15 USC 1681: What the Fair Credit Reporting Act Covers

The Fair Credit Reporting Act, codified at 15 U.S.C. § 1681, is the federal law that controls how your credit information gets collected, shared, and used. It gives you the right to see what’s in your credit file, dispute anything wrong, limit who can pull your report, and sue when a bureau, lender, or employer breaks the rules. It also puts real obligations on the credit bureaus and on the companies that feed them data about you.

Your Core Rights

A Free Report Every Year

You can request a free copy of your credit report from each nationwide consumer reporting agency once every 12 months.¹ That’s separate from the additional free reports you’re entitled to after triggering events like a credit denial or a fraud alert. The annual report is the baseline tool for catching errors and spotting identity theft before it snowballs.

Notice When You’re Turned Down

When a company denies you credit, raises your rate, rejects a rental application, or takes any other negative action based on your credit report, it has to send you an adverse action notice. That notice must name the reporting agency that supplied the report, give the agency’s contact information, and state that the agency did not make the decision and cannot explain the reasons behind it.² The notice also has to tell you about your right to a free copy of the report and your right to dispute anything inaccurate. For most people, this letter is the first sign something is wrong in their file.

Opting Out of Prescreened Offers

Credit card companies and insurers can buy prescreened lists from the bureaus to send you unsolicited offers. You can opt out. A phone or online request lasts five years; a signed written request is permanent, and the opt-out takes effect five business days after the bureau receives it.³ Opting out does not affect your score, and it cuts down on identity theft exposure from stolen mail.

Who Can Pull Your Report

A bureau can only release your report to someone with a legally recognized reason to see it. The statute lists the permissible purposes: evaluating you for credit, reviewing an existing account, underwriting insurance, screening you for employment with your consent, and responding to a court order, among others.³ Pulling a report without one of those purposes is a violation.

How to Dispute an Error

You can dispute inaccurate or incomplete information directly with the credit bureau. The bureau has to conduct a free reinvestigation and resolve your dispute within 30 days. That deadline stretches to 45 days if you send in additional relevant information during the first 30 days.⁴

Within five business days of receiving your dispute, the bureau must forward the details to the furnisher that reported the information. The furnisher investigates and reports back. If the entry can’t be verified as accurate, the bureau must delete or correct it.⁴

If a deleted item is later reinserted, the bureau can only put it back after the furnisher certifies the information is complete and accurate. The bureau then has to notify you in writing within five business days of the reinsertion, including the furnisher’s name and contact information and a reminder that you can add a statement to your file disputing the data.⁴

Send dispute letters by certified mail with return receipt requested so you have proof the bureau received them and when. Keep your originals and send only copies.⁵ Online and phone disputes are faster but harder to prove if the process breaks down. A paper trail becomes essential evidence if you ever have to sue.

What the Bank or Lender Has to Do

Furnishers (banks, lenders, collection agencies, anyone feeding data to the bureaus) have their own duties. A furnisher cannot report information it knows or has reasonable cause to believe is inaccurate. Once it learns that data it supplied is wrong, it must promptly notify the bureau and provide corrections.⁶

When the bureau forwards your dispute to the furnisher, the furnisher has to investigate, review the evidence the bureau sends along, and report the results back. If it finds the data was wrong, it must notify every bureau it sent the bad data to.⁶ Many disputes stall not at the bureau but at this stage. If your bank insists its data is correct without actually checking, that itself may be a violation.

If you tell a furnisher directly that specific information is wrong and it turns out to be wrong, the furnisher cannot keep reporting it. And if you’ve contested a debt with the company, it can’t keep reporting the account without noting the dispute.⁶

The accuracy duty on the bureau side is set high. Bureaus must follow reasonable procedures to ensure the maximum possible accuracy of the information in your file.⁷ They cannot simply dump whatever they receive into your file without quality control.

Fraud Alerts, Freezes, and Identity-Theft Blocks

Fraud Alerts

If you suspect fraud or identity theft, you can place an initial fraud alert on your file. It lasts one year and tells anyone pulling your report to take extra steps to verify your identity. You only contact one of the three major bureaus, and that bureau shares the alert with the other two.⁸

If you already have an identity theft report, you can request an extended fraud alert lasting seven years. Extended alerts also automatically opt you out of prescreened offers for five years. Active-duty military members can get a duty alert of at least 12 months with a two-year prescreened-offer exclusion.⁸

Security Freezes

A freeze is stronger than an alert. It blocks the bureau from releasing your report to anyone new, making it nearly impossible for a thief to open accounts in your name. It’s free to place, free to lift, and stays in effect until you remove it.⁸

When you request a freeze by phone or online, the bureau must place it within one business day. When you later need to lift it temporarily to apply for credit, the bureau must remove it within one hour of an electronic or phone request. Mail requests take up to three business days either way.⁸

Blocking Fraudulent Accounts

If fraudulent accounts are already showing up on your report, you can go further than a freeze. A bureau must block the reporting of information you identify as resulting from identity theft within four business days of receiving your request, proof of identity, an identity theft report, and your statement identifying the fraudulent entries.⁹ Unlike a dispute, a block removes the fraudulent data entirely rather than just flagging it as contested.

