Can an Employer Run a Background Check After Hiring?

Yes — an employer can run a background check after hiring you, and federal law puts no time limit on when it can happen. The Fair Credit Reporting Act (FCRA) treats current employees the same way it treats job applicants, so your employer can pull an updated report at any point during your employment as long as it follows the disclosure, consent, and notice rules built into the statute. Your protections come from how the check is requested, what the employer does with the results, and the notices you receive before and after any decision.

The FCRA’s authorization for employment screening, at 15 U.S.C. § 1681b, uses the word “consumer” rather than “applicant.”¹ That single word choice is why post-hire checks are lawful: the statute covers anyone whose report is being used for employment purposes, not just people at the hiring stage. The report itself can include criminal records, credit history, driving records, license and credential verification, and information about character or general reputation.²

Consent and Disclosure Your Employer Needs

Before pulling a report on you, your employer has to do two things. It must give you a clear written disclosure in a standalone document containing nothing else, and it must get your written authorization.¹ The standalone rule means the disclosure cannot be buried inside your employment contract or mixed with other legal language. Employers who slip the disclosure into a broader onboarding packet are one of the most common targets of FCRA class actions.

Most employers ask for what is called an “evergreen” authorization when you’re first hired. This is language in the initial disclosure giving the employer permission to run background checks at any point during your employment without asking again. Look for wording like “at any time during the course of my employment.” The FCRA allows this at the federal level because the statute only requires disclosure “at any time before the report is procured” and does not demand a fresh disclosure for every subsequent check.

Some states override that approach and require a new notice and fresh consent every time a report is pulled. If you work in one of those states, your original authorization won’t carry forward, and your employer has to come back to you before each new screening. Employers operating across state lines have to follow whichever law offers you stronger protection.

Investigative Reports Involving Personal Interviews

A separate set of rules kicks in when the check goes beyond database records and involves someone interviewing your neighbors, coworkers, or acquaintances about your character or reputation. This is called an investigative consumer report. Under 15 U.S.C. § 1681d, your employer has to send you written notice within three days of requesting one, and that notice must tell you that you can ask for a full description of the investigation’s scope.³ If you ask in writing, the employer has five days to respond describing what is being looked into.

When Post-Hire Checks Typically Happen

Employers don’t usually run these checks at random. The common triggers are:

Promotions or role changes. Moves into management, positions with access to sensitive financial data, or transfers into departments handling confidential information often prompt a new screening.
For-cause suspicion. A workplace incident or reason to suspect misconduct can lead to a targeted check.
Periodic reviews. Some organizations screen every employee on a recurring cycle, typically every one to three years.
Regulatory requirements. Financial services and healthcare, among others, require regular re-screening under federal or state rules.

A growing number of employers also use continuous monitoring services that scan criminal databases in real time and alert the company when an employee is arrested or convicted. The same FCRA rules apply: your written authorization is required before enrollment, and the full adverse-action process must be followed before the employer takes any action based on an alert.⁴ Some states require a fresh authorization each time new information is pulled through these services rather than accepting one blanket consent.

Limits on Credit Checks and Social Media Access

Roughly a dozen states restrict or prohibit employers from using credit reports in employment decisions, including decisions about current employees. Common exceptions cover roles requiring a security clearance, positions with fiduciary responsibility above a certain dollar threshold, law enforcement roles, and jobs requiring the employee to be bonded. If your job doesn’t fall into one of those exceptions and you work in a restrictive state, your employer generally cannot pull your credit as part of a post-hire check.

More than half of all states also prohibit employers from demanding access to your personal social media accounts. That includes asking for passwords, requiring you to log in while they watch, or forcing you to add a supervisor as a contact.⁵ These laws typically apply to current employees, not just applicants. Employers can still view what you have chosen to post publicly. If they hire a third-party service to systematically monitor your social media and compile reports, that service can qualify as a consumer reporting agency, which means the full FCRA disclosure, consent, and adverse-action requirements apply to those reports too.

How Criminal Records Must Be Evaluated

When a post-hire check turns up a criminal record, federal anti-discrimination law adds another layer of protection. The Equal Employment Opportunity Commission’s guidance takes the position that blanket policies automatically excluding people based on criminal records can violate Title VII of the Civil Rights Act when they disproportionately affect a protected group and are not job-related and consistent with business necessity.⁶

The EEOC recommends that before an employer takes adverse action against a current employee based on a criminal record, it should conduct an individualized assessment. That means notifying you that the record may lead to a negative decision, giving you a chance to explain, and considering your response. Relevant factors include:

How closely the offense relates to the duties of your specific job.
How long ago it occurred.
Whether you performed the same type of work after the conviction without incident.
Evidence of rehabilitation, such as education, training, or positive references.

The EEOC has found reasonable cause to believe Title VII was violated where an employer terminated a current employee based on a newly discovered conviction without any individualized assessment, especially where the employer refused to weigh the employee’s positive work history.⁶ Many states have adopted their own individualized-assessment rules, and some create a presumption in your favor when the conviction is old or unrelated to the work.

The Adverse Action Process Before Any Negative Decision

If the report gives your employer reason to consider firing, demoting, or reassigning you, the FCRA requires a two-step notification process before it can act.⁴

Pre-Adverse Action Notice

Before doing anything negative, your employer has to give you a copy of the consumer report it relied on along with a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act.” This is your window to review the report and flag any errors before a decision becomes final. The FCRA requires a “reasonable” waiting period without defining a specific number of days; industry practice generally treats five business days as a minimum.

Final Adverse Action Notice

If the employer decides to proceed after that waiting period, it must send a second notice confirming the decision. That notice has to include the name, address, and phone number of the consumer reporting agency that supplied the report; a statement that the agency did not make the decision and cannot explain it; and notice of your right to dispute the accuracy of the report and to request another free copy within 60 days.⁴ Skipping either step, or rushing through them without giving you a real chance to respond, exposes the employer to FCRA liability.

Disputing Errors in the Report

If the check contains mistakes — a criminal record that belongs to someone else, an outdated charge that was dismissed, or a credit account you never opened — you can dispute the information directly with the consumer reporting agency. Once the agency receives your dispute, it has 30 days to complete a reinvestigation.⁷ That window can extend by up to 15 additional days if you submit new relevant information during the initial 30 days. If the disputed item turns out to be inaccurate, incomplete, or unverifiable, the agency has to promptly delete or correct it and send you the results, including a revised copy of your report, within five business days of finishing the reinvestigation.

What You Can Recover If the Employer Breaks the Rules

The FCRA creates two tiers of employer liability. For willful violations, such as deliberately pulling a report without your consent or skipping the adverse-action process, you can recover statutory damages between $100 and $1,000 per violation without proving financial harm, plus any actual damages, punitive damages, and attorney’s fees.⁸ For negligent violations, where the employer simply failed to follow the procedures without acting intentionally, you can recover actual damages and attorney’s fees, but not statutory or punitive damages.⁹ State laws often add remedies of their own on top of these federal ones, particularly in states with stronger consent, credit-check, or fair-chance rules.

1
Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
2
Legal Information Institute (LII). Consumer Report – 15 USC 1681a(d)(1)
3
Office of the Law Revision Counsel. 15 U.S. Code 1681d – Disclosure of Investigative Consumer Reports
4
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
5
National Conference of State Legislatures. Privacy of Employee and Student Social Media Accounts
6
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII
7
Office of the Law Revision Counsel. 15 U.S. Code 1681i – Procedure in Case of Disputed Accuracy
8
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
9
Office of the Law Revision Counsel. 15 U.S. Code 1681o – Civil Liability for Negligent Noncompliance