Is Your Employment History Verification Actually Compliant? Most Isn't.

By Vivianne Johnson | Co-founder of Vetting Hub and employment screening compliance specialist with twenty years of operational experience across regulated sectors.

Most organisations think they verify employment history. They ask for a CV, they send a reference request, someone calls the number the candidate provided and has a five minute conversation about whether the person was reliable and whether they would rehire them. Box ticked. Candidate cleared. Process complete.

What they have actually done is ask someone the candidate selected, using contact details the candidate supplied, to confirm the story the candidate told them. If that sounds circular, it is. And in 2026, it is also increasingly dangerous.

The process most organisations are running is not verification. It is confirmation. There is a meaningful difference between those two things, and the gap between them is exactly where employment fraud lives. Reference houses, paid referee services and AI-assisted document manipulation have made that gap wider and harder to spot than at any point in the two decades I spent processing real vetting files across security, healthcare, financial services and government. What looked borderline manageable five years ago has become a serious operational risk today.

Before I get into what a compliant process actually looks like, it is worth being clear about what the current landscape means for organisations that have not updated their approach.

What You Are Actually Up Against

Paid reference services, often called reference houses, are commercial operations that candidates pay to pose as a previous employer. They register companies, build websites, set up phone lines staffed by briefed individuals, and provide references that align precisely with whatever the candidate has claimed on their application. They will answer calls. They will confirm dates. They will say the candidate was excellent and that they would take them back tomorrow.

Research by Cifas suggests around one in five UK workers have at some point falsified CV information. One study found that roughly one in four people have provided inaccurate information about their employment history. The most common motivation is covering a gap or concealing a departure that did not end well. The most dangerous motivation, particularly in regulated sectors, is gaining access to a role the candidate does not legitimately qualify for.

This is not a fringe problem. The organisations most at risk are those still running reference processes designed for a world where fraud was rare and detectable. That world no longer exists.

There is also a dimension that often goes unspoken. Some reference houses do not simply fabricate references and walk away. They have been known to coerce the very candidates they helped. Once someone inside your organisation holds a secret that could unravel their employment, they become a vulnerability, not just to themselves but to you. The insider threat risk created by a fraudulent hire is significant, and it begins the moment that person walks through your door.

What Legislation and Standards Actually Require

There is no single statute that prescribes the exact form employment history verification must take. What there is, however, is a regulatory patchwork that collectively means a failing process is never just an inconvenience.

Under UK GDPR and the Data Protection Act 2018 you must have a lawful basis for processing personal data during verification, be transparent with candidates about what you are checking and why, and not retain information beyond the point at which it serves its purpose. The Data Use and Access Act 2025, whose commencement regulations are being introduced throughout 2026, adds further weight to data minimisation and transparency obligations in screening contexts. If you have not reviewed your candidate privacy notices and your data retention policy recently, that is worth doing now. Our guide to Right to Work compliance in 2026 covers the broader legislative picture for employers navigating this year's regulatory changes.

For specific sectors the bar is considerably higher. BS7858, the standard governing security sector employers, requires a five year employment history verified to source wherever possible, with documented gap analysis for any periods not covered by direct employer verification. BPSS, applicable to government contractors and those working with sensitive information, requires documented evidence covering at minimum the preceding three years. FCA regulated roles require fitness and propriety assessments in which verifiable employment history is a core component. CQC safer recruitment requirements make clear that a candidate's employment history should be established and verified as part of a safe recruitment process, not simply accepted on the basis of what the candidate has declared.

If you operate in any of these sectors and your process amounts to sending a reference request form to a contact address the candidate gave you, you are not meeting the standard. You may believe you are. Your process documentation may suggest you are. But if a regulator or auditor examined what you actually did and how you verified what the candidate told you, the gaps would be visible.

What a Compliant Process Actually Looks Like

A compliant employment history verification process does four things consistently. It establishes the claimed history in full. It verifies that history to source. It investigates and documents any gaps. And it creates a defensible record of how it did all three. Let me take each in turn.

Establishing the claimed history in full

Before you verify anything, you need the complete picture of what the candidate is claiming. Not just the last two employers. Not just the roles they have chosen to highlight. The full chronological employment history covering the period required by your sector standard or your own internal policy, whichever is more demanding. This means an application form or declaration that requires the candidate to account for every period of time, including gaps, rather than simply list selected roles. A CV is not a declaration. It is a marketing document the candidate has constructed to present themselves favourably. Treat it as a starting point, never as the record.