Employment Background Checks

Employers cannot pull your credit report without your written permission. The request for consent has to come on a standalone document; it cannot be buried in a job application or bundled with other paperwork.³

If the employer decides to take an adverse action based on the report (passing on your application, reassigning you, or firing you), the process runs in two steps. First, before the action is final, the employer has to give you a copy of the report and a summary of your rights so you can review the information and raise concerns. Second, after the adverse action, the employer must send a formal notice identifying the reporting agency, stating that the agency didn’t make the decision, and telling you about your right to dispute inaccuracies and request another free report within 60 days.¹⁰ Employers trip up most often by skipping the pre-adverse notice or combining both steps into one letter.

How Long Negative Items Stay on Your Report

Old negative information eventually ages off. The law caps how long most items can be reported:

Bankruptcy: 10 years from the date of the order for relief or adjudication.
Collection accounts and charge-offs: 7 years.
Civil judgments and arrest records: 7 years from entry, or until the statute of limitations expires, whichever is longer.
Paid tax liens: 7 years from the date of payment.
Other adverse items (except criminal convictions): 7 years.

Criminal convictions have no expiration and can stay on your report indefinitely.¹¹ These limits don’t erase the debt itself. A creditor can still try to collect. What ends is the bureau’s ability to report it.

Suing for Violations

Willful Violations

If a bureau, furnisher, or user of credit reports willfully violates the FCRA, you can sue for either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. A court can also award punitive damages, plus your attorney’s fees and court costs.¹² Willfulness doesn’t require malice. It covers cases where a company knew its FCRA obligations and disregarded them, or acted with reckless disregard for whether its conduct was lawful.

Negligent Violations

When the violation is negligent rather than willful, you can still recover your actual damages and attorney’s fees. Statutory and punitive damages are off the table.¹³ The hard part of a negligence claim is proving actual damages: you need to show concrete financial harm, like a higher interest rate or a lost job, that came from the violation.

Criminal Provisions

Anyone who knowingly obtains information from a credit bureau under false pretenses faces fines and up to two years in prison.¹⁴ A bureau employee who knowingly gives consumer information to someone not authorized to receive it faces the same penalties.¹⁵ The Consumer Financial Protection Bureau and the Federal Trade Commission can also bring enforcement actions against companies with systemic violations.

The Deadline to Sue

You cannot wait indefinitely. The FCRA gives you the earlier of two deadlines: two years from the date you discovered the violation, or five years from the date the violation actually occurred.¹⁶ The five-year outer limit is a hard cap. If you discover an error four years after it was reported, you have one year to file, not two. If you don’t discover it until after the five-year mark, the window has already closed. That’s a strong argument for checking your reports on a regular schedule rather than waiting until you need credit.

1
Office of the Law Revision Counsel. 15 U.S. Code 1681j – Charges for Certain Disclosures
2
Office of the Law Revision Counsel. 15 U.S. Code 1681m – Requirements on Users of Consumer Reports
3
Office of the Law Revision Counsel. 15 U.S.C. 1681b – Permissible Purposes of Consumer Reports
4
Office of the Law Revision Counsel. 15 U.S.C. 1681i – Procedure in Case of Disputed Accuracy
5
Consumer Advice. Sample Letter to Credit Bureaus Disputing Errors on Credit Reports
6
Office of the Law Revision Counsel. 15 U.S. Code 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
7
Office of the Law Revision Counsel. 15 U.S. Code 1681e – Compliance Procedures
8
Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
10
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
11
Office of the Law Revision Counsel. 15 U.S. Code 1681c – Requirements Relating to Information Contained in Consumer Reports
12
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
13
Office of the Law Revision Counsel. 15 U.S. Code 1681o – Civil Liability for Negligent Noncompliance
14
Office of the Law Revision Counsel. 15 U.S. Code 1681q – Obtaining Information Under False Pretenses
15
Office of the Law Revision Counsel. 15 U.S. Code 1681r – Unauthorized Disclosures by Officers or Employees
16
Office of the Law Revision Counsel. 15 U.S.C. 1681p – Jurisdiction of Courts; Limitation of Actions