Shostack + Friends Blog Archive


Credit Checks are a Best Practice in Hiring

The New York Times reports that “As a Hiring Filter, Credit Checks Draw Questions:”

In defending employers’ use of credit checks as part of the hiring process, Eric Rosenberg of the TransUnion credit bureau paints a sobering picture. […]

Screening the backgrounds of employees “is critical to protect the safety of Connecticut residents in their homes and offices, in their cars and in all other places they travel,” Mr. Rosenberg testified to Connecticut legislators in February 2009, explaining why TransUnion markets its credit reports to employers.

Trouble is, researchers say there is no evidence showing that people with weak credit are more likely to be bad employees or to steal from their bosses, a fact that Mr. Rosenberg himself later admitted.

“At this point we don’t have any research to show any statistical correlation between what’s in somebody’s credit report and their job performance or their likelihood to commit fraud,” he said in separate testimony to Oregon legislators in January.

But please keep sending Transunion your money, they really like your money, and it makes them happy.

So why do I say it’s a best practice? Because most best practices, like this one, seem to be good ideas, but actually have no evidence that they work. It’s like torture. There are people who think torturing people helps prevent terrorist plots, but there’s no evidence for that, and lots of evidence it undercuts our security. People keep advocating anyway.

Businesses would actually be better off sending their money to TransUnion and not getting the credit report: that way, all those people they reject for the wrong reasons would still be in their hiring pools.

Businesses would be even better off spending their money on something that protects them or their customers.

7 comments on "Credit Checks are a Best Practice in Hiring"

  • Ian says:

    Good stuff as always, Adam.

    Much like the slashdot story about passwords from today bring to mind these things that sound like good ideas, are never tested for success, and become a hallowed Best Practice without ever having proved their merit.

    I have a story from some time ago that amused many of my recruiter friends and sounds relevant to this discussion.

    This large company that everyone has heard of picked me to manage one of their operational infosec teams. All I needed to do was pass their background check.

    I’ve passed literally dozens of background checks before and after this with no problems, but this one didn’t work out. Let’s look into why this is.
    – This major company outsourced their background and employment verification to another company.
    – This company went through my resume and attempted to verify every contracting engagement I have had over the last decade.
    – Some of these contracts were outsourced to a third party which engaged me.
    – Some of these outsourcers had outsourced their employment verification duties to yet another company. This company charges the callers to verify employment.
    – The outsourced verification company didn’t want to pay the outsourced verifier company for my verification information.

    Thus, I had unverifiable gaps in my resume. Thus I was a liar and not eligible for employment.

    No doubt everyone patted themselves on the back for catching a risk to their organization before sending me an offer letter.

    It seems like no one in HR wants to own risk anymore. They seem more like coordinators who give away as much money as possible to services and outsourcing firms instead of performing these tasks themselves.

    This article you mention seems to be just another continuation of this process.

  • There is a growing number of people frustrated by the “best practice” meme, so I enjoyed tracing your serial attacks on the concept. Have added some of them to the Next Practice wiki.

  • Marsh Ray says:

    Ian: Trust me, you didn’t want to work there. 🙂

  • BA Barbie says:

    Based on what I’ve seen inside of IT and Infosec, companies would be better off hiring trained psychologist to help hire staff. A great credit rating doesn’t mean someone does not have a serious antisocial personality disorder. A credit report can’t identify a BOFH or the BOFH who is now in management and supports up-and-coming BOFH.

    This is right up there with the ‘best practice’ (e.g. sorry excuse) network people keep trotting out of “performance issues” whenever they are ‘adverse’ (scared) to enable procotol inspection on firewalls.

    Poor credit can be an indicator of any number of personal concerns not all indicitive of fraud. Unless organizations are going to hire professional profilers then why bother.

  • John Kelsey says:

    So, is there good data out there somewhere to guide hiring decisions? Someone, somewhere, must have done a study of shared characteristics of people who were convicted of stealing from their employer vs random other employees, right?

    Without that data, we’re all just guessing.

  • BA Barbie says:

    Perhaps companies should determine what the greatest HR issues are first. I doubt fraud is at the top of the list and even if it is what is the cost. More costly is discrimination and harassment.

    There is no silver bullet to human relations, however, some issues could be eased and liability to companies reduced, if problem people were eliminated at the start. It’s easy to hide bigotry, antisocial personality disorders, and other equally pathological behavior from lay people. HR personnel with professional training as psychologist could skillfully ask the right type of questions to determine certain types of behavior and personalities.

    A Credit Report would provide evidentiary/Corroborating data.

  • Beri says:

    John Kelsey, what a great idea. At the very least, a master’s thesis. But then how would HR justify its existence? Back in the good old days, they hired people whose skills fit the job. And that seemed to work as well as anything else but left nothing for HR to do but forward resumes.

Comments are closed.