Skip to content
Naked Security Naked Security

Background check company reads your private Facebook data to profile you

Tenant Assured accesses your social media accounts to help landlords assess your personality and credit risk.

Background checks and credit reports are routine when applying for a job or an apartment.

What’s missing from background checks today is information many people would consider private and protected information, such as your marital status, friends, political preferences and leisure activities – information that is dutifully recorded on social media.

Many employers admit to checking out prospective employees’ social media profiles, but they usually don’t require access to all the inner workings of your private accounts.

That could be changing.

One service, called Tenant Assured, provides detailed reports assessing rental applicants’ personality traits, creditworthiness and financial risk by directly accessing their social media accounts, with the applicant’s consent.

Once you connect your Facebook, Twitter, LinkedIn and Instagram profiles to the Tenant Assured platform, it scrapes data from your accounts, including your activity, connections, employment, life events, age and interests, in order to prepare a tenant risk score.

tenant assured sample report

Tenant Assured was recently launched by a UK-based startup called Score Assured (at the time of writing, Score Assured’s main website still had “Coming soon” listed for all its services).

Tenant Assured for landlords is Score Assured’s first product, but the company will soon offer a service for employers, called Recruit Assured.

Score Assured’s co-founder, Steve Thornhill, defends this invasion of privacy, because applicants must opt in, and “people will give up their privacy to get something they want,” according to a report in the Washington Post.

Besides, lack of privacy isn’t a problem if you have nothing to hide, Thornhill seems to believe, telling the Post:

If you’re living a normal life, then, frankly, you have nothing to worry about.

Even if you’re living a “normal” life, whatever that means, you might be concerned about what information of yours is being used by landlords or employers to assess you.

But Tenant Assured doesn’t allow tenants to see their reports or correct mistakes, and uses propriety algorithms to crunch your data, according to the Post.

Sure, you can refuse to submit to such an invasive check on your private accounts, tell the landlord or employer to mind their own business, and walk away.

There are other landlords or employers that still allow you to get an apartment or a job while keeping a modicum of privacy.

But if deep background checks like Tenant Assured become commonplace, will you have a choice?


Wouldn’t this break the terms of service of these social media sites? I thought a 3rd party couldn’t access your account.


The article says “with the applicant’s consent;” it must require either signing into FB through the Score Assured servers or explicit passwd sharing. Ergo they have your implicit blessing.


I think Darren’s point is that Facebook’s terms and conditions state that giving your explicit consent in that manner is grounds for a lifetime ban from Facebook.

Wouldn’t surprise me.


yikes; you’re right. I’m getting a refund on that speed reading course.

…and it probably would indeed constitute grounds for a ban


So to me a 3rd Party would also be inclusive of all the search engines out there that scour the internet for information to query, and thus making your publicly view able social media account information available to anyone who is savvy with query logic and structure, so according to you the access to search engines also violates the ToS. So what say you?


Deep background checks can/will become commonplace because the statement from the Washington Post article is correct… many people will give up some privacy to get something for free. If everybody refused to provide the necessary credentials then employers and landlords would stop paying these people for the reports. The future of privacy is in our hands. Unfortunately, many people don’t take is seriously.


Very well stated Keith

Education of the masses is key…I’m trying to not feel cynical about that, but the trends are increasingly (and not decreasingly) supporting this sort of thing.

Maybe it’d help if “Idiocracy” were required high school viewing, with post-film discussion on what an incisive commentary it actually is despite the crude delivery.


Agreed. The real question they should be answering (and perhaps they “will” in their marketing materials) is whether or not with this additional social media data they become any more accurate in predicting potential issues or credit worthiness.

So you can analyze it, and you can create a score from it, but is that really any better than just a credit score or is it all just to fill the flashy dashboard?


Okay, so everyone will have multiple profiles on FB, one for the anti-privacy nazi companies to use as background checks, the other for it’s intended purpose – fun / friends only and FB to market to. (same for other profile sites)


“If you have nothing to hide,” this getting old. You may be a Luthern, quote bible quotes, joke around,anything really and some person may find that offensive. Horrible- I have enough of these intrusive techies.


Darren is correct, It’s a violation of the ToS to allow 3rd parties to access your account.

I can see the UK’s ICO weighing in on this AND the unfair terms in credit contracts laws being invoked to shut this down, quickly.


Even the UK Government (I won’t identify which bits) didn’t ask for access to my social media accounts when checking me out for high level clearance… If they don’t need it, landlords certainly don’t.


Privacy is important to all of us. Be very careful what you post or what info you provide to unknown sources.


Just tell them you don’t have a facebook account etc. Of course all the “real name” stuff makes it more difficult to do these days but suspicion wouldn’t get them into your account.
Better yet get and maintain a MySpace account. Let them have that.


I don’t have anything to hide… but I do worry that a crook gains access to this company systems and leaves with a gold stash of personal information… that’s what the “founders” of these companies don’t understand.

It would be interesting to change the personal details/name on one of the social media sites to try to create SQL injection (or similar) :D. Little Bobby Tables to the rescue!


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!