness, prevention, and deterrence: are we doing enough

©2012

FRAUD AWARENESS, PREVENTION, AND DETERRENCE:

ARE WE DOING ENOUGH? EMPLOYMENT BACKGROUND CHECKS:

STOPPING EMPLOYEE FRAUD AT THE POINT OF ENTRY

Employee fraud is often caused by dishonest and fraudulent employees. An applicant who is

dishonest in obtaining a job may well be dishonest once in the job. This session will help

employers and fraud professionals avoid bad hires in the first place by practicing due diligence in

their hiring programs. It will also cover both best hiring practices and background checks,

including the current debate over the use of social media websites and credit reports in hiring.

LESTER ROSEN, J.D.

CEO

Employment Screening Resources

Novato, CA

Lester S. Rosen is an attorney at law and President of Employment Screening Resources

(www.ESRcheck.com), an accredited national background screening company headquartered in

California. He is the author of, The Safe Hiring Manual, the first comprehensive book on

employment screening and The Safe Hiring Audit.

He is also a frequent presenter nationwide on pre-employment screening and safe hiring

issues and has testified in court cases as an expert witness. Mr. Rosen was the chairperson of the

steering committee that founded the National Association of Professional Background Screeners

(NAPBS), and served as the first co-chairman.

“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,” “ACFE,” and the

ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of

this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without

the prior consent of the author.

http://www.esrcheck.com/

EMPLOYMENT BACKGROUND CHECKS:


23rd

Annual ACFE Fraud Conference and Exhibition ©2012 1

NOTES Why “Due Diligence” Is Mission Critical

Employees are typically a firm’s greatest investment and

largest cost. Each hire also represents a large potential risk.

Every employer has the obligation to exercise due diligence

in hiring. An employer who hires someone he either knew

or should have known was dangerous, unfit, or unqualified

for the work can be sued for negligent hiring.

Due Diligence Q & A

Question: What is a term that can be used to describe an

employer who fails to exercise due diligence in the hiring

process?

Answer: The term defendant, as in a party who is sued for

damages in a civil lawsuit for failure to perform a legal

duty.

The “Parade of Horribles”

Fraud, theft, and embezzlement

Statistical certainty that a firm that does not do

screening will hire someone with unsuitable criminal

record or false credential

Workplace violence

Time wasted in recruiting, hiring, and training

Termination exposure

Fraudulent credentials: Up to 40 percent of resumes

contain material lies or omissions about education, past

jobs, or qualifications

Turnover costs—two to three times their salary

Brand destruction—“just one bad apple”

Lost customers and workplace disruption

“Parade of Horribles” Defined

As a rhetorical device, a “Parade of Horribles” is used to

argue against taking a certain course of action by listing a

number of unpleasant predictions of extremely undesirable

events that will result from the action.



23rd


NOTES Fraud and Embezzlement

Issue: Embezzlers come disguised as your best employees.

Trust is needed to have access to money, since

embezzlement is a crime that is based upon an abuse of

trust. Background checks are critical, but inadequate as a

sole of line of defense in the absence of proper internal

controls.

Negligent Hiring Lawsuits Increasing and Employers

Are at a Disadvantage

Per a California survey, employers lose 60 percent of

negligent hiring cases with verdicts averaging about $3

million while the average settlement is $500,000 plus

attorney fees. Cases will normally have some sort of

serious harm (death, assault, rape, sodomy, child

molestation, theft, embezzlement, identity theft, etc.).

Employers have the ability, duty, and resources to prevent

harm through due diligence. Unless employer has a

compelling reason why an injury is not its fault, employers

often lose since jurors are often employees themselves.

Example of a Negligent Hiring Lawsuit

In November 2011, the family of a truck driver killed in

a 2008 accident in Arkansas was awarded $7 million in

damages in a wrongful death lawsuit brought against a

timber company and its truck driver in an Arkansas

Federal Court. Lawyers serving as counsel for the

family of the man killed in the accident argued that the

timber company had negligently hired the truck driver

who caused the accident without conducting a basic

background search that would have quickly revealed a

history of unsafe driving, including having his license

revoked twice. The case involved the timber company

truck driver’s qualifications to drive a commercial

vehicle and the timber company’s failure to

appropriately screen its drivers. Evidence was



23rd


NOTES introduced at the trial that the timber company truck

driver never should have been permitted to drive a

tractor trailer since he had lied on his application and

had received two license revocations, previous

infractions that the timber company could have easily

discovered with a simple background search that took

only 15 minutes and cost $15. The deadly crash

occurred only 19 days after the truck driver was

negligently hired by the timber company for the driving

job. The jury returned a unanimous verdict that

awarded $7 million to the victim’s family and found the

timber company 75 percent liable and its driver 25

percent liable. For more information, visit:

www.esrcheck.com/wordpress/2011/11/15/jury-awards-

7-million-dollars-to-family-of-truck-driver-killed-in-

accident-in-negligent-hiring-case/.

What Defenses Could an Employer Utilize?

Successful defenses have been:

Not foreseeable this would happen or too attenuated

There was nothing for a background check to reveal

We demonstrated due diligence but this hire fell

through the cracks despite our best efforts

Less successful defenses have been:

Applicant lied on application form and fooled us

Too costly

We were a victim of the criminal behavior too

Other firms in our industry do not perform checks

Other Reasons for Safe Hiring

What is the one question everyone will ask you if there

is a bad hire?

