You can sue for an unauthorized credit inquiry under the federal Fair Credit Reporting Act (FCRA), which restricts who may access your credit file and lets you recover between $100 and $1,000 per willful violation even if you lost no money, plus actual damages, punitive damages, and attorney’s fees. You have two years from the date you discover the inquiry to file, with an absolute cutoff of five years from the date it happened.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions
What Makes an Inquiry Unauthorized
The FCRA says anyone requesting your credit report must have a “permissible purpose,” meaning a specific, legally recognized reason to view your file. A credit reporting agency can only release your report under the circumstances the statute lists.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The common ones:
- A lender evaluating you for a loan, credit card, or credit line increase
- An insurer underwriting your application
- An employer or prospective employer, but only with your written consent
- A landlord screening your rental application
- An existing creditor reviewing whether you still meet the terms of your account
- A legitimate business need tied to a transaction you started
If a company pulled your report for a reason outside that list, the inquiry is unauthorized and violates the FCRA.3Federal Trade Commission. Fair Credit Reporting Act Obtaining a consumer report under false pretenses is a willful violation and can even carry criminal penalties of up to two years in prison.4Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses
Hard Inquiries Only
Not every line on your credit report is a potential lawsuit. A hard inquiry happens when a lender formally requests your full report in connection with an application, can lower your score, and requires your authorization.5myFICO. Does Checking Your Credit Score Lower It A soft inquiry — checking your own score, a company prescreening you for an offer, an existing creditor reviewing your account — does not affect your score and does not require your permission.6Consumer Financial Protection Bureau. What Kind of Credit Inquiry Has No Effect on My Credit Score? Suits over unauthorized inquiries almost always involve hard inquiries.
What You Can Recover
How much your case is worth depends almost entirely on whether the violation was willful or negligent. This is where most of the fight in these cases actually happens.
A willful violation means the defendant knew it was breaking the law or acted with reckless disregard for your rights. A company that pulled your credit with no application on file and no business relationship with you has a hard time claiming an honest mistake. For a willful violation you can recover:
- Statutory damages of $100 to $1,000 per violation, awarded at the court’s discretion whether or not you lost a dollar
- Any actual damages you can prove
- Punitive damages in whatever amount the court finds appropriate
- Attorney’s fees and court costs7Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
A negligent violation means the company failed to follow the FCRA but did not act intentionally or recklessly. The recovery shrinks dramatically: only actual damages you can document, plus attorney’s fees. No statutory damages, no punitive damages.8Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance A negligent case with no demonstrable financial loss is essentially worthless.
Actual damages typically mean concrete, documented harm: a credit denial, a higher interest rate you can tie to the score drop, a lost job offer because an employer pulled your report without proper authorization. You need paper — a denial letter, loan terms, something linking the loss to the inquiry. General testimony about stress or frustration without corroboration tends to fall short.
Attorney’s fees matter more than they look. Because the defendant pays your legal costs if you win, lawyers can take these cases even when the dollar amount at stake is modest. One caution runs the other way: if a court finds you filed in bad faith or for harassment, it can order you to pay the defendant’s fees instead.8Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
How Long You Have to File
Two years from the date you discover the unauthorized inquiry, and no later than five years from the date it occurred.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery date is when you first learned or reasonably should have learned about the inquiry. If you pull your report and spot an unfamiliar hard inquiry, the clock starts that day.
You can file in any U.S. district court regardless of the amount at stake, or in any other court with jurisdiction. There is no minimum dollar threshold to get into federal court on an FCRA claim.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions
Who You Can Sue
Two defendants are possible, for different reasons.
The Company That Pulled Your Report
Whoever accessed your file without a permissible purpose committed the primary violation. That could be a lender, a debt collector, a car dealership, a landlord, or any other entity. Their liability does not depend on whether you disputed the inquiry first — the violation happened the moment they pulled the report.
The Credit Reporting Agency
Experian, Equifax, or TransUnion becomes a defendant only if it mishandles your dispute. If you notify the agency of an unauthorized inquiry and it refuses to investigate, runs a sham investigation, or declines to remove the inquiry after finding it unverifiable, that failure is a separate FCRA violation.9Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2022-07 – Reasonable Investigation of Consumer Reporting Disputes The agency cannot demand documentation beyond what the statute allows, such as a police report, as a precondition to investigating.
What to Do Before You File
You do not have to dispute the inquiry before suing the company that pulled your report. The violation already happened. But disputing is still worth the effort for two reasons: it builds a paper trail showing you objected, and it triggers the credit reporting agency’s independent duty to investigate, which opens the second claim described above if the agency drops the ball.
Dispute With the Credit Bureau
Write to whichever agency shows the inquiry (dispute with all three if it appears on multiple reports). Identify the specific inquiry, the date, and the company. State clearly that you did not authorize it and did not initiate any transaction with that company. Send the letter certified mail with return receipt requested so you have proof of delivery.10Consumer Financial Protection Bureau. How Do I Dispute an Error on My Credit Report?
Dispute With the Company That Pulled Your Report
Send a separate letter to the company that made the inquiry. Demand that it identify the permissible purpose it relied on and that it contact the credit bureaus to remove the inquiry. If the company cannot produce a valid purpose, its response or silence becomes evidence for your case.
Gather Proof of Harm
Pull together anything that ties a financial consequence to the inquiry: a denial letter dated after the inquiry appeared, loan documents showing a higher rate, correspondence from an employer who declined to hire you after seeing the report. Without this kind of documentation your case rises or falls on proving willfulness and collecting statutory damages, since actual damages will be hard to put a number on.
Employer Credit Checks Have Extra Rules
If an employer pulled your report, the FCRA imposes stricter requirements than for other users. The employer must give you a standalone written disclosure that a report will be obtained and get your written authorization before pulling it. The disclosure cannot contain liability waivers, accuracy certifications, or extraneous language.11Federal Trade Commission. Background Checks on Prospective Employees – Keep Required Disclosures Simple Skipping the disclosure, burying the authorization inside an application, or pulling the report without written consent is a violation regardless of what the report said. If the employer then decided against you based on the report, it also had to send a pre-adverse action notice with a copy of the report and a summary of your rights, wait a reasonable period for you to dispute errors, and only then send a final adverse action notice.12Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports Skipping either step is a separate violation.
If the Inquiry Points to Identity Theft
An unauthorized inquiry is sometimes the first visible sign that someone used your identity to apply for credit. If that is what happened, the FCRA gives you an added tool: the credit reporting agencies must block information resulting from identity theft within four business days of receiving proper documentation.13Federal Trade Commission. FCRA 605B – Block of Information Resulting from Identity Theft You need to provide proof of your identity, a copy of an identity theft report (filed at IdentityTheft.gov or with local law enforcement), identification of the specific information you are disputing, and a statement that the inquiry and any associated accounts are not yours. The agency must then notify the company that made the inquiry that a block is in place. Identity theft situations also give you potential claims against the thief and against any company that approved credit in your name without adequate verification.