Every time an employee applies for a mortgage, signs a lease, or accepts a new job offer, someone on the other end picks up the phone and calls your HR department. Background screening companies, lenders, landlords, and prospective employers all need the same thing: confirmation that a person actually works (or worked) where they say they did. For HR teams at mid-to-large employers, these inbound verification calls are a constant, low-grade operational drain that rarely gets the process attention it deserves.
Disclose too much and you face defamation liability. Disclose inconsistently and you create compliance exposure. Refuse to respond and your employee's home purchase stalls at closing. A structured approach to inbound employment verification protects your organization and your people.
What Is an Inbound Employment Verification Request?
An inbound employment verification request is a contact from a third party asking your HR team to confirm details about a current or former employee's work history. The request typically arrives by phone, fax, email, or secure portal. Your role is reactive: you're responding to someone else's inquiry, not initiating one.
These requests are sometimes called VOE (verification of employment) requests. They can range from a simple "Did Jane Smith work there?" phone call to a formal written request with a multi-page authorization form attached. The volume and formality depend entirely on who's asking and why.
Who Sends Inbound Verification Requests?
Four categories of requestors account for the vast majority of inbound VOE contacts:
Background screening companies (CRAs) are the most frequent callers. When a candidate goes through a pre-employment background check, the screening firm contacts every employer listed on the resume to confirm dates, titles, and sometimes salary.
Mortgage lenders require employment verification at application and again near closing. These requests often come with tight deadlines because loan approval timelines are rigid.
Landlords and property managers verify employment to assess a prospective tenant's stability and ability to pay rent. These tend to be less formal, often arriving as a simple phone call.
Prospective employers sometimes verify work history directly rather than going through a CRA, particularly for senior roles or smaller companies without screening vendor relationships.
What Information Can HR Legally Disclose?
Federal law does not restrict what employers can share in response to a verification request. There is no blanket federal statute that limits disclosure. But accuracy, consistency, and state-level regulations create real boundaries around what you should share.
Safe to Share
Three data points are widely treated as safe to disclose without employee consent as a matter of standard HR risk-management practice: dates of employment, job title, and current employment status (active or separated). These are factual, verifiable, and carry minimal legal risk when reported accurately. While no federal law codifies this as a safe harbor, the convention is well established across the industry.
Most employers treat these as the default response for any inbound verification request. If you share nothing else, sharing these three items satisfies the majority of requestors.
Requires Employee Consent
Salary and pay rate disclosure should require a signed employee release before you share anything. While federal law doesn't explicitly mandate consent for salary disclosure in the VOE context, requiring authorization is a sound risk-management practice. Disclosing compensation without consent can create defamation exposure if the figures are inaccurate, and employees reasonably expect their pay information to be treated as confidential.
It's worth noting that many states have enacted salary history ban laws, including California, New York, Illinois, and Massachusetts. These laws primarily restrict employers from seeking or relying on a candidate's salary history during the hiring process, rather than prohibiting salary disclosure in standard VOE responses to lenders or landlords. Still, the patchwork of state laws makes a universal consent requirement the simplest policy to administer. Collecting that release should be a standard step in your verification workflow, not an afterthought.
What to Avoid
Never disclose disciplinary history, reasons for termination, performance evaluations, or any information related to an employee's protected class status (race, age, disability, religion, etc.). Sharing termination reasons opens the door to defamation claims, particularly if the characterization is subjective or disputed. Disclosing protected class information creates EEOC exposure regardless of intent.
The practical rule: stick to objective, documented facts. If it involves judgment, opinion, or anything that could be characterized as retaliatory, do not share it.
Are Employers Required to Respond?
With limited exceptions, employers are not legally required to respond to verification requests. Federal court orders and certain government agency requests (such as those related to child support enforcement or immigration verification) are mandatory. Everything else is voluntary.
That said, refusing to verify employment has real consequences for the employee involved. A non-response can delay mortgage closings, block rental applications, and slow hiring processes. As a practical matter, most employers respond because the cost of non-response falls on the employee, not the company.
If your organization has a blanket no-response policy, be aware that it can create friction with your own workforce. Employees who can't get their employment verified will hear about it, usually at the worst possible time.
The Hidden Cost of Ad-Hoc Verification Handling
At small employers with a handful of requests per month, handling verification calls manually is annoying but manageable. At scale, the math gets unfavorable quickly.