How much time do you have in addition to everything

else you are doing to be involved in litigation?

Certain industries have legal requirements.

http://www.esrcheck.com/wordpress/2011/11/15/jury-awards-7-million-dollars-to-family-of-truck-driver-killed-in-accident-in-negligent-hiring-case/





23rd


NOTES Under Sarbanes-Oxley, arguably background checks

are required as part of an environment of control under

Sec. 404 for positions involving access to financial data

or IT.

Strong evidence suggests that if people lied their way

into a job, they will be dishonest on the job.

Solution: A Safe Hiring Program

The solution is a Safe Hiring Program. A Safe Hiring

Program is a series of policies, practices, and procedures

designed to minimize the probability of hiring a dangerous,

questionable, or unqualified candidate. The critical pre-

screening elements—Application, Interview, and Reference

Checking—cost the employer nothing.

A Safe Hiring Program Consists of Five Core Areas:

Core Competencies Key Components

Organizational

Infrastructure

Have organizational commitment and

structure to a Safe Hiring Program. The

S.A.F.E System sets in place the

critical Policies, Practices, and

Procedures necessary for a Safe Hiring

Program.

Initial Screening

Practices

The AIR (Application, Interview, and

References) Process begins from the

first job announcement or

advertisement. It may also include an

initial identification check.

In-Depth Screening

Practices

These practices include a criminal

record check and other tools.

Post-Hire Practices

Practices include a continuing

commitment to a safe workplace even

after an applicant has been hired.

Legal Compliance

Practices

Practices include an awareness of the

legal and regulatory environment

surrounding safe hiring and

compliance.



23rd


NOTES Basics of Screening

S—Sources of information are public (e.g., criminal

records) and private records, verification of credentials

C—Consent in writing under Fair Credit Reporting Act

(FCRA) and state laws

R—Rationale (pre-employment screening discourages

applicants with something to hide, encourages honesty,

demonstrates due diligence, and helps to hire based on facts

and not just instinct)

E—Even-handed (similarly situated people treated

similarly)

E—Effectiveness (no single tool can be relied upon but

need series of overlapping tools)

N—Not an FBI check or Big Brother Watching but a

valuable due diligence employment tool

Not Screening: Gut Instinct Alone Insufficient

Employers cannot identify potentially bad hires by

detecting lies at interview. Studies show that even

though people believe they can detect liars, they have

only a 50/50 chance at best. Per a recent study, even

trained law enforcement officers and judges are

generally only right about half the time.

Many applicants tell the lie so often it comes across

naturally—they believe their own story—so body

language, eyes, and voice may not be reliable

indicators.

Insufficient Screening

There is no ONE definition of a background check.

Unless a firm is government regulated and screening

requirements are mandated, due diligence is a moving

target where a jury ultimately decides if an employer

exercised due diligence. Employers need to carefully



23rd


NOTES audit their current practices to ensure they are

practicing due diligence.

No National Criminal or Credentials Database

Employers should beware of using cheap databases as

substitute for due diligence. Contrary to popular belief,

there is no national database available to private employers

to check criminal records or false credentials. Fingerprint

checks from the FBI are only available when mandated by

law (e.g., teachers, child-care workers, banks, etc.). Private

databases are NOT official government databases but large

private “data dumps.” Databases can have false positives

and false negatives. The primary method for obtaining

criminal records is to physically look at each relevant

courthouse. There are more than 10,000 courthouses in the

United States with court records in over 3,200 jurisdictions.

Searches are subject to human error as well.

Issues with Database Searches

Employers using these databases for employment

purposes need to understand the limitations and legal

exposure associated with them or risk finding

themselves embroiled in litigation. Employers are

quickly discovering that fast and cheap online

background checks using criminal databases are not

always accurate or legal. Accurate background checks

are important because inaccurate or “stale” (not current)

information on background checks can disrupt the lives

and careers of employees and job seekers alike. Here

are just some of the issues with these databases.

Multi-jurisdictional databases are NOT official FBI

database searches. FBI records are only available to

certain employers or industries where Congress or a

state has granted access. Searches offered by “fast and



23rd


NOTES cheap” websites are drawn from government data that is

commercially available or has been made public.

So-called national criminal searches are a research tool

only and are not a substitute for a hands-on criminal

record search at the county level by researchers. The

best use for these databases is to indicate additional

places for a background-check firm to search.

Many states have very limited database information

available for employers. Examples of states where

databases may have limited value are California, New

York, and Texas.

Databases in each state are compiled from sources that

may not be accurate or complete and can contain results

that are false positives or false negatives. A person’s

name in a database is not an indication that person is

criminal any more than the absence of that person’s

name shows the person is not a criminal.

Database searches can be inaccurate due to searches

often being based on matching last name, the date of

birth, and the first three letters of the first name to

eliminate computer matches that are not applicable.

However, in some states, there is limited or no date of

birth information or a person may have been arrested

under a different first name.

There are also significant legal complications for

employers since any search from an Internet site for

employment is subject to the federal Fair Credit

Reporting Act (FCRA), which highly regulates

employment background checks. There are some

“instant criminal check sites” that do not bother to

make that clear or mention it only in the fine print.



23rd


NOTES Higher Duty for High Risk Positions

An employer’s level of liability increases with the level of

risk and the level of supervision and responsibility.

