Most businesses that run background checks believe they follow the rules. They have a process, they have forms and someone on the team handles it. Then a lawsuit arrives. The gaps become impossible to ignore. The Fair Credit Reporting Act does not grade on effort. It grades on execution. Here are five mistakes businesses make repeatedly and what you need to do differently.
Mistake 1: Burying the disclosure in a stack of forms
The law requires a clear, standalone disclosure before you pull a consumer report on any applicant. Standalone means one document, one purpose, nothing else on the page.
Many businesses fold this disclosure into their general employment application or new hire packet. Courts do not accept that. The moment you add anything else to that page, including a liability waiver or a company policy summary, you have a defective disclosure. It does not matter that the applicant signed it.
Separate the document and keep it clean. This is not a technicality. It is the foundation of your entire compliance process.
Mistake 2: Skipping the pre-adverse action step
Before you act on anything negative in a consumer report, federal law requires you to send a pre-adverse action notice first. This gives the individual time to review the report and dispute any errors before your decision becomes final.
Here is what happens in practice. A hiring manager sees a criminal record, decides the candidate is out and rescinds the offer that same afternoon. No notice sent, no waiting period observed. That sequence creates legal liability regardless of what the report said or how reasonable the decision was.
Send the pre-adverse action notice. Attach a copy of the report and the summary of rights. Wait a reasonable period, then make your final call.
Mistake 3: Pulling reports without a clear permissible purpose
The FCRA only allows you to request a consumer report for specific, legally defined reasons: employment, credit, insurance and a handful of others. Pulling a report on a former employee, a business partner or anyone outside those categories puts you on the wrong side of the law.
Before you request any report, confirm your purpose fits within those defined categories and document it. If you cannot articulate a permissible purpose in plain language, you should not be pulling the report.
Mistake 4: Ignoring the rules around investigative consumer reports
Investigative consumer reports, which include interviews with references, neighbors or personal contacts, carry additional obligations that many businesses overlook entirely. You must notify the subject within three days of requesting the report and inform them of their right to request a full description of the investigation’s scope.
Businesses run these reports without sending the required notice and open themselves up to a separate set of legal claims on top of any standard FCRA violation. Know what kind of report you are ordering before you order it.
Mistake 5: Building a process once and never revisiting it
This is the mistake that builds on all the others. A compliance process is not a filing cabinet item. Courts and regulators update their interpretations regularly and what held up three years ago may not hold up today. Watch for these recurring gaps:
- Disclosure forms that have grown over time and no longer qualify as standalone documents.
- Adverse action timelines applied inconsistently across departments or locations.
Set a review schedule, audit your forms annually and update your procedures whenever your screening practices change.
What the stakes look like
FCRA violations do not require intent. A procedural gap in an otherwise well-run process carries the same legal exposure as deliberate noncompliance. Statutory damages can reach $1,000 per violation and class action exposure multiplies that number fast. An attorney who knows this statute well can review your current process and find the gaps before a complaint does it for you.
This publication is provided only for educational purposes; it should not be relied upon as legal advice, and it should not be used, in whole or in part, as a basis for engaging in estate planning or estate administration. Every reader’s circumstance is unique, and legal advice should be obtained only from a lawyer with whom the reader has established an attorney-client relationship.
Copyright 2026 © Higey Law LLC. All material contained within this publication is protected by copyright law and may not be reproduced without the express written consent of Higey Law.