Yes, they are legal as long as they are conducted transparently, with the candidate's consent, and in compliance with privacy laws.
While it's a red flag, employers can discuss alternative ways to verify the candidate's suitability, such as skills assessments or project-based interviews.
Typically, it's advisable to contact at least two professional references to gather a well-rounded perspective.