Examples where an employer’s duty is even greater with

applicants include:

Where there is contact or responsibilities with groups at

risk (youth, infirmed, aged)

Where this is a degree of authority and responsibility

such as a security guard or apartment manager

Where workers enter homes or where other unique risks

exist

Where there is access to personal data

Scope of Screening

Scope is a cost-benefit decision based upon the risk.

Employers can use:

County criminal searches based on a social trace report

(seven-year search)

Statewide searches where available

Federal records on PACER

Sexual offender

Driving records

Past employment verification

Education verification

Various disbarment lists

Application and Changes in the FCRA

The federal Fair Credit Reporting Act (FCRA) controls

screening. Employers must sign certification and all

screenings are done per legally written authorization and

standalone disclosure. Employers should beware of illegal

consent forms.

There is also a new statute of limitations—now five

years—under FCRA in certain situations.



23rd


NOTES Walkway point: It is CRITICAL to follow Pre-Adverse and

Post-Adverse Action procedures.

State Specific Laws

Numerous states have specific laws governing both the pre-

employment screening procedures in addition to the Fair

Credit Reporting Act (FCRA) and regulating the use of

information, such as criminal records or credit reports.

Some of the laws are aimed at background screening firms

and others at end-user employers.

Some U.S. States Have Stricter Background Check

Rules Than Others

At least twenty states arguably have stricter state FCRA

rules. The twenty states are: Arizona, California,

Colorado, Georgia, Kansas, Kentucky, Louisiana,

Maine, Maryland, Massachusetts, Minnesota, Montana,

New Jersey, New Hampshire, New Mexico, New York,

Oklahoma, Rhode Island, Texas, and Washington.

Also, state law for background screening can change at

any time.

Examples of State Rules

At least 11 states have a seven-year limit on criminal

records; some states have an exception if applicant has a

higher income level (but Texas and Colorado are

preempted by FCRA).

When Does the Seven-Year Limit Begin?

An ongoing question for employers and screening firms

is: “When does the seven years begin?” The Federal

Trade Commission published commentaries to the

FCRA, contained in the Code of Federal Regulations

(Code of Federal Regulations, 16 C.F.R. Ch. 1 1-1-97

edition Pt. 600 App.), intended to be interpretations of

the law and clarify how the FTC will construe the



23rd


NOTES FCRA in light of congressional intent as reflected in the

statute and legislative history. According to page 514 of

the commentary, the reporting time period is calculated

as follows:

“The seven-year reporting period runs from the date of

disposition, release or parole, as applicable. For

example, if charges are dismissed at or before trial, or

the consumer is acquitted, the date of such dismissal or

acquittal is the date of disposition. If the consumer is

convicted of a crime and sentenced to confinement, the

date of release or placement on parole controls.

(Confinement, whether continuing or resulting from

revocation of parole, may be reported until seven years

after the confinement is terminated.) The sentencing

date controls for a convicted consumer whose sentence

does not include confinement. The fact that information

concerning the arrest, indictment, or conviction of

crime is obtained by the reporting agency at a later

date from a more recent source such as a newspaper or

interview does not serve to extend this reporting

period.”

However, a court record will only indicate the date the

sentence was imposed by the court and the length of the

sentence. It is not always possible to tell from the

docket or court record when the confinement actually

ended, since the release date from custody is often NOT

contained in the court file. The date is actually

contained in files maintained by the county jail or

probation office for a county sentence, or by the state

Department of Corrections for a state prison sentence.

Information from these offices is not easily accessible

without a subpoena.



23rd


NOTES The logical conclusion is the FCRA intends to not

count as part of the seven-year rule any time not spent

in confinement. The seven years starts when a person is

out of custody, even though he or she may still be on

parole or probation. Sometimes a case older than seven

years is brought back into the seven-year rule if a

person is jailed for having violated probation or parole

within the seven-year period; if so, rule starts over

again.

Various states have special rules for:

Disclosure form for consumer

Rules for investigative consumer reports

Nature and scope letter

Disputed accuracy procedures

Timing and notice of reports

Notification periods

Other examples include:

CA—numerous “only in California rules”

MA—final adverse action letter must be in ten point

type minimum within ten days with specified language

NJ—special notifications of reason why dispute is

frivolous

NY—special criminal notice

TX—“deferred adjudication”

EEOC Implications of Criminal Records and Scoring

Procedures

The Equal Employment Opportunity Commission (EEOC)

rules govern criminal convictions and arrests. Per the

EEOC, employers cannot automatically disqualify an

applicant based on a criminal conviction without a business

justification, taking into account the nature and gravity of

the offense, the nature of the job, and the time elapsed.

Also, new laws in New York effective February 2, 2009,



23rd


NOTES underscore the importance of no automatic decisions. Other

states and cities have “banned the box” (the question on

application forms asking job applicants about past criminal

convictions).

Arrests have limited use—employers need to locate and

evaluate underlying behaviors if possible. But if person

lied, then the falsehood can be the grounds to deny

employment.

Employers should be careful using automated scoring

system (red, orange and green lights); it can create an issue

under EEOC rules because of the automated nature of the

decision making without an outlet for individualized

consideration. The rule for screening and reference checks

is: Employers cannot ask about information you could not

ask an applicant face to face.