Large employers with 1,000+ employees can receive dozens to hundreds of inbound verification requests per month. Each call takes 5 to 15 minutes when you factor in looking up the employee record, verifying the caller's identity, determining what's appropriate to disclose, and documenting the interaction. At 100 requests per month and 10 minutes average, that's roughly 17 hours of HR staff time dedicated to a purely administrative task.
A March 2025 thread on Reddit's r/humanresources captured the frustration directly: "We have been getting more and more verification of employment requests and the administrative burden is taking up too much of my team's time." The thread drew 20+ comments from HR professionals describing the same problem. Without a defined process, verification handling sprawls across the department, pulls people off higher-value work, and introduces inconsistency in what gets disclosed.
6 Best Practices for Managing Inbound Verification Requests
1. Designate a Single Point of Contact
Route all inbound verification requests to one trained HR person or a small dedicated team. When front desk staff, office managers, or line supervisors field these calls, the responses are unpredictable. An untrained manager might casually share termination reasons or performance details without realizing the liability involved.
A single point of contact creates accountability and consistency. It also makes it easier to track volume, identify patterns, and enforce your disclosure policy.
2. Require Written Requests Before Responding
Establish a policy that verification requests must arrive in writing (email, fax, or secure portal) before your team responds. Written requests create a paper trail, filter out bad-faith callers, and give your team time to review what's being asked before responding.
Phone-only requests are harder to verify and document. If a caller insists on a verbal response, your designated POC can still require that a written request be submitted first.
3. Verify the Requester's Identity and Purpose
Before disclosing any information, confirm that the requester is who they claim to be. A caller saying "I'm with ABC Mortgage" is not sufficient verification. Ask for a callback number you can independently confirm, a company email address, or documentation of their permissible purpose.
Social engineering and pretexting are real risks. Someone posing as a lender to obtain an employee's salary or employment status for non-legitimate purposes is a scenario your process should be designed to catch.
4. Always Collect a Signed Employee Release for Salary
Build a step into your verification workflow where salary disclosure requires a signed employee authorization on file. Many CRAs and lenders will include a release form with their request. If they don't, request one before proceeding.
One policy applied consistently across all locations and states is simpler than tracking jurisdiction-specific requirements. It also reduces your compliance surface area and protects against defamation claims tied to inaccurate compensation data.
5. Document Every Response
Log the date of each response, the requester's name and organization, the employee involved, and exactly what information was disclosed. This documentation is your defense if an employee later disputes what was shared or if a regulator asks for records.
Without documentation, you're relying on memory. When an employee claims HR shared their termination reason with a prospective employer, and no log exists of what was actually said, the company has no way to refute the claim.
6. Respond Consistently
The same type of request should always receive the same type of response. If you confirm salary for one mortgage lender but refuse it for another, or share job titles for current employees but not former ones, the inconsistency itself becomes a liability.
Inconsistent responses can support claims of discrimination or retaliation. If a terminated employee's verification request gets a different (less favorable) treatment than a current employee's, the difference is noticeable and potentially actionable.
The Compliance Risk of Getting This Wrong
Three categories of risk deserve attention:
Over-disclosure liability. Sharing information beyond what's appropriate (termination reasons, performance issues, subjective characterizations) can result in defamation claims. Even truthful statements can be problematic if they're delivered in a way that implies negative intent or if the information wasn't requested.
Salary disclosure without consent. Releasing compensation data without employee authorization exposes your organization to defamation risk if the figures are inaccurate and to employee trust issues even if they're correct. While salary history ban laws are primarily aimed at the hiring process (restricting employers from asking candidates about prior pay), the broader principle of treating compensation as confidential information applies to VOE responses as well. A consistent consent requirement is the simplest way to manage this risk.
Accuracy in responses that feed into background checks. Employers responding to verification requests are not directly regulated by the Fair Credit Reporting Act in the way that consumer reporting agencies are. But when your response feeds into a CRA's background check report, inaccurate information (wrong dates of employment, incorrect job titles, erroneous salary figures) can trigger disputes from the employee and potential liability for the CRA. Providing accurate, documented information protects both the employee and your organization from downstream problems.
How High-Volume Employers Automate Inbound VOE Responses
Once verification volume exceeds a few dozen requests per month, manual handling becomes a poor use of HR resources. The task is repetitive, rule-based, and identical in structure across nearly every request, which makes it well suited for automation.
