No, not just anyone can call to verify employment and expect to walk away with your salary, work history, or personnel details. The Fair Credit Reporting Act restricts who can pull a formal employment report through a consumer reporting agency, and most employers voluntarily limit what they’ll confirm even when someone phones HR directly. What a caller actually learns depends on three things: whether they have a legally recognized reason under the FCRA, whether you’ve given written consent, and what your employer’s internal disclosure policy allows.
Who Is Legally Allowed to Verify Your Employment
The FCRA lists the specific “permissible purposes” under which a consumer reporting agency may release employment data, and the statute says reports can be furnished under those circumstances “and no other.”1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The categories that matter for most people:
- Lenders and creditors checking income and job stability before extending credit.
- Prospective employers running a background check, subject to extra consent rules.
- Insurance underwriters evaluating an application.
- Landlords confirming that a rental applicant earns enough to cover rent.
- Government agencies determining eligibility for benefits or licenses.
- Anyone acting under a court order or grand jury subpoena.
Child support enforcement agencies sit in a category of their own. Federal law requires employers to give these agencies information about an employee’s wages, income, and employment status on request, and the employee’s permission is not needed.2Administration for Children & Families. Verification of Employment
A stranger with no business relationship to you cannot legally obtain a consumer report about your employment. The statute prohibits reporting agencies from furnishing reports to anyone lacking a permissible purpose, and pulling one under false pretenses carries its own penalties.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports That said, nothing physically stops someone from dialing your employer’s main line and asking whether you work there. What they get back is entirely up to your employer’s policy, and most companies keep those policies tight.
When Written Consent Is Required
The consent rules turn on who is asking and how they’re getting the information.
For a background check run through a consumer reporting agency, the FCRA imposes two steps on the employer. First, they must give you a clear written disclosure on a standalone document, not buried in an application, stating that a consumer report may be obtained. Second, you must authorize the report in writing. Skip either step and the employer has broken the law.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
For credit and insurance, the rule is different. Lenders and insurers generally don’t need your signed authorization to pull a report as long as they have a permissible purpose, such as evaluating a loan application you initiated. A reporting agency can also furnish a report on your own written instructions, which is what happens when you sign a mortgage lender’s income-verification form.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Now the grayer scenario. When a hiring manager picks up the phone and calls your previous employer directly instead of going through a reporting agency, the FCRA doesn’t govern that conversation. No federal law forces your old employer to obtain your written permission before confirming dates of employment. In practice, most HR departments still demand a signed release before saying anything, because that policy shields them from liability. Listing a former supervisor as a reference is sometimes treated as implied consent, but documented authorization is the norm.
What Information Actually Gets Released
Verification and reference checks get confused constantly, and the distinction shapes what a caller can learn. A factual verification confirms objective data: dates worked, job title, sometimes salary. A reference check is subjective, with a former manager offering opinions about your performance or reliability. Legal exposure is far higher for references, which is why many companies simply refuse to give them.
Most employers will confirm dates of employment and the title you held. Employment status such as full-time, part-time, or contractor is also standard. Beyond that, they get cautious. Salary is commonly treated as its own category requiring specific employee authorization, and some organizations use automated systems where the caller must enter a code the employee provides before wage data is released.
Whether a former employer will say you’re “eligible for rehire” varies by state and company policy. Several state reference immunity statutes explicitly cover rehire eligibility, but only when the answer is truthful. Knowingly stating a false rehire status strips the employer of that protection, which is why many companies decline to answer the question at all.
The Work Number and Automated Verification
Even if no one ever calls your employer, your data may already be available through an automated database. The Work Number, operated by Equifax, collects payroll data from more than 4.88 million employers and holds over 813 million employee records.3The Work Number. Income and Employment Verification Services Many employers feed salary, title, and dates of employment into the system automatically each pay cycle, often without any action by the employee.
Lenders, landlords, government agencies, and other parties with a permissible purpose can query the database and get results almost instantly. Because The Work Number operates as a consumer reporting agency under the FCRA, you have the same rights you’d have with any credit bureau, including at least one free file disclosure per year so you can see what data is being held about you.4Consumer Financial Protection Bureau. Fair Credit Reporting; File Disclosure
Freezing Your Employment Data
You can place a security freeze on your Work Number records at any time, at no cost. A freeze blocks the database from releasing your information to third parties until you lift it. You can initiate one online, by phone at 1-800-367-2884, or by mailing a freeze form.5Employees The Work Number. Freeze Your Data The tradeoff is that you’ll need to temporarily lift the freeze whenever you want a lender or new employer to verify your employment. If you’re not actively applying for credit or jobs, keeping the freeze on is worth considering.
What Your Employer Cannot Share
Some information is off-limits regardless of who is asking or what consent they claim to have.
Medical and Disability Information
The Americans with Disabilities Act requires employers to keep medical information in separate confidential files, apart from your regular personnel records. That information may be shared only with supervisors who need to know about work restrictions or accommodations, first aid personnel in emergencies, and government officials investigating ADA compliance.6Office of the Law Revision Counsel. 42 USC 12112 – Discrimination An employer who tells a prospective employer about your disability, medical history, or use of FMLA leave has crossed a clear legal line.7U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA The EEOC has stated that even when a supervisor already holds medical information about an employee applying for an internal position, that information cannot be passed to the hiring manager for the new role.8U.S. Equal Employment Opportunity Commission. The Family and Medical Leave Act, the ADA, and Title VII of the Civil Rights Act of 1964
False Statements Under State Reference Laws
Roughly 40 states have reference immunity statutes that protect employers from defamation suits when they provide truthful job performance information in good faith. The presumption of good faith collapses if the former employer knowingly provides false information, acts with reckless disregard for the truth, or shares information for a malicious purpose. If a former employer tells a prospective employer something false that costs you a job, you can still bring a defamation or tortious interference claim; the statute just requires you to show the statement was deliberately or recklessly false.
What to Do If the Rules Are Broken
If a consumer reporting agency holds wrong information about your employment history, such as incorrect dates, a title that doesn’t match, or salary data that’s off, you have the right to dispute it. The agency generally has 30 days to investigate, with the timeline extending up to 15 additional days if you submit further documentation. Results must be sent to you within five business days of the investigation closing.9Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report The same process applies to entries in an automated employment verification database.
If someone pulls your consumer report without a permissible purpose, or a reporting agency releases it without proper authorization, the FCRA provides two liability tracks.
For willful violations, you can recover actual damages or statutory damages of $100 to $1,000, whichever is higher, plus possible punitive damages and your attorney’s fees and court costs.10Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance A person who knowingly obtains a report under false pretenses faces the greater of actual damages or $1,000.
For negligent violations, where the company should have followed the rules but failed to, you can recover actual damages plus attorney’s fees and costs, with no statutory minimums or punitive damages available.11Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance Willful violations are worth pursuing even when your out-of-pocket loss is small; negligent violations require you to prove concrete harm.