“Ban the Box” Movement Aims to Remove Arrest

Question on Applications

The issue of whether employers can use a job

application to ask about an applicant’s criminal record

is becoming more complicated. In an effort to provide

fair employment opportunities for ex-convicts, some

states, cities, counties, and local governments across the

country are joining the “ban the box” movement and

removing the “box” job applicants are asked to check

next to the question on the job application asking about

past criminal arrest and convictions to give those

applicants with criminal pasts a fair shot at obtaining

employment. By removing this question, supporters

claim job applicants can be sure that they will not be

automatically excluded for consideration for a job

because of their past mistakes.

A July 2011 resource guide from NELP, “Ban the Box:

Major U.S. Cities and Counties Adopt Fair Hiring



23rd


NOTES Policies to Remove Unfair Barriers to Employment of

People with Criminal Records,” lists the following

cities and counties as having already banned the box

asking applicants about felony convictions: Alameda

County, CA; Austin, TX; Baltimore, MD; Berkeley,

CA; Boston, MA; Bridgeport, CT; Cambridge, MA;

Chicago, IL; Cincinnati, OH; Detroit, MI; Hartford,

CT; Jacksonville, FL; Kalamazoo, MI; Minneapolis,

MN; Multnomah County, OR; New Haven, CT;

Norwich, CT; Oakland, CA; Philadelphia, PA;

Providence, RI; San Francisco, CA; Seattle, WA; St.

Paul, MN; Travis County, TX; Washington, DC; and

Worcester, MA.

The resource guide is at: www.nelp.org/page/-

/SCLP/2010/BantheBoxcurrent.pdf?nocdn=1.

Policy on Convictions and Arrests

Remember, people who have made mistakes but have

repaid society need jobs in order to live law-abiding lives

and be tax-paying citizens. It costs more than $30,000 a

year to keep a person in custody. Society does not want to

create a permanent criminal class of unemployable citizens.

However, due diligence requires the right person in the

right job. Employers should have a policy that the employer

maintains a safe workplace and will conduct a strict review

of any applicant with a criminal record, but there is no

automatic disqualification. Employers should go through an

individualized process, taking EEOC factors into account.

Credit Reports

A new development is that credit reports are a potential

issue under EEOC rules. Credit reports can invade privacy

and potentially be discriminatory unless measures are taken

http://www.nelp.org/page/-/SCLP/2010/BantheBoxcurrent.pdf?nocdn=1

http://www.nelp.org/page/-/SCLP/2010/BantheBoxcurrent.pdf?nocdn=1



23rd


NOTES to ensure their use is fair, accurate, and relevant. The issue

is “Disparate Impact.”

Employment credit reports do NOT utilize credit scores.

Seven states now limit use of credit reports with more

expected: CA just passed AB 22 and joins Connecticut,

Hawaii, Illinois, Maryland, Oregon, and Washington.

Employers need to clearly establish job-related reasons

why a credit report is a valid predictor of job performance.

Typical reasons are:

Debt-to-income ratio

Inability to handle own finances

Credit reports can have errors. Applicants are entitled to

their FCRA rights if a credit report is used adversely in any

way. Credit reports do not stop embezzlement. Employers

need internal controls.

SHRM Survey Shows Employment Credit Report

Checks More Common

According to a 2010 survey from the Society for

Human Resource Management (SHRM), “Conducting

Credit Background Checks,” 60 percent of employers

polled conducted credit checks on some or all job

applicants.

47 percent of employers surveyed conducted credit

checks on job candidates for selected jobs.

40 percent of employers surveyed did not conduct

any credit checks on job candidates.

13 percent of employers surveyed conducted credit

checks on all job candidates.

When asked in the SHRM survey which categories of

job candidates their organization conducted credit

background checks on:



23rd


NOTES 91 percent of employers surveyed said job

candidates with fiduciary or financial responsibility.

46 percent of employers surveyed said job

candidates for senior executive positions.


candidates with access to highly confidential

employee information.


candidates with access to company/other property.

As for the primary reason organizations conducted

credit background checks on job candidates, the SHRM

survey found:

54 percent of employers surveyed said to reduce or

prevent theft, embezzlement, and other criminal

activity.

27 percent of employers surveyed said to reduce

legal liability for negligent hiring.

In addition, nearly 2 out of 3 organizations polled in the

SHRM survey—65 percent—said they would allow job

candidates the opportunity to explain the results of their

consumer report that might have an adverse effect on an

employment decision after the credit report check but

before the decision to hire or not hire was made.

The SHRM Poll is available at:

www.shrm.org/Research/SurveyFindings/Articles/Page

s/BackgroundChecking.aspx. To download ESR’s

complimentary white paper ‘Use of Credit Reports in

Employment Background Screening,’ visit

www.ESRcheck.com/Download.

http://www.shrm.org/Research/SurveyFindings/Articles/Pages/BackgroundChecking.aspx

http://www.shrm.org/Research/SurveyFindings/Articles/Pages/BackgroundChecking.aspx

http://www.esrcheck.com/Download



23rd


NOTES In-House Processes

The application, interview and reference checking

processes are critical and will be reviewed in detail in any

litigation.

For applications:

Get consent for background checks since it discourages

people with something to hide.

Ask about past criminal record in broadest language

allowed by law.

Review for failure to answer questions or omissions.

Nearly every time there is a problem hire, there was a

“Red Flag” on the application.

Don’t limit questions to just misdemeanors.

