The Fair Credit Reporting Act gives you consumer rights that cover the whole life cycle of your credit file: you can see what’s in it for free, dispute anything that’s wrong, limit who gets to look at it, freeze it against identity thieves, and sue in federal court when a bureau, furnisher, or user of your report breaks the rules. Each right has its own procedures and deadlines, and knowing them is the difference between a report that quietly damages your finances and one you actively control.
Your Right to See Your Credit File
Every consumer reporting agency must, on request, disclose all information in your file at the time you ask, along with the sources of that information and a list of everyone who received a report about you recently.1Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers Credit scores are not automatically part of this disclosure. You can request a score separately, and the bureau may charge a reasonable fee unless a specific exception applies.
Federal law entitles you to one free report every twelve months from each nationwide bureau through a centralized request system.2Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures In practice you can currently check far more often than that. The three major bureaus have permanently extended a program letting you pull your report from each of them once a week at no cost through AnnualCreditReport.com.3Federal Trade Commission. Free Credit Reports Weekly access is the fastest way to catch identity theft or data errors early.
You also get a free report after adverse action. When a business denies your application for credit, insurance, or employment based in whole or in part on your credit report, it must send you an adverse action notice with the name, address, and phone number of the bureau that supplied the report, and a statement that the bureau did not make the decision.4Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions You then have 60 days to request a free copy of that report. This is separate from your annual and weekly entitlements, so use it whenever you get one.
Who Can Legally Access Your Report
Bureaus cannot hand your report to just anyone. Access is restricted to parties with a legally recognized permissible purpose.5Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The main ones are:
- A lender evaluating your application for a loan, credit card, or line of credit.
- An insurer assessing your application for coverage.
- A current or prospective employer, but only after giving you a standalone written disclosure and obtaining your written authorization first.
- A landlord evaluating your rental application.
- A court with proper jurisdiction, or a federal grand jury subpoena.
- A legitimate business transaction you initiated, such as setting up a utility account.
The employment rule catches many people off guard. Unlike a lender, an employer must get your specific written permission before pulling your report, and the disclosure has to be on its own page rather than buried in an employment application.
Stopping Prescreened Offers
Credit card and insurance companies can use your credit file to generate prescreened offers, the unsolicited letters saying you’ve been pre-approved. You have the right to shut these off. Calling 1-888-5-OPT-OUT or visiting OptOutPrescreen.com gives you a five-year opt-out by phone, or you can submit a signed form to make it permanent.6Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance The opt-out takes effect within five business days.
How Long Negative Information Can Stay on Your Report
Credit bureaus cannot report negative information forever, regardless of what a collector or creditor might claim. The maximum time limits under federal law:
- Late payments, collection accounts, charged-off accounts, civil judgments, and paid tax liens fall off after seven years. For collections and charge-offs, the seven-year clock starts 180 days after the date of the original delinquency that led to the collection activity.7Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
- Bankruptcy cases can be reported for up to ten years from the date the court entered the order for relief.
- Records of criminal convictions can be reported indefinitely.
These limits do not apply to certain high-value transactions. If the report is being used for a credit application of $150,000 or more, a life insurance policy with a face amount of $150,000 or more, or employment at an annual salary of $75,000 or more, the standard time caps drop away.
Security Freezes and Fraud Alerts
If you are worried about identity theft, two tools let you lock down or flag your file. Both are free.
A security freeze prevents any new creditor from accessing your report, which effectively blocks anyone from opening accounts in your name. Bureaus must place a freeze at no charge within one business day of a phone or online request, or within three business days for mail requests.8Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts When you need to apply for credit yourself, you can lift it temporarily, and the bureau must remove the freeze within one hour of a phone or online request. Parents and guardians can also freeze the files of children under 16, and representatives can freeze files for incapacitated individuals, at no cost.
A fraud alert is lighter. It flags your file so that any business pulling your report must take reasonable steps to verify your identity before extending credit. An initial fraud alert lasts at least one year. If you have actually been a victim of identity theft and file an identity theft report, you can place an extended fraud alert that lasts seven years. You only need to contact one bureau; it must notify the other two.
How to Dispute an Error
The dispute process is where most people actually use the FCRA, and how you handle it matters. A sloppy dispute gets a rubber-stamp response. A documented one forces the bureau to take you seriously.
Start by pulling your report and identifying the exact entries you believe are wrong. For each error, gather supporting evidence: payment receipts, account statements, court orders showing a debt was discharged, or correspondence with the creditor. Include your full name, date of birth, and current address so the bureau can match the dispute to the right file. Each of the three major bureaus offers an online dispute portal, and Equifax also provides a downloadable form you can mail in.
Once a bureau receives your dispute, it generally has 30 days to investigate.9Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy The bureau must forward the dispute to the furnisher that reported the data, and the furnisher must conduct its own review. If the information turns out to be inaccurate or can’t be verified, the bureau must correct or delete it. Within five business days of finishing the investigation, the bureau must send you written notice of the results, including an updated copy of your report if anything changed, information about your right to add a personal statement to your file, and details about how to request information on the investigation itself.
If the investigation does not resolve the dispute in your favor, you can add a brief statement to your file explaining why you still believe the information is wrong. The bureau can limit that statement to 100 words. Going forward, the statement, or a summary of it, must accompany the disputed item whenever the bureau releases your report. It is not as good as removal, but it gives future creditors context.
Send disputes by certified mail with return receipt if you want a paper trail proving when the bureau received them. Keep copies of everything. If the bureau ignores you or fails to investigate, those records become the foundation of a lawsuit.
Suing for FCRA Violations
The FCRA has real teeth. When a bureau, furnisher, or user of your report breaks the rules, you can sue in federal court, and the statute is structured to make that feasible even when your out-of-pocket loss is small.
For a willful violation, you can recover either your actual damages or statutory damages between $100 and $1,000, whichever is greater. On top of that, the court can award punitive damages plus your attorney fees and court costs.10Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Statutory damages matter because they mean you do not need to prove a specific dollar loss to bring a case. If someone obtained your report under false pretenses or knowingly without a permissible purpose, the minimum recovery is $1,000 or the actual loss, whichever is greater.
For a negligent violation, meaning carelessness rather than intentional wrongdoing, you can recover actual damages and attorney fees, but not statutory or punitive damages.11Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance That means a negligence claim needs provable financial harm: a denied mortgage, a lost job opportunity, documented emotional distress. Without real losses, negligence cases are hard to win.
Anyone who knowingly obtains consumer report information under false pretenses faces a fine and up to two years in prison.12Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses That is a criminal matter pursued by the government, not something you file yourself, but it shapes the risk calculus for the worst abuses.
Deadlines are strict. You must file an FCRA lawsuit within two years of discovering the violation, or five years after the violation occurred, whichever comes first.13Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery rule helps when you could not reasonably have known about the violation when it happened, but the five-year outer limit is absolute. Waiting is one of the most common ways people lose otherwise strong claims.