What's the law that says they can't do that?

I've had recruiters on two occassions ask for ph# of former employers, saying they just wanted to verify dates of employment and salary.