Credit Reporting Agencies: Your Rights, Disputes, and Freezes

Credit reporting agencies are private, for-profit companies that collect your financial history from creditors and other sources, compile it into consumer reports, and sell those reports to lenders, landlords, insurers, employers, and other businesses that want to evaluate you. They are not government agencies and they do not decide whether you get approved. Three nationwide bureaus — Equifax, Experian, and TransUnion — dominate the industry, but dozens of specialized agencies track narrower slices of your life, from checking account history to insurance claims.¹ The Fair Credit Reporting Act gives you the right to see your file, dispute errors, freeze access, and sue when the rules are broken.

The Three Nationwide Bureaus

Equifax, Experian, and TransUnion each run their own independent database. A creditor might report your account to all three, to two, or to just one, which is why the same consumer can look different at each bureau. The bureaus make money by selling reports, credit scores, and related analytics to businesses. They do not make lending decisions, and a denial is never “the bureau’s fault” in the sense people sometimes assume. Checking all three reports matters precisely because the data isn’t identical.

Specialized Reporting Agencies

The big three are not the whole picture. ChexSystems focuses on banking history, recording involuntary account closures and bounced checks that can keep you from opening a new checking or savings account.² Rental history bureaus track lease violations, eviction filings, and payment patterns for landlords. Utility reporting agencies track electric, gas, and water bill payments. Insurance companies pull claims histories from agencies like LexisNexis when setting auto or homeowners premiums.

These specialized agencies fall under the same federal law as the nationwide bureaus, so you have the same rights to request your file, dispute errors, and receive an adverse action notice if a report cost you a bank account, an apartment, or a policy.¹

What’s in Your Credit Report

A credit report has four main parts. Personal identifiers — name, address history, Social Security number, date of birth — are used to match incoming data to your file. Tradelines are the core: each one shows a creditor’s name, the account type, your credit limit or loan amount, your balance, your payment history, and whether the account is open or closed. Inquiries show who has looked at your report. Public records round out the file; bankruptcy filings are the most common entry here, with Chapter 7 appearing for up to ten years and Chapter 13 for up to seven.³

Hard and Soft Inquiries

Not every inquiry affects your score. A hard inquiry happens when you apply for new credit and a lender pulls your report; it can lower your score slightly, the effect usually fades within a year, and the inquiry drops off entirely after two years. A soft inquiry — checking your own credit, a prescreened promotional offer, a background check — has no effect on your score.

How Long Negative Information Can Stay

Federal law caps how long most adverse items can be reported. The limits under 15 U.S.C. § 1681c are:

Late payments: up to seven years from the date you first fell behind.
Collections and charge-offs: up to seven years from the original delinquency that led to the collection or charge-off.
Chapter 7 bankruptcy: up to ten years from the filing date.
Chapter 13 bankruptcy: up to seven years from the filing date.
Paid tax liens: up to seven years from the payment date.
Civil judgments: up to seven years from the entry date, or until the statute of limitations expires, whichever is longer.

One exception: for credit transactions above $150,000, life insurance policies above $150,000, or jobs paying $75,000 or more per year, these time limits don’t apply, and older negative information can still be reported.³

Your Rights Under Federal Law

The Fair Credit Reporting Act, codified at 15 U.S.C. § 1681 and its subsections, governs what agencies can collect, who can see it, and what you can do when something is wrong.

Who Can Pull Your Report

An agency cannot hand your report to anyone who asks. The requester must have a “permissible purpose”: reviewing a credit application, insurance underwriting, employment screening with your written consent, debt collection, or a business transaction you initiated.⁴ Government agencies can also pull reports for child support enforcement and certain licensing decisions. Without a qualifying reason, pulling your report is illegal.

Your Right to See Your File

Every bureau must disclose all the information in your file on request, including every tradeline, every inquiry, and the sources of the data. It must also tell you who requested your report for employment purposes during the past two years and who pulled it for any other purpose during the past year.⁵

Adverse Action Notices

When a lender, insurer, or other business denies your application or offers worse terms based on your credit report, it must send you an adverse action notice. That notice must name the bureau that supplied the report, state that the bureau did not make the decision and cannot explain why it was made, inform you of your right to a free copy of the report within 60 days, and inform you of your right to dispute inaccurate information.⁶ If a credit score was used, the notice must include the score. This is often how people first learn about an error.

Employment Screening

Employers face extra restrictions. Before pulling your report, an employer must give you a clear, standalone written disclosure that it plans to use a consumer report in making employment decisions, and it must get your written consent. The disclosure cannot be buried inside a job application.⁷ If the employer intends to take adverse action based on the report, it must give you a copy of the report and a summary of your rights before finalizing the decision, so you have time to respond.