Verifying to source

Verification to source means contacting the actual employer, not the contact the candidate suggested. This matters enormously. The most basic test is whether the organisation the candidate claims to have worked for actually exists and whether the individual answering your reference request is genuinely employed there. Check the company on Companies House. Find the main switchboard number independently, not from information the candidate provided. Ask to be transferred to HR rather than contacting the direct email or number on the reference form. These steps take minutes and they filter out a significant proportion of fraudulent references.

Where verification to source is not possible because the employer has ceased trading, merged or is otherwise unreachable, document why and obtain alternative evidence from the candidate. Payslips, P60s, HMRC records via the candidate's Government Gateway account and bank statements showing salary payments are all legitimate supporting evidence that does not rely on a third party who was selected by the candidate.

Investigating and documenting gaps

An employment gap is not automatically a red flag. People take career breaks, care for family members, deal with health issues, travel and do any number of legitimate things that create periods outside formal employment. The question is not whether a gap exists but whether it has been accounted for and whether that account is plausible and consistent.

A gap that appears on the application form and is explained coherently is very different from a gap that only becomes apparent when you lay the verified employment dates alongside each other and discover three months that nobody mentioned. The former is transparency. The latter is a disclosure failure that needs to be explored. Document both the gap and the explanation, whatever form that takes. If the explanation cannot be verified, document that too.

Gaps are also where fraud often hides. A candidate who served a prison sentence, was dismissed for gross misconduct or was involved in activity they do not want you to know about will construct an employment history around that period. The fabricated employer covering the awkward eighteen months, the reference house answering your call, the plausible story about a small company that has since closed. From two decades of processing real cases, I can tell you this pattern is more common than most organisations realise and that the cases with the most serious consequences for the employer almost always involve a gap that was accepted without scrutiny.

Creating a defensible record

A defensible audit trail is not simply a folder of reference letters. It is a documented record of what you did to verify each element of the employment history, when you did it, what evidence you obtained, what you could not verify and why, and what decision you made on the basis of that information. It should be possible for someone with no knowledge of the case to read your records and understand precisely how you reached your conclusions.

This matters at audit. It matters if a hiring decision is ever challenged. It matters if something goes wrong with an employee whose history you checked and the question becomes whether you took reasonable steps. Our piece on AI deepfake fraud in employment screening explores how the fraud landscape is evolving in ways that make robust documentation even more important, because the threats you are defending against are becoming harder to detect without a rigorous process behind you.

The Questions Your Process Should Be Able to Answer

When your employment history verification process is working as it should, you should be able to answer the following questions for any hire, without having to search through emails or piece together what happened from memory.

Did you verify every period of employment the candidate claimed, or only some of them? Did you contact each employer independently or through contact details the candidate supplied? Where you could not verify a period of employment, what alternative evidence did you obtain? Are all gaps in the employment history accounted for and documented? Could you present your verification records to a regulator or auditor today and demonstrate a coherent, defensible process?

If any of those questions produces hesitation, that is the gap in your process. Not a theoretical gap. A real one that exists right now in relation to people who are already employed in your organisation.

This Is Not About Being Suspicious of Every Candidate

A robust employment history verification process is not about treating every applicant as a fraudster. Most people applying for roles with your organisation are telling the truth. A good process confirms that and gives you confidence in the people you hire.

What it is about is having a process that works even when someone is not telling the truth, and that gives you a defensible record of what you did regardless of the outcome. The organisations that get into serious difficulty are rarely those that uncovered a fraud. They are the ones that missed it because their process was not designed to find it, and who cannot demonstrate what steps they actually took.

Employment history verification done properly is not a bureaucratic exercise. It is the foundation of knowing who you have actually hired.

Working with Vetting Hub

Vetting Hub is a subscription based compliance consultancy founded by Graham and Vivianne Johnson, who spent twenty years running an operational screening business across security, healthcare, financial services and government. Everything inside Vetting Hub has been built from that direct operational experience, not from textbooks.

A Vetting Hub subscription gives your organisation the knowledge to understand every aspect of employment screening and vetting compliance, the tools to implement that knowledge correctly through practical templates, frameworks and decision guides, and the direct expert access to bring your specific questions and situations to Graham and Vivianne through monthly private briefings, written question responses and ongoing subscriber support.

If you want a verification process that holds up under scrutiny, we can help you build one. www.vettinghub.co.uk