Review Application for Ten Red Flags

1. Applicant does not sign application.

2. Applicant does not sign release.

3. Applicant leaves criminal questions blank (the honest

criminal syndrome).

4. Applicant self-reports offense.

5. Applicant fails to identify past employers.

6. Applicant fails to identify past supervisors.

7. Applicant fails to explain why left past jobs.

8. Applicant doesn’t explain employment gaps.

9. Applicant makes explanations for employment gaps or

leaving past jobs that do not make sense.

10. Applicant makes excessive cross-outs and changes.

The Five Critical Questions

Question 1: We do background checks on everyone we

make an offer to. Do you have any concerns that you

would like to discuss?

Question 2: We also check for criminal convictions for

all finalists. Do you have any concerns about that?



23rd


NOTES (Make sure question reflects what employer may

legally ask in your state)

Question 3: We contact all past employers. What do

you think they will say?

Question 4: Will your past employer tell us that e.g. you

were tardy, did not perform well, etc.?

Question 5: Ask questions about any unexplained

employment gaps.

Past Employment Checks as Critical as Criminal

Checks

It is critical for employers to verify employment to

determine where a person has been (even if they only get

dates and job title). Otherwise they are hiring a stranger.

Employers should be looking for unexplained gaps and for

locations to search for criminal records.

There are more than 10,000 courthouses in the United

States, so employers need to know where to search. If they

can verify that a person was gainfully employed in the last

5–10 years, it is less likely that he or she spent long periods

in custody.

Just attempting and documenting effort at screening

demonstrates due diligence.

Vendors, ICs, and Temps

Firms that would never hire a criminal often allow vendors,

independent contractors (ICs), and temporary workers

(temps) on the premises with no idea who they are. Non-

employees can have access to computer systems, trade

secrets, and customer lists.

For temps, employers need to review with the staffing firm

their due diligence standards.



23rd


NOTES

Screening from the Staffing Firm’s Point of View

Today, more and more staffing firms are conducting

background checks on applicants before sending them

to client locations. Some staffing firms have learned the

hard way that failure to spend a few dollars to conduct

due diligence can result in millions of dollars spent,

should a dangerous criminal or imposter be sent to

work for a client. Every worker sent by a staffing firm,

PEO, or recruiter into a client’s workplace has the

potential to put the staffing vendor out of business.

Solutions? Staffing firms need to be open with clients

about disclosing the nature and scope of their

background checks. It is critical for any staffing firm or

recruiter to be very clear with a client on the issue of

background checks, including if background checks are

performed, who pays for it, what criteria is used, and

who reviews the reports. If a business wants to review

the background report, the staffing firm should ensure

that the worker has signed an appropriate release.

International Screening

A growing trend is that employers are responsible for

international checks. They are part of due diligence if

applicant has spent time abroad or if past employment or

education is outside the United States. Many resources are

available to check international employment, education,

and credentials. The ability to do international criminal

checks is developing. Terrorist databases are available but

they have limits.

Why Should U.S. Employers Conduct International

Background Checks and Verifications?

Foreign-Born U.S. Residents: The U.S. Census

found that there are 38.5 million foreign-born U.S.



23rd


NOTES residents, representing 12.5 percent of the

population, in October 2010.

U.S. Legal Permanent Residents (LPRs): The

Office of Immigration Statistics (OIS) revealed

1,130,818 persons became Legal Permanent

Residents of the U.S. in 2009.

Unauthorized Immigrants: The Department of

Homeland Security (DHS) estimates 10.8 million

unauthorized immigrants were residing in the U.S.

in January 2009.

U.S. Citizens Spending Time Abroad: Many U.S.

citizens have spent time traveling on vacation or

living, working, and attending school in a foreign

country.

The ESR white paper “Introduction to International

Background Screening” is available at


Be Careful Using Facebook, Google, Twitter, and

Similar Services

Using social media can expose employers and recruiters to

discrimination claims if an Internet search reveals protected

data such as nationality, race, religion, age, or medical

issue. There are issues of appearance, grooming, or

religious affiliations revealed by photos.

Other questions include:

Is there a reasonable expectation of privacy based on

the terms of use and generally accepted standards?

Issue of identifiers and authenticity—is it really the

applicant in question?

Can employers consider off-duty conduct?

What should employers, recruiters, schools, and

applicants do?




23rd


NOTES An emerging hot issue is asking for passwords or shoulder

surfing.

Facebook Warns Employers Not to Ask Applicants

for Social Media Passwords

Responding to an increase in reports of employers

seeking to gain “inappropriate access” to social network

profiles of job applicants, online social media giant

Facebook issued a warning to employers in a recent

blog posted on the company website—“Protecting Your

Passwords and Your Privacy”—that the practice of

asking job applicants for their social media passwords

“undermines the privacy expectations and the security

of both the user and the user’s friends” and could

potentially expose businesses to “unanticipated legal

liability.”

In a blog dated March 23, 2012, Erin Egan, Facebook’s

Chief Privacy Officer, responded to recent news reports

of employers “seeking to gain inappropriate access” to

the social media profiles of job applicants and

employees. She also said that Facebook would “take

action to protect the privacy and security” of users and

consider “initiating legal action” where appropriate.

