Consumer Reporting Agencies Under the FCRA: Duties, Disputes, and Your Rights

Consumer reporting agencies under the Fair Credit Reporting Act are companies that regularly gather and sell information about you — credit history, rental records, employment background, insurance claims, and more — to banks, landlords, employers, and insurers making decisions about you. The FCRA sets what those agencies can collect, how long they can keep negative items, who can see your file, and what you can do when they get it wrong. It also lets you sue when they break the rules.

What Counts as a Consumer Reporting Agency

The label is defined by conduct, not by a company’s name or marketing. Under the FCRA, an entity is a consumer reporting agency (CRA) if it meets three conditions: it collects fees, dues, or operates on a cooperative nonprofit basis in exchange for information services; it regularly assembles or evaluates consumer information as part of its business; and it does so to supply consumer reports to third parties.1Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction

Nonprofits are not automatically out. The statute expressly covers cooperative nonprofit entities alongside for-profit ones. A one-time data transfer isn’t enough either; the activity has to be ongoing. If a company’s day-to-day operations check all three boxes, it is a CRA subject to the full weight of the law, regardless of what it calls itself.

The Big Three and the Specialty Agencies

Most people know Equifax, Experian, and TransUnion. Those three nationwide bureaus hold files on nearly every American adult and supply the data behind mortgage, auto loan, and credit card decisions. The FCRA reaches well beyond them.

Specialty agencies compile narrower slices of your life for specific industries:

  • Check and deposit account screening companies that track bounced checks and account closures for banks.
  • Tenant screening agencies that compile eviction records and rental payment histories for landlords.
  • Employment background check firms that assemble criminal records and job history for employers.
  • Insurance claims and prescription history agencies used by life and health insurance underwriters.
  • Telecom and utility reporting companies that track unpaid phone and utility bills.

Every one of these specialty agencies answers to the same FCRA rules as the nationwide bureaus.2Federal Trade Commission. Fair Credit Reporting Act The Consumer Financial Protection Bureau publishes a downloadable list of consumer reporting companies organized by market, including gaming, retail, and subprime lending, which is the practical place to look if you want to know who holds a file on you.3Consumer Financial Protection Bureau. List of Consumer Reporting Companies

What the Law Requires CRAs to Do

Accuracy

Every CRA must follow reasonable procedures to ensure the maximum possible accuracy of the information in its reports.4Office of the Law Revision Counsel. 15 USC 1681e – Compliance Procedures This is a legal standard, not an aspiration. Common failures include mixing two consumers’ files because they share similar names, reporting debts that were already paid, and including outdated public records. Agencies are expected to catch obvious mismatches, such as a Social Security number that doesn’t line up with the name on the account, before a report ever leaves the building.

Permissible Purposes

A CRA cannot hand your file to anyone who asks. The FCRA sets out a closed list of permissible purposes, and anyone obtaining a report has to certify which one applies.5Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The main lawful reasons are:

  • Credit decisions, including application review, account review, and debt collection.
  • Insurance underwriting on a policy involving the consumer.
  • Employment screening for hiring or promotion.
  • Government licensing or benefit eligibility where financial responsibility matters.
  • A legitimate business need tied to a transaction the consumer initiated.
  • Compliance with a court order or federal grand jury subpoena.

Pulling your file out of curiosity or for unsanctioned marketing is not on that list.

Your Right to See Your File

You can request a full disclosure from any CRA at any time. The agency must show you all the information it has, the sources of that information, and a list of everyone who requested your report. For employment inquiries, that list covers the past two years; for all other requests, it covers the past year.6Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers

Each nationwide CRA has to give you this disclosure for free once every 12 months through AnnualCreditReport.com.7Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures The three major bureaus have also permanently extended a program allowing free weekly reports through that same site.8Federal Trade Commission. Free Credit Reports Beyond the annual free report, you can also get one at no cost in several other situations:

  • Within 60 days of receiving an adverse action notice based on your report.
  • If you’re unemployed and plan to apply for a job within 60 days.
  • If you receive public welfare assistance.
  • If you believe your file contains inaccurate information due to fraud.
  • When you place a fraud alert on your file.

