What an Automated Reference Check Asks Your Referees

When an employer asks for referee names and email addresses late in a hiring process, the request is often routed to a reference-check platform rather than to a person. The platform emails your referees a structured questionnaire, asks automated follow-up questions when their answers look inconsistent, summarizes the whole set for the hiring team, and runs fraud checks on the referees themselves. In the United States, a reference check performed by a third party on an employer's behalf also carries a specific legal status that gives you documented rights before the employer can act on it.

This article covers what your referees receive, what the hiring team sees, who holds the resulting data, and what you can ask for. It is written for candidates who have just been sent a referee-details form. It is not legal advice.

What your referees actually receive

The structured questionnaire has largely replaced the phone call. HiPeople's reference-check product pages, reviewed on 14 October 2026, describe a workflow that handles "collecting referee details to outreach, scheduling, rescheduling and follow-ups" without a recruiter in the loop, and state an average of 25 hours to complete a full reference check (HiPeople).

The sample referee screens on that page show closed questions rather than open prose. One asks the referee to confirm, adjust, or decline to confirm a stated job title and date range. Another asks whether they would rehire you, with four options: strong yes, yes, undecided, or no. The screen tells the referee that "Your response is used as one signal in the reference process."

Two details matter more to candidates than the question wording:

• Follow-ups are automated. HiPeople states that when answers are unclear or contradictory, its agents ask follow-up questions automatically. Your referee may be asked to resolve a discrepancy without a human ever deciding that a discrepancy existed.
• Your referee may be recruited. The same page says referees who respond can be added to the employer's talent pool, and reports that roughly a third do. Handing over a colleague's contact details hands over a sourcing lead as well.

Vendors other than HiPeople structure this differently, and a given employer may use a long-form questionnaire, a short verification-only check, or a phone call. Ask which one you are in before assuming the format.

What the hiring team sees

Raw referee answers are increasingly read through a summary layer. Xref announced AI Reference Summaries on 19 August 2025, describing a feature that analyses "all the text-based answers" for "recurring themes, standout details, and key sentiment across all responses" and presents both a consolidated summary that "updates in real-time" and a summary on each individual referee report (Xref).

Xref also states in that announcement that "your ability to read the full, original text of every referee answer remains unchanged," and frames the summary as something that "supports your review process, never replacing the raw data." So the verbatim answers survive — but whether a given hiring manager reads them or stops at the summary is a matter of that manager's habits, not of the product.

HiPeople's pages describe a further layer: flags for references that read as overly positive, overly negative, or internally inconsistent, alongside a skills benchmark comparison and a work-history report. These are vendor-documented capabilities, not independently verified ones, and neither vendor publishes how a flag is weighted against the rest of a candidate's file.

The practical consequence is that the pattern across your referees can carry as much signal as any single answer. A referee who declines to confirm a date range, or who answers "undecided" on rehire while your other referees answer "strong yes", produces a visible inconsistency rather than a note in a recruiter's file. This is the same shift candidates have already encountered in AI-scored interview recordings that get re-examined after the fact: the artifact outlives the conversation and stays queryable.

Your referees get screened too

Reference-check platforms now treat the referee as a possible point of fraud, not just a source of information. HiPeople's page states that it runs fingerprinting and IP and phone checks on participants to detect fraud. Referoo, another vendor in the category, says it "tracks IP addresses against referee responses" specifically to catch candidates completing their own reference checks, and cites a Citi Institute estimate that "as many as one in four candidate profiles globally could be fake by 2028" (Referoo). Both the capability description and the statistic come from vendor marketing and should be read as vendor claims; Referoo's figure is cited secondhand without methodology.

For an honest candidate this matters in a mundane way. If you and your referee share an office network, a VPN, or a family connection, the platform may see overlapping signals it was built to treat as suspicious. If your referee asks you to help them draft a response, or to fill the form in while you are on a screen share with them, you may create exactly the pattern the fraud check looks for. The safer practice is to give your referee the context they need in advance and then stay out of the submission entirely.

This is the reference-check counterpart to the identity-verification steps candidates now meet earlier in a process; the same logic is covered in more detail in our candidate's guide to interview identity verification.

In the US, a vendor-run reference check is usually an investigative consumer report

This is the part most candidate-facing content omits. When a third party gathers reference information for an employer, that activity falls under the Fair Credit Reporting Act. In a staff advisory opinion dated 25 March 1999, the Federal Trade Commission concluded that "the reference checks which you describe constitute investigative consumer reports" under Section 603(e) of the FCRA (FTC). The letter also states that "The opinions set forth in this informal staff letter are not binding on the Commission," so treat it as the agency's stated reading rather than as settled law, and note that it predates every platform named above.