The warning from Facebook comes at a time when so-

called social-media background checks of job

applicants are becoming more prevalent and more

controversial. More news stories have appeared

recently concerning social media background checks

where prospective businesses, government agencies,

and colleges are increasingly curious about the online

life of potential workers and students. While some

employers review public social networking websites

such as Facebook to learn about job candidates, many

users have their social media profiles set to private,



23rd


NOTES which makes them available only to selected people and

more difficult for employers to view. The blog is

available at: www.facebook.com/notes/facebook-and-

privacy/protecting-your-passwords-and-your-

privacy/326598317390057. For more information about

social media screening, download the complimentary

white paper “Managing the Risks of Using the Internet

for Employment Screening Background Checks” at


Offshoring PII

California passed SB 909 effective January 1, 2012,

requiring disclosure to consumers if information is

offshored (sent outside the United States) for processing.

Authorization forms must have a background firm’s

privacy policy, and the background firm must

conspicuously post their privacy policy and specific

information about offshoring. The issue is screening firms

possess large amounts of personally identifiable

information (PII) and large firms send it to places like India

and Philippines for processing, beyond the protection of

U.S. privacy laws.

Dangers of Background Check Firms Offshoring

Personal Data of Americans Outside of U.S.

Revealed in Whitepaper

To alert U.S.-based employers and job seekers about

the potential dangers caused by background check firms

“offshoring” personally identifiable information (PII) to

countries such as India and the Philippines,

Employment Screening Resources (ESR) is offering a

new whitepaper on the subject. The whitepaper written

by ESR founder and CEO Attorney Lester Rosen is

titled “The Dangers of Offshoring Personally

Identifiable Information (PII) Outside of United States”

and details the hazards of sending PII to counties that

http://www.facebook.com/notes/facebook-and-privacy/protecting-your-passwords-and-your-privacy/326598317390057






23rd


NOTES are well beyond the reach of U.S. privacy and identity

theft laws. The complimentary whitepaper is available

at: www.esrcheck.com/Download/.

The whitepaper defines offshoring as the practice of

some U.S. companies routinely sending the PII of

American consumers to foreign countries with cheaper

production and labor costs to increase profits. PII is

defined as data used for distinguishing individual

identity and may include: full name, birthday and

birthplace, Social Security number (SSN), vehicle

registration plate number, driver’s license number,

credit card number, and national identification number.

To help combat offshoring of PII, a group of more than

125 like-minded Consumer Reporting Agencies

(CRAs) formed the industry group Concerned CRAs

that endorses and subscribes to a set of standards that

opposes the processing of consumer reports outside of

the United States. For more information, visit

www.concernedcras.com/no_offshoring.htm.

As a member of Concerned CRAs, Employment

Screening Resources (ESR) does not offshore PII and

all processing and preparation of background checks

are performed exclusively in the United States, with the

only exception being international verification using

information outside the United States. ESR was also the

third U.S. background screening firm to become “Safe

Harbor” certified for data privacy protection.

NAPBS Accreditation Program

National Association of Professional Background Screeners

(NAPBS)—www.NAPBS.com—has formulated in-depth

accreditation program covering information security,

compliance, client education, information providers, and

http://www.esrcheck.com/Download/

http://www.concernedcras.com/no_offshoring.htm

http://www.napbs.com/



23rd


NOTES business practices. It is an intensely detailed process

confirmed by third-party professional onsite audit. Since

background screening is loosely regulated if at all,

employers should consider only dealing with NAPBS

accredited firms.

NAPBS Background Screening Agency

Accreditation Program (BSAAP) Standards for

Consumer Reporting Agencies (CRA)

* Section 1—Consumer Protection: 1.1 Information

Security Policy, 1.2 Data Security, 1.3 Intrusion,

Detection and Response, 1.4 Stored Data Security, 1.5

Password Protocol, 1.6 Electronic Access Control, 1.7

Physical Security, 1.8 Consumer Information Privacy

Policy, 1.9 Unauthorized Browsing, 1.10 Record

Destruction, 1.11 Consumer Disputes, 1.12 Sensitive

Data Masking, and 1.13 Database Criminal Records

* Section 2—Legal Compliance: 2.1 Designated

Compliance Person(s), 2.2 State Consumer Reporting

Laws, 2.3 Driver Privacy Protection Act (DPPA), 2.4

State Implemented DPPA Compliance, 2.5 Integrity,

2.6 Prescribed Notices, and 2.7 Certification from

Client

* Section 3—Client Education: 3.1 Client Legal

Responsibilities, 3.2 Client Required Documents, 3.3

Truth in Advertising, 3.4 Adverse Action, 3.5 Legal

Counsel, 3.6 Understanding Consumer Reports, and 3.7

Information Protection

* Section 4—Researcher and Data Product

Standards: 4.1 Public Record Researcher Agreement,

4.2 Vetting Requirement, 4.3 Public Record Researcher

Certification, 4.4 Errors and Omissions Coverage, 4.5

Information Security, 4.6 Auditing Procedures, 4.7



23rd


NOTES Identification Confirmation, and 4.8 Jurisdictional

Knowledge

* Section 5—Verification Service Standards: 5.1

Verification Accuracy, 5.2 Current Employment, 5.3

Diploma Mills, 5.4 Procedural Disclosures, 5.5

Verification Databases, 5.6 Use of Stored Data, 5.7

Documentation of Verification Attempts, 5.8

Outsourced Verification Services, 5.9 Conflicting Data,

5.10 Professional Conduct, and 5.11 Authorized

Recipient

* Section 6—General Business Practices: 6.1

Character, 6.2 Insurance, 6.3 Client Credentialing, 6.4

Vendor Credentialing, 6.5 Consumer Credentialing, 6.6

Document Management, 6.7 Employee Certification,

6.8 Worker Training, 6.9 Visitor Security, 6.10

Employee Criminal History, 6.11 Quality Assurance,

and 6.12 Certification

New Trend—Ongoing Checks

Some employers are looking at “continuous” screening that

occurs periodically after hiring. The argument: Employees

may commit crime after being hired. The issues:

Accuracy: In some states, the screening is through a

database subject to false positives and false negatives.

