Every hiring decision starts with a story. A CV lists the roles, the dates, the achievements. Somewhere along the way, someone checks whether that story holds up.

That job usually falls to referencing, and for many organisations, it still looks the same as it did twenty years ago: one phone call, and a couple of emails to one nominated contact. Before looking at what needs to change, it's worth being clear on exactly what that process covers today, where it can run into issues, and how bad actors can maliciously 'game' the reference process.

The process, as it's always been

Strip it back, and referencing usually follows the same five steps almost everywhere:

1. The applicant controls who is contacted, nominates a referee, usually a former line manager or an HR contact.

2. A recruiter or background screener sends a request by email, phone, or a paper form.

3. Someone at the former employer (HR, payroll, or a manager who happens to check the inbox) locates the applicant's record.

4. They confirm a handful of facts: that they worked there, employment dates, and job title, that response goes into a file, a box gets ticked, and the process moves on.

We've written before about the hidden cost this creates for HR teams fielding these requests. But the bigger issue isn't the admin burden. It's what the process actually confirms, and what it quietly leaves out.

‍

What gets missed

A traditional reference is a narrow, one-sided snapshot. By design, it can only tell you what one employer knows about one period of time. That leaves gaps most organisations never think to question:

• Concurrent employment. A reference confirms someone worked at Company A between two dates. It says nothing about whether they were also working at Company B, C, or D during the same window.

• Reason for leaving. Most employers now operate a "factual only" policy: dates and title, nothing more, largely to avoid legal exposure. A dismissal for misconduct and a redundancy look identical on paper.

• Cherry-picked history. The applicant decides which roles appear on the CV and which contacts get nominated as referees. A bad manager, a short and messy tenure, or an employer who'd tell a very different story can simply be left off.

• Unverifiable referees. A name and a mobile number aren't proof that someone works where they say they work, or that they are who they claim to be.

• A single point in time. Once a reference is filed, it's rarely revisited, even as new information about the person emerges later.

None of this requires anyone to lie outright. The process simply isn't built to catch these edge cases.

‍

How it gets obfuscated

Where there's a gap, someone will find a way to fill it on paper. Some of the more common tactics we see:

• Reference houses. Paid services will supply a "former employer" who answers the phone, confirms a job title, and sounds entirely plausible, right down to a company email domain and letterhead.

• Favours from friends. A former colleague, a friend, or a relative pose as a manager and answers the call.

• AI-generated documents. We've previously shown how easily generative AI can produce a convincing reference letter, complete with company branding, a signature, and a plausible story, built from a single prompt in seconds.

• Selective omission. Simply not mentioning the employer that wouldn't give a good reference.

None of these require much effort. That's precisely the problem.

‍

A system built on trust, not verification

Referencing was designed for a world of paper personnel files and single, linear careers, where checking meant one phone call to one employer who had every reason to answer honestly. It assumes goodwill and a shared interest in accuracy on both sides.

That assumption is under more pressure than ever. Applicants have more reasons, and more tools, to shape their story before it reaches you.

👉 See how Konfir verifies employment directly from the source, not from the applicant's account of it.

‍