Disputing Errors

When you spot a mistake, notify the agency in writing. The clock then starts: the CRA has 30 days to conduct a free reinvestigation.9Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy If you submit additional supporting information during that window, the deadline can stretch to 45 days. The agency has to contact the company that furnished the data, consider the evidence you sent, and delete or correct anything that turns out to be wrong, incomplete, or unverifiable.

After the reinvestigation, the agency must send you written results and a free copy of your updated report. If you still disagree with the outcome, you can add a brief personal statement to your file that goes out with every future report. Agencies that miss the 30-day deadline or ignore your evidence face lawsuits and CFPB enforcement.

How Long Negative Information Can Stay

Bad entries don’t live forever. The FCRA caps how long most negative items can appear:10Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports

  • Seven years for collections, charge-offs, late payments, civil suits, civil judgments, paid tax liens, and most other adverse items.
  • Ten years for bankruptcies, regardless of chapter.
  • No limit on criminal convictions.

These caps don’t apply when the report is being used for a credit transaction of $150,000 or more, a life insurance policy with a face amount of $150,000 or more, or employment paying $75,000 or more a year. In those cases a CRA can report older negative information.

Fraud Alerts and Security Freezes

If you think your identity has been or is about to be stolen, you can place an initial fraud alert on your file for at least one year, and the CRA must pass that alert to the other nationwide agencies automatically. With an identity theft report filed with law enforcement, you can request an extended alert that lasts seven years. Either kind can be removed early if you ask.11Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts

A security freeze goes further by blocking new creditors from accessing your file entirely until you lift it. Placing and removing a freeze is free under federal law. Online or phone requests to place a freeze must be honored within one business day; requests to lift one must happen within one hour. Mail requests get three business days either way. The one-hour lift rule matters in practice: if you’re applying for new credit and need a quick thaw, you don’t have to plan days ahead.

Opting Out of Prescreened Offers

Credit card and insurance companies can tap CRA data to send unsolicited pre-approved offers without your consent, but you can stop them. Call 1-888-567-8688 or visit OptOutPrescreen.com to opt out for five years. A signed form through the same site makes it permanent.12Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance Requests process within five days, though mailings in the pipeline may keep arriving for a few weeks.

Extra Rules for Employment Background Checks

Employment screening carries requirements on top of the general permissible-purpose rules. Before an employer can request your report, it must give you a clear standalone written disclosure and get your written authorization.5Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports That disclosure document shouldn’t be bundled with liability waivers or broad authorizations buried in an application.

If the employer plans to take adverse action because of the report, there are two steps. First, before the final decision, the employer must give you a copy of the report and a written summary of your FCRA rights, so you have a window to flag errors. Only then can the employer send a formal adverse action notice with the CRA’s contact information and a notice of your right to dispute. Skipping the pre-adverse-action step is one of the most common employer violations.

Adverse Action Notices in Other Contexts

Employment isn’t the only setting that triggers adverse action duties. Any lender, insurer, or landlord that takes adverse action based wholly or partly on a consumer report must notify you and provide:13Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports

  • The name, address, and phone number of the CRA that supplied the report.
  • A statement that the CRA did not make the decision and cannot explain the specific reasons for it.
  • Notice that you can get a free copy of the report within 60 days.
  • Notice of your right to dispute inaccurate information with the CRA.
  • The credit score used and the key factors that influenced it.

Suing a CRA

The FCRA gives you a private right of action in federal or state court. What you can recover depends on whether the violation was willful or negligent.

For willful violations, you can recover actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. Courts can also award punitive damages in any amount they consider appropriate, plus your attorney’s fees and costs.14Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance There’s no statutory cap on the punitive piece, which is why willful violations can get expensive fast.

Negligent violations are lighter. You can recover only actual damages you can document, plus attorney’s fees and costs. There are no statutory minimums and no punitive damages for negligence.15Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance A denied mortgage, a lost job, or quantifiable distress can anchor the claim; without concrete harm, negligence cases are hard to bring.

The statute of limitations is the earlier of two years from when you discovered the violation or five years from when it occurred.16Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery rule is important: if a CRA has been misreporting for years and you only learn about it when you pull your file, the two-year clock starts the day you learned, not the day the error first appeared.