The FTC's current business guidance for employers using consumer reports sets out what has to happen around one. Before obtaining the report, the employer must tell you in writing that it may use a consumer report for employment decisions, in a "stand-alone format" — the notice "cannot be in an employment application" — must get your written permission, and must certify to the vendor that it did both (FTC).

If the employer then decides not to hire you based on the report, the same guidance requires a pre-adverse-action notice including "a copy of the consumer report you relied on to make your decision" and a copy of the FTC's "A Summary of Your Rights Under the Fair Credit Reporting Act." After the decision, the employer must tell you action was taken based on the report, name the reporting company, state that the company "did not make the decision to take the unfavorable action and can't give specific reasons for it," and explain your right to dispute inaccurate information and to obtain an additional free report within 60 days.

The investigative-consumer-report classification adds one right that is unusually useful here. Alongside the written disclosure, you can request further detail about the investigation — and a summary from the law firm McAfee & Taft notes that the FCRA's investigative-report provisions require the employer to disclose that you "may request additional disclosures, including the nature and scope of the investigation to be performed," and to respond "within five days of receipt of the request" (McAfee & Taft). That commentary is dated 2011, so verify the current statutory text or ask a lawyer before relying on the timing.

Scope matters: these are US federal rules, they attach to reports obtained from a third party rather than to a hiring manager calling a former boss directly, and state law adds further requirements in places. The broader map of what employers must disclose about automated steps in a hiring process is covered in our guide to what candidates are entitled to know about AI hiring rules.

Who holds the data, and where to send a request

The vendor usually is not the party you need to ask. Xref's privacy policy states that for reference information it acts as a data processor on behalf of the employer, and directs access and correction requests accordingly: "address the request to the Employer and Xref will assist the Employer to respond" (section 8.2). On retention, section 5.2 says Xref will keep the information "as directed by the Employer," with no published retention period (Xref).

That has two consequences. A request sent to the platform will likely be forwarded or declined. And the answer to "how long does this sit on file" is set by each employer's configuration, not by the vendor, so it is a question for the employer's recruiting or privacy contact. Candidates who have gone through the equivalent exercise for a recorded interview will recognize the pattern described in how to get an interview recording deleted.

It is also worth knowing what categories can end up in a reference file. Xref's policy lists referee-supplied employment details and opinions about your performance, and notes that candidate records may include sensitive information such as criminal record or proceedings, health or disability information, and visa or work-authorisation details where relevant.

What this does not tell you

Several things remain genuinely unresolved, and it is better to say so than to guess:

• Weighting is undisclosed. No vendor reviewed here publishes how an inconsistency flag or a low rehire score affects a hiring decision, or whether it is advisory or disqualifying.
• Summary fidelity is unverified. Xref documents that raw answers remain available; nothing establishes how often a summary and the underlying text would lead a reader to different conclusions.
• Compliance claims are vendor-stated. HiPeople's pages list SOC 2 Type II, ISO 27001, GDPR, CCPA, the EU AI Act, and NYC Local Law 144 among its compliance commitments, with US or EU hosting options. Those are the vendor's representations about its own product.
• Practice varies by employer. The same platform can be configured for a two-question employment verification or a long qualitative questionnaire.

Before you hand over referee details

A short, practical sequence covers most of it:

1. Ask what the check is. Whether it is run in-house or by a named third party determines whether the FCRA framework above is in play at all.
2. Read the standalone disclosure. If you were asked to authorize a background or reference report, the notice should be a separate document, not a clause in the application.
3. Ask for the nature and scope if you want to know what will be asked and of whom. For a third-party investigative report, that request has a defined response obligation.
4. Brief your referees properly and then step back. Tell them the role, the dates you listed, and that the questions will be closed-form — then let them submit alone, from their own network and device.
5. If you are rejected after a reference check, the pre-adverse-action notice should include a copy of the report. That copy is the only reliable way to learn what a referee actually said.

The automated reference check is not a harder test than the phone call it replaced, but it is a more durable one. It produces a structured, scored, retained record with your referees' names attached, and the leverage you have over that record comes almost entirely from asking the right questions before it is created rather than after.

Control is a desktop AI interview assistant for Windows and macOS, and it has nothing to do with the reference stage described here. If you are earlier in a process and working out what employers must tell you about the automated steps in it, start with our guide to AI hiring disclosure rules for candidates.