Several solutions exist in this space, each with different tradeoffs:
The Work Number (Equifax) is the largest automated verification database. Employers enroll and upload payroll data, and verifiers query the database directly without contacting HR. The platform handles millions of verifications annually and integrates with major payroll systems like Workday and ADP. Employers who aren't on compatible platforms, or who prefer not to share payroll data with Equifax, will need to look elsewhere. Pricing involves an employer enrollment fee, and some employers have raised concerns about Equifax monetizing their workforce data.
Best for: Enterprise employers on major payroll platforms who want to remove HR from the verification loop entirely.
ADP SmartCompliance Employment Verification automates responses for employers already using ADP payroll. The integration is native within the ADP ecosystem, which means minimal setup for existing ADP customers. The tradeoff is platform lock-in: if your payroll runs on a different system, SmartCompliance isn't available, and if you later migrate away from ADP, you lose the verification automation as well.
Best for: ADP payroll customers looking for verification automation within their existing system.
HRlogics ClearVerify provides software for HR teams to manage and track inbound verification requests more efficiently. Rather than eliminating HR involvement, ClearVerify organizes the workflow with request tracking, status management, and reporting. HR still handles the actual verification, but the process is structured and auditable. Pricing is subscription-based.
Best for: HR teams that want better tracking and workflow management for manual verification handling.
Konfir Respond is a free service for employers to handle inbound reference and employment verification requests automatically. The no-cost entry point is attractive for budget-constrained teams, though the feature set is more limited than paid alternatives, particularly around customization and reporting.
Best for: Small to mid-size employers looking for a no-cost entry point into verification automation.
What Automation Looks Like in Practice
Superunit takes a different approach by deploying AI agents that answer inbound verification phone calls on behalf of the employer. When a background screener, lender, or landlord calls to verify employment, Superunit's AI handles the interaction: it verifies the requester's identity, confirms their permissible purpose, discloses only pre-approved information (dates, title, employment status), and routes salary requests based on whether a signed employee release is on file. The company has processed over 70,000 verifications and is backed by Y Combinator.
Best for: Mid-market employers (500 to 5,000 employees) receiving high call volumes who aren't on enterprise payroll platforms like ADP or Workday.
Pros:
- Verification calls are handled without HR involvement, freeing staff from repetitive phone inquiries.
- Every call is recorded and transcribed, creating a defensible audit trail of what was disclosed.
- Scales to any volume without additional staffing.
- Pay-on-success pricing with no upfront cost or subscription fee.
Cons:
- Requires comfort with an AI agent representing the company in external interactions.
- Does not replace a payroll database; it automates call handling specifically, not data storage.
The Audit Trail Advantage
The documentation gap is one of the biggest risks in manual verification handling. When an HR generalist takes a verification call and jots a note (or doesn't), there's no reliable record of what was actually said. If an employee later claims that HR disclosed their salary without consent, or shared the reason for their termination, the company's defense depends on a handwritten note in a desk drawer.
Automated solutions like Superunit address the documentation problem by recording and transcribing every verification interaction. The transcript captures the exact exchange: what the requester asked, what was disclosed, and what was declined. If a dispute arises six months later, you can pull the transcript and replay the call. That level of documentation is difficult to achieve with manual processes, even with disciplined logging.
Frequently Asked Questions
Can an employer refuse to verify employment?
Yes. Outside of federal court orders and certain government-mandated requests, employers can decline to respond to verification inquiries. The practical consequence falls on the employee: a refused verification can delay a mortgage closing, block a rental application, or slow a hiring decision at another company. Most employers respond because refusing hurts the employee without providing meaningful benefit to the company.
What if the requester won't identify themselves?
Decline to respond. If a caller refuses to provide their name, organization, contact information, or the purpose of their request, your HR team should end the conversation. No legitimate CRA, lender, or employer will object to basic identity verification. Sharing employee information with an unverified caller is an unnecessary risk with no upside.
Does FCRA apply to employers responding to verification requests?
FCRA primarily governs consumer reporting agencies and the entities that request consumer reports. Employers responding to verification requests are not covered entities under FCRA in the traditional sense. However, accuracy still matters: when your response feeds into a CRA's background check report, inaccurate information (wrong dates, incorrect titles, erroneous salary data) can trigger disputes from the employee and create downstream problems for both the CRA and your organization. Maintaining accurate records and consistent disclosure practices protects you regardless of whether FCRA directly applies.