Disputing Errors

If you find a mistake on your report, you can dispute it directly with the bureau. The investigation is free, and the bureau generally must resolve the dispute within 30 days of receiving your notice. If you submit additional supporting information during that window, the bureau gets an extra 15 days.⁸ Disputes filed after requesting your free annual report can extend the timeline to 45 days.⁹

After the investigation, the bureau must notify you of the results within five business days and send an updated copy of your report if anything changed; that updated copy doesn’t count against your free annual report. If the furnisher — the creditor that reported the data — corrects the information as a result of your dispute, it must forward that correction to every bureau it originally reported to.⁹ If the bureau won’t fix the item, you can add a brief statement to your file explaining your position.

Security Freezes and Fraud Alerts

A security freeze blocks new creditors from accessing your report, which stops most identity thieves from opening accounts in your name. Placing and lifting a freeze is free under federal law, with no limit on how often you can freeze and unfreeze.¹⁰ You place a freeze separately at each of the three nationwide bureaus. If you need to apply for new credit, you temporarily lift the freeze, let the lender pull your report, and then refreeze. A freeze is also the only option for protecting a minor child’s file.

Some bureaus offer products branded as “credit locks” that work similarly but are governed by the bureau’s terms of service rather than federal law. Equifax offers its lock for free; Experian and TransUnion bundle locks into paid subscription services. The statutory freeze does the same job at no cost.

A fraud alert is less restrictive. Instead of blocking access, it flags your file so a creditor reviewing it must take extra steps to verify your identity before opening an account. An initial fraud alert lasts one year and is free, and you only need to contact one bureau, which must relay the alert to the other two.¹¹ Identity theft victims with a police report or similar documentation can place an extended alert that lasts seven years.¹² Active duty military and National Guard members can place a free active duty alert and get free electronic credit monitoring from each bureau.

Getting Your Free Reports

Federal law entitles you to one free report per year from each nationwide bureau through a centralized source.¹³ That source is AnnualCreditReport.com, the only website authorized to fulfill free annual report requests.¹⁴ You can also request reports by calling 1-877-322-8228 or mailing a request form.

In practice, you can check far more often than once a year. All three bureaus have permanently extended a program that lets you pull a report from each bureau once a week at no cost through AnnualCreditReport.com.¹⁵ Equifax is also offering six free reports per year through 2026 on top of the standard weekly access.¹⁴ To verify your identity when requesting a report, you’ll need your Social Security number, date of birth, and current mailing address, and you may be asked security questions about your loan history or previous addresses.

Suing for FCRA Violations

If a bureau or a furnisher violates the FCRA, you can sue. The damages depend on whether the violation was deliberate or careless.

For willful violations, you can recover either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. A court can also award punitive damages in whatever amount it considers appropriate, plus your attorney’s fees and court costs.¹⁶ For negligent violations, you can recover actual damages plus attorney’s fees and costs, with no statutory minimum and no punitive damages.¹⁷

The practical difference matters. In willful cases, the statutory minimum means you don’t need to prove a specific dollar amount of harm. In negligence cases, you do. Anyone who obtains your report under false pretenses or knowingly without a permissible purpose faces a minimum of $1,000 in damages or actual damages, whichever is greater.¹⁶

Medical Debt Reporting

Medical debt reporting has been in flux, and the current rules are not what some headlines suggested. In 2023, the three major bureaus voluntarily stopped reporting medical debts under $500 and removed records of medical debts that had already been paid. A federal rule finalized in January 2025 would have banned medical debt from credit reports entirely, but that rule was vacated by a federal court in July 2025 after the CFPB and the plaintiffs agreed it exceeded the agency’s statutory authority under the FCRA.¹⁸

The current standard is the 2023 voluntary industry practice: paid medical debts and unpaid medical debts under $500 should not appear on reports from the big three, but unpaid medical debts above $500 still can. If you see a medical collection on your report that falls below the threshold or was already paid, dispute it using the process above.

1
Consumer Financial Protection Bureau. Companies List
2
America’s Credit Unions. ChexSystems Reports
3
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
4
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
5
Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
6
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
7
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
8
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
9
Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report
10
Federal Trade Commission. Credit Freezes and Fraud Alerts
11
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
12
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
13
Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures
14
Federal Trade Commission. Free Credit Reports
15
Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports
16
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
17
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
18
Consumer Financial Protection Bureau. Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)