When the British tabloid The Sun blared the headline “Your Life for Sale,” a couple of weeks ago, the most shocking detail in our view was a photo of a reporter and an alleged Indian fence purporting to depict the exchange of $5,000 for stolen credit-card data. This was yet another blow to the offshoring community. It follows closely on the heels of perhaps the most infamous identity-theft case in India—one that resulted in nearly $500,000 of bank losses and a whopping 17 arrests. While the world waits to see how the Indian police and courts handle these landmark investigations, both outsourcing customers and providers are examining what changes should be made, if any, to hiring practices in global delivery centers.

In April, call-center workers at a Pune, India, subsidiary of Mphasis, an IT services and business-process outsourcing (BPO) firm, talked four Citibank customers into revealing their PIN numbers and then transferred nearly $500,000 to their personal accounts. Local police arrested six Mphasis workers, plus 11 outside accomplices, and recently said the investigation is continuing, with even more arrests are possible. Citibank replenished the customer accounts, but it is yet to erase the concern of other offshoring customers that the problem won’t be repeated here or overseas, where for largely xenophobic reasons the threat is perceived as worse than in America.

The industry itself is reacting, too. “The Indian BPO industry is in its infancy, and when one tends to hire 400 to 500 people every month, we often fail to scrutinize the employees closely,” concedes Mphasis chairman Jerry Rao. He issued these remarks at a session called “Security and Privacy—Raising the Bar” at Nasscom’s ITeS-BPO Summit in Bangalore the second week of June. Rao endorses Nasscom’s proposal for “a national employment registry where potential employees’ backgrounds are registered and updated.”

The goal, says Nasscom VP Sunil Mehta, is to develop a system where every employee voluntarily allows information about prior educational background and employment history to be entered into a database. When employees are considering changing jobs, they can simply authorize the registry to release the information to the potential new employer.

In addition to speeding up the process of background checks, Mehta says the new system, to be administered by an impartial third party, would make background checks easier to accomplish, less expensive, and more accurate. Although largely believed to be a positive step toward averting a repeat of the Mphasis case, some think it simply won’t be enough.

“Extensive reference-checking is employed throughout the world, as well as motor-vehicle abstracts, media searches and in-depth interviewing, but much more is needed,” says Bill Greenblatt, president of New York-based Sterling Testing Systems, a provider of outsourced pre-employment background screening and checking. “The world has changed and the risks are greater. What’s to stop a terrorist from going to work for a defense contractor in the Philippines and gaining access to its code to sabotage a project?”

It’s just those kinds of potential problems that have employers worried, especially those with extensive operations overseas. The matter has taken on a bit of urgency lately in the wake of the disclosure of 40 million stolen MasterCard account numbers from an Arizona clearinghouse. Will consumers accept the viability of safeguards aimed at preventing identity theft and trust the people who answer the phones or respond to online customer service inquiries, many of whom are located offshore?

Mitigating Risk

Even very large IT services and BPO companies have become more rigorous in their background-checking procedures. Tata Consultancy Services, one of India’s largest IT-services companies, is one of them. To mitigate rising concerns, Tata recently began insisting that every new associate supply a passport when applying for a job.

“So to increase customer confidence in our verification process, we insist that they produce a passport, which involves precertification by the local police and a criminal records check,” says RK Raghavan, Tata’s consulting adviser for security. Raghavan says the new procedures are especially important in India, which lacks a national ID or a driver’s license, both nationally accepted identification documents.

But in many cases, simple reference checks aren’t enough. Hiring offshore workers in today’s world means researching their backgrounds as thoroughly as possible—and that takes knowledge of the laws and customs in the countries where you plan to hire—plus knowing the language, how to obtain verification and validation of certifications and information, and more.

Because of these difficulties, many BPO and other types of firms prefer to hire a company that specializes in background checks. These companies have the knowledge and expertise in various countries—and they tend to know the human resources departments, large employers, and their processes. The sophisticated methods they employ make background checks a reasonable hedge against problems of all sorts.

In general, a reputable background-checking firm will do everything Greenblatt discussed and more, if the country, its laws, and culture cooperate. Depending on the country, other types of background checking may include criminal conviction information, civil claims and suits, credit history, work history, educational background, and driving records.

In many cases, the type of work the employee will be doing will dictate how thorough the background check should be. Management consultant Hill & Associates Ltd., for example, offers three levels of service. Tier 1 might be administrative or support staff—people who won’t have access to sensitive information. These employees will be screened at the most basic level, which generally consists of criminal record, education, and previous employment. For middle managers, the company might add bankruptcy and issues conflict. For senior managers and executives, the company also might want information on past business conflicts, credit checks, and more.