Hacker News Reader

Comment by tptacek | Hacker News Reader

Does anybody at all on HN think that pulling credit reports on candidates is a reasonable thing for hiring firms to do, outside of a very few roles and an even smaller set of companies (trading exchanges, for instance) with genuine and easily documented concerns about embezzlement or susceptibility to bribery? My point being: no, I don't think anyone here thinks widespread credit report pulling is reasonable.

Was anyone on HN unaware of the fact that some companies do request authorization to pull credit reports during the hiring process? I'd be surprised, but maybe there are.

Obviously, my subtext is: what is this post doing on HN?

View on HN

It helps to talk about it.

Even if we all agree the practice is malodorous, without public discussion of it, we are apt as individuals to concede to it as we believe we have no alternatives.

It's similar to the puzzle interviews which are controversial and many people here dislike. By talking about it, by raising it and discussing again and again their negatives, it helps raise awareness of strategies on how to avoid them, what to do when one is encountered, and can even raise awareness in people that do like them as to why they are problematic and encourage them to find alternatives within their company.

FWIW, I think credit pulls are obnoxious, and even so, yes, I have been asked to consent to them as well as background checks for jobs which should not need them at any time.

And it's Saturday.

A better comparison would be required non-competes, puzzles aren't nearly as harmful as either.

> Obviously, my subtext is: what is this post doing on HN?

A large part of HN is about finding (or creating) employment.

This is on HN because it gratifies one's intellectual curiosity [1]. Moreover, it's an important public policy topic that affects a large number of people in the US and beyond.

That said, I believe employers are well within their rights to run credit checks on their employees. Granted, it might not be useful, but nobody's forcing anyone to apply to a job, either.

[1] http://ycombinator.com/newsguidelines.html

If you are on welfare, the government is forcing you to apply for a job. That was the result of the 90s "welfare reform."

Edit: also, I don't think HN's top commentor needs to have someone give him a link to the guidelines. That being said, I agree with you that this is relevant.

> Does anybody at all on HN think that pulling credit reports on candidates is a reasonable thing for hiring firms to do

I would if the evidence suggested that a credit report was a good indicator of the risk of the candidate committing an offence, and that the candidate is applying for a position where they have the ability to do such.

I suspect that the probability of either event is small, and that it's worthless and discriminatory. My major concern is that the practice turns into a catch-22--you need a job to get out of debt, but you can't get a job with debt.

I worked at a major financial institution where a pre-requisite was drug, credit, and background testing (even running fingerprints) for everyone. The whole thing seemed a big waste of time.

> Does anybody at all on HN think that pulling credit reports on candidates is a reasonable thing for hiring firms to do

That's not the pertinent question. Since it's already happening, the trend can only be reversed through confrontation, and confrontation only happens if people think that pulling credit reports is an unreasonable thing to do (as opposed to not having an opinion on the practice). Otherwise people are inclined to say nothing if it so happens that they have the ear of someone responsible for making the decision (or are such a person).

The default position propagates the bad practice, making it vitally important to force people to choose one side or the other before they unwittingly endorse the status quo.

outside of a very few roles and an even smaller set of companies (trading exchanges, for instance) with genuine and easily documented concerns about embezzlement or susceptibility to bribery?

Ok, I'll be that guy. The risk is that an employee with bad credit might be more likely to steal or take bribes, and you acknowledge that this is a potential risk for some employees (e.g., comptroller of NASDAQ).

Why do you believe it is a risk that the comptroller of NASDAQ might embezzle, but not a risk that a guy selling $2,000 shoes might swipe a few $100 bills from the register?

> Why do you believe it is a risk that the comptroller of NASDAQ might embezzle, but not a risk that a guy selling $2,000 shoes might swipe a few $100 bills from the register?

Let's take a practical example here. I've had my credit run when consulting for certain clients (software security). If I were a malicious actor and, say, intentionally left vulnerabilities out of a report to use them for my own, it may never be detected. The likelihood of someone discovering that you are stealing from the register is much, much higher.

Now, do I think that a credit score correlates to these activities in the least? No. But I can certainly see why they'd do it for people with access to critical systems and not your average joe working at a shoe store.

I hope you know that by allowing clients to run your credit, you're doing a major disservice to everyone else in the industry and you're part of the problem.

The thought that bad credit has anything whatsoever to do with sitting on vulnerabilities is offensive and ridiculous. Use a criminal background check to find criminal behavior. A person with bad credit doesn't have a criminal record. Don't act like they do, and don't help others act like they do.

Half the people I've met in this industry have poor money management. Don't hire them to be accountants. It has absolutely no bearing on their ability to do their job and speaks nothing to their integrity.

In fact, I can name more than a few examples to suggest bad credit negatively correlates with hire-worthiness. They're so wrapped up in hacking that their bills and often their health (leading to more bills) get neglected. Money management is a different skill. And it is a skill, not a measure of integrity.

Your right background checks are acceptable for say TS /DV clearance jobs but a shoe shop FFS

I wonder how effective background check + credit check is versus background check on its own. Finding a known felon is easy enough, but discovering that someone may become a felon? That's tough.

Yep, modern retail chain stores basically work under the assumption that their staff will steal everything if given half a chance.

It could be that the under- and unemployed are heavily overrepresented in online forums. It's one of the few places where they can be treated as equals. And also, given the nature of the site, many people here are taking risky financial moves that involve non-traditional employment and the hope of future rewards; and knowing that your plan B could be completely screwed up by something that happens to you because plan A goes up in smoke in a disastrous fashion ( say your business gets sued by a patent troll or you lose customer data to carders because your contract programmer had a severe lack of clue ); that's likely to be a concern.

You likely have exposure to several consulting companies other than just your own (via NCC if nothing else), but how is this usually dealt with in the security consulting industry?

I have had a few clients request my credit reports to do assessments. Do consulting companies typically bend over for those? I declined, but it was pretty clear that most or all consultants they talked to in the past agreed to it, and I was the exception.

For what it's worth, this client had nothing to do with finance or national security, and there would be no PII involved. Amusingly, the largest of clients I've worked with and the most sensitive information and IP I've handled never involved anything beyond an NDA.

We try to keep consultants from signing anything at all; that's why we have a legal department. But there are some clients that require explicit background checks, and we case-by-case them.

I'm not aware of anyone here authorizing a credit check. We have no idea what anyone's credit score here is.

I think NACLC is necessary but not sufficient for most important roles (either executive or operational; devops/ops, or developers in an environment without good dev/ops separation). In general any process which PFC Manning could pass is insufficient for personnel security screening, and any process which is one point in time vs. ongoing is also insufficient.

Maybe not for a shoe salesman, but for something technical, sure. Maybe not for some crappy social game, but for a platform, or anything touching finance, or anything security related (other than purely exploit development on public code).

Reply on news.ycombinator.com