Cost: What will be the return on investment given the

time, cost, and administrative issues involved?

Value: If a person is in custody for a criminal offense,

he or she presumably will not show up to work.

Legal Use: What rules or criteria are to be used if a

criminal matter is found?

Education and Employment Fraud

Background screening firms report a high percentage of

degree fraud. This can range from people claiming that they



23rd


NOTES graduated even though they were short credits to lying

about attending the school to presenting worthless degrees

from diploma mills. Also, applicants can now get very

generic-looking fake diplomas on the Internet for most

schools in the United States. Employees can run the term

fake schools on LinkedIn and see how many worthless

degrees are claimed. There are now sites providing fake

employment histories.

Report Reveals 48 Percent Increase Worldwide in

Diploma Mills in 2010

The second annual Accredibase™ Report for 2011

revealed an astounding 48 percent increase worldwide

in the number of known fake diploma mills in 2010.

According to the report, the United States was the

world’s fake college capital and saw a 20 percent

increase in known diploma mills.

The top five U.S. states with the highest number of

diploma mills—which the report described as “largely

online entities whose degrees are worthless due to the

lack of valid accreditation and recognition”—were:

California (147), Hawaii (98), Washington (91), Florida

(84), and Texas (68).

Accredibase™, Verifile’s proprietary database of

diploma and accreditation mills, has identified

approximately 5,000 suspect educational institutions

and accreditors. In addition to the 2,615 confirmed

diploma mills known to Accredibase™, more than

2,000 suspect institutions are currently under

investigation for inclusion in the database. The second

annual Accredibase™ Report for 2011 is available at:

www.accredibase.com/index.php?section=871&page=4

493.

http://www.accredibase.com/index.php?section=871&page=4493

http://www.accredibase.com/index.php?section=871&page=4493



23rd


NOTES Top Ten Background Check Trends of 2012

1. Criminal Background Checks by Employers Under

Scrutiny by EEOC

2. Credit Report Checks by Employers Increasingly

Regulated by State Laws

3. Social Media Checks of Job Applicants More Prevalent

and Controversial

4. Automation in Screening Increases Both Efficiency and

Risks

5. NAPBS Accreditation Program Proof of Increased

Professionalism in Industry

6. Diploma Mills Offering Fake Degrees Increasing in

Tight Job Market

7. Lawsuits Increase as Attorneys and Consumers Become

Familiar with FCRA

8. New E-Verify Laws Create Complex Web of Federal

and State Rules

9. Offshoring PII Outside U.S. Increases Privacy and

Identity Theft Concerns

10. Self-Background Checks Proactively Conducted by Job

Seekers

ESR Releases “Top Ten Trends in Background

Checks” for 2012

For the past five years, Employment Screening

Resources (ESR) has compiled the ‘ESR Top 10 Trends

in Background Checks’ list featuring emerging and

influential trends in employment screening background

checks as selected by ESR’s Founder and CEO

Attorney Lester Rosen. With help from the ESR team,

Rosen carefully selected each trend after closely

reviewing:

* Evolving hiring practices and demographics

* Legal cases concerning background checks

* Advancements in background check technology



23rd


NOTES * New government regulations for screening at the

federal and state level

* Questions and concerns raised by employers,

recruiters, human resources professionals, and the

security industry regarding background checks

The fifth annual Employment Screening Resources Top

Ten Trends in Background Checks for 2012 available at

www.esrcheck.com/ESR-Top-10-Trends-in-

Background-Checks-for-2012.php.

Audit Your Practices

Employers can audit their hiring practices by taking the

Safe Hiring Audit. For more information, see:

In the “Safe Hiring Audit” section of this paper

www.esrcheck.com/articles/Safehiringaudit.php.

Warning: Do it as an education tool or through your

attorney only. Do not create a document that will be used

against you in litigation.

The Safe Hiring Audit

Goals: Perform a self-assessment audit of procedures in

chronological order.

Use audit to identify strengths and weaknesses, areas

that need improvement, and compliance.

Caution: This is for educational purposes only—do not

create a document that can be used against your

organization in court.

A formal audit can be conducted with assistance of the

firm’s attorney using attorney-client or work product

privilege.

Advantages of a Safe Hiring Audit

General rule: Members of an organization accomplish

those things that are audited, measured, and rewarded.

http://www.esrcheck.com/ESR-Top-10-Trends-in-Background-Checks-for-2012.php

http://www.esrcheck.com/ESR-Top-10-Trends-in-Background-Checks-for-2012.php

http://www.esrcheck.com/articles/Safehiringaudit.php



23rd


NOTES A Safe Hiring Program will be most effective if

everyone involved clearly understands that they will be

audited periodically, and their compensation depends in

part on results.

Otherwise, hiring managers may just assume that the

Safe Hiring Program is just the “flavor of the day” from

the central office.

Audit trail must go all the way up the organization.

Scoring the Safe Hiring Audit

A is 4 points: Your operations could be a model for

others—all procedures are documented and reviewed

by legal.

B is 3 points: You have taken strong measures but

additional documentation or review is needed.

C is 2 points: You have taken some measures but need

to improve.

E is 1 point: You have taken some measures but are

falling noticeably short as to what an employer should

do.

F is 0 points: You are doing nothing or out of legal

compliance.

Take the Safe Hiring Audit

The Safe Hiring Audit consists of 25 questions:

1. Does your organization have written policies, practices,

and procedures for safe hiring?

2. Are the safe hiring policies, practices, and procedures

reviewed and updated every year?

3. Are the organization’s policies and procedures on safe

hiring communicated effectively to the workforce and

managers?

4. Is there documented organizational responsibility for

safe hiring with consequences of not following the

program spelled out?



23rd


NOTES 5. Are tools and training in place to ensure hiring

managers follow a Safe Hiring Program?

6. Is a procedure in place to audit all the safe hiring

practices?

7. Are all hiring policies and practices reviewed for legal

compliance?

8. Is the Fair Credit Reporting Act (FCRA) followed if

third-party firms are involved in screening?

9. Are there procedures to place applicants on notice that

your organization engages in “Best Practices” for

hiring?

10. Does your firm use an application form?

11. Does the application form have all necessary and

correct language?

12. Are completed applications reviewed for potential red

flags including employment gaps?

13. Are the five critical questions used in a structured

interview?

14. Are interviewers trained in legal compliance?

15. Does the firm check past employment?

16. Does the firm check education credentials?

17. Is the firm conducting an appropriate search for

criminal records?

18. Does the firm understand the appropriate uses and the

limitations on criminal record databases?

19. Are the firm’s policy and procedures for the use of

negative criminal information legal and compliant with

federal and state laws?

20. Does the firm use other screening tools and, if so, is the

information used in accordance with safe hiring

guidelines?

21. Are the mechanics of your screening program

documented?

22. If screening is outsourced to a third-party firm, can the

employer demonstrate due diligence and show

procedures are being used per FCRA?



23rd


NOTES 23. Are procedures in place if a person with negative

information is hired?

24. Are procedures in place if employment is offered before

a background check is completed?

25. Does the organization have written policies, practices,

and procedures for screening essential non-employees?

Conclusion: How Do Your Safe Hiring Measures Add

Up?

After taking the Safe Hiring Audit to assess their screening

practices, employers should begin a program of improving

those areas with potential litigation exposure and should

consider using resources available from an accredited

background screening provider. Once you have completed

the 25 questions in the Safe Hiring Audit, add the scores of

each question (using the 0-4 point scoring system) to find

the overall score. Divide the overall score by 25 to find the

average score for each question. For instance, if the total

score is 75 points, the average score would be 3 points for

each question (75 ÷ 25 = 3).

If your overall score is less than 75 points, meaning an

average score of less than 3 points for each question,

you have some work to do to improve your safe hiring

practices.

Thank You

For more information about Safe Hiring, see:

ESR website: www.ESRcheck.com

Email Les Rosen: [email protected]

ESR News Blog: www.ESRcheck.com/wordpress/

The Safe Hiring Manual: The Complete Guide to

Keeping Criminals, Terrorists, and Imposters Out of

Your Workplace (Facts on demand Press/512 pages)


mailto:[email protected]

http://www.esrcheck.com/wordpress/



23rd


NOTES The Safe Hiring Manual (Facts on Demand Press/288

pages)

Selected Stories from the ESR News Blog

New California Background Check Laws Impacting

Employers Take Effect January 1 2012:

www.esrcheck.com/wordpress/2011/12/22/new-

california-background-check-laws-impacting-

employers-take-effect-january-1-2012

Facebook Warns Employers Asking Job Applicants

for Social Media Passwords May Expose

Businesses to Legal Liability:

www.esrcheck.com/wordpress/2012/03/26/faceboo

k-warns-employers-asking-job-applicants-for-

social-media-passwords-may-expose-businesses-to-

legal-liability

New EEOC Strategic Plan Combats Employment

Discrimination through Strategic Law Enforcement:

www.esrcheck.com/wordpress/2012/03/16/new-

eeoc-strategic-plan-combats-employment-

discrimination-through-strategic-law-enforcement

FTC Report on Protecting Consumer Privacy

Recommends Businesses Adopt Best Privacy

Practices:

www.esrcheck.com/wordpress/2012/03/28/ftc-

report-on-protecting-consumer-privacy-

recommends-businesses-adopt-best-privacy-

practices

(c) 2012 Lester Rosen

http://www.esrcheck.com/wordpress/2011/12/22/new-california-background-check-laws-impacting-employers-take-effect-january-1-2012/



http://www.esrcheck.com/wordpress/2012/03/26/facebook-warns-employers-asking-job-applicants-for-social-media-passwords-may-expose-businesses-to-legal-liability/




http://www.esrcheck.com/wordpress/2012/03/16/new-eeoc-strategic-plan-combats-employment-discrimination-through-strategic-law-enforcement/



http://www.esrcheck.com/wordpress/2012/03/28/ftc-report-on-protecting-consumer-privacy-recommends-businesses-adopt-best-privacy-practices/


