Under the Fair Credit Reporting Act, only someone with a “permissible purpose” can pull your credit report, and the statute lists those purposes exhaustively. So the short answer to who can pull your credit report is: a lender you’ve applied to, a creditor already managing your account, an insurer underwriting a policy, an employer with your written consent, a landlord or utility handling a transaction you started, certain government agencies, anyone you authorize in writing, and a few narrower categories tied to loan servicing and national security.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Anyone outside that list who accesses your file is exposed to civil damages and, in some cases, criminal penalties.
Lenders and Existing Creditors
The most common reason a company sees your report is that you applied for credit. Submitting a loan, credit card, or mortgage application gives the lender an automatic right to pull your file and evaluate the risk of extending credit.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
That right continues after you’re approved. Existing creditors can review your report to manage the account, raise or lower your credit limit, adjust your interest rate, or decide whether you still meet the original terms. If you fall behind, the same creditor can pull your file again to assess your overall financial picture before deciding how to collect. These ongoing reviews are typically soft inquiries, meaning they appear on your report but don’t affect your score.
Employers
An employer can pull your credit report for hiring, promotion, or retention decisions, but this is the most heavily regulated category in the statute. Before requesting the report, the employer must give you a standalone written disclosure that a credit report may be obtained for employment purposes, and you must authorize the pull in writing.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The disclosure can’t be tucked into a stack of other onboarding paperwork.
If the employer decides against you because of something in the report, the adverse-action process runs in two stages. First comes a pre-adverse action notice with a copy of the report and a written summary of your rights, giving you time to spot errors. The statute doesn’t fix an exact waiting period, but five business days is the widely accepted standard. Only after that window can the employer issue a final adverse action notice identifying the credit bureau that supplied the report.2Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions
More than a dozen states now restrict or ban employment credit checks entirely for most positions, usually carving out financial-sector jobs. If you’re asked to authorize a credit pull during a job application, check whether your state limits the practice.
Insurance Companies
Insurers can pull your report when you apply for a new policy or when they review an existing one at renewal.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports They use the data to build an insurance-specific score that feeds actuarial models predicting claim likelihood and setting premiums. A weak credit profile can mean a higher rate or fewer policy options; a change in your profile between renewals can move the number too.
These pulls are generally soft inquiries and won’t hurt your score. If an insurer raises your rate or declines coverage because of your credit data, it must send you an adverse action notice identifying the bureau that supplied the report and telling you how to get a free copy.2Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions
Landlords, Utilities, and Transactions You Initiated
The statute grants a permissible purpose to any company with a legitimate business need tied to a transaction you started.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports That’s the bucket that covers landlords screening tenants, utilities activating service, and cell carriers evaluating whether to put a $1,000 phone on a payment plan. In each case the company is extending something of value and wants to know your track record.
The key word is “initiated.” An FTC staff opinion letter drew a useful line: walking into a car dealership and asking about prices or taking a test drive does not give the dealer permission to pull your credit. The dealer needs your written consent unless you’re actually beginning the purchase or lease of a specific vehicle and have asked the dealer to arrange financing. If you’re paying cash, there’s no legitimate business need for your report at all. This is where unauthorized pulls happen most often, so be alert when a salesperson asks for your Social Security number “just to see what we can do.”
Government Agencies
A handful of government actions create a permissible purpose without your consent. Credit bureaus must release your report in response to a court order or a federal grand jury subpoena.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports State or local child support agency heads can request your report after certifying it’s needed to establish payment capacity, set a payment amount, or enforce an existing order. Government agencies also have access when evaluating your eligibility for a license or benefit that legally requires a financial-responsibility review.
Two separate statutes give national security agencies access without a traditional court order. The FBI can obtain limited identifying information for counterintelligence investigations through a written request signed by a senior official no lower than a Deputy Assistant Director, certifying the data is needed to protect against international terrorism or clandestine intelligence activities.3Office of the Law Revision Counsel. 15 US Code 1681u – Disclosures to FBI for Counterintelligence Purposes A broader provision lets any authorized agency obtain a full consumer report for terrorism-related investigations with written certification from a designated supervisory official.4Office of the Law Revision Counsel. 15 USC 1681v – Disclosures to Governmental Agencies for Counterterrorism Purposes Both provisions bar investigations of U.S. persons based solely on constitutionally protected activity.
Prescreened Credit and Insurance Offers
Those pre-approved offers arriving in your mailbox aren’t random. Credit bureaus can share limited data with companies making what the law calls a “firm offer of credit or insurance,” meaning the company must actually honor the offer if you meet the selection criteria.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The company gets your name, address, and a non-unique identifier for verification, not your full credit history.
You can stop these mailings. Contact the nationwide opt-out system at optoutprescreen.com or call 1-888-567-8688 to opt out for five years.5Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance A permanent opt-out requires a signed election form, available through the same channels. The opt-out takes effect within five business days.
Anyone You Authorize in Writing
You can authorize any person or company to pull your report, for any reason, by giving written instructions to the credit bureau.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports This is the catch-all for situations that don’t fit the other categories: a financial advisor helping you plan, a family member co-managing your finances, a monitoring service watching your file. The authorization needs to be in writing and specific about who’s permitted access.
How to Spot an Unauthorized Inquiry
You don’t have to guess who’s been looking. Credit bureaus must disclose every entity that pulled your report during the prior year for most purposes, or the prior two years for employment-related inquiries.6Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers Each entry includes the company’s name and, on request, its address and phone number. Prescreened inquiries you didn’t initiate are listed separately.
You’re entitled to one free report from each of the three major bureaus every year through AnnualCreditReport.com. Reviewing the inquiry section regularly is the simplest way to catch unauthorized pulls early. Any inquiry you don’t recognize is worth investigating.
Disputing an Inquiry You Didn’t Authorize
Start by contacting the company listed on the entry. Sometimes what looks unauthorized turns out to be a soft pull from an existing creditor or a prescreened offer you forgot about. If the company can’t explain why it accessed your file, or you never dealt with it at all, you have grounds to dispute.
File a dispute directly with the credit bureau showing the inquiry. You can do it online, by phone, or by mail. The bureau then has 30 days to investigate and either verify or remove the inquiry, extendable to 45 days if you submit additional supporting information during the investigation.7Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy If the pull can’t be verified, the bureau must delete it.
For inquiries that are clearly fraudulent, file an identity theft report at IdentityTheft.gov and place a fraud alert or credit freeze with all three bureaus. A fraud alert requires creditors to take extra verification steps before opening new accounts. A freeze goes further by blocking access to your report until you lift it. Neither costs anything.
What Violators Owe You
Consequences for pulling a report without a permissible purpose fall into three categories.
A willful violation entitles you to either your actual damages or statutory damages of $100 to $1,000, whichever is greater, plus punitive damages at the court’s discretion and your attorney’s fees.8Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance When someone obtains a report under false pretenses or knowingly without any permissible purpose, the floor rises to $1,000 or actual damages, whichever is greater, and the bureau itself can also recover damages.
A negligent violation carries only actual damages plus attorney’s fees and costs, with no statutory minimum and no punitive damages.9Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance If you can’t prove concrete financial harm, recovery may be minimal, which is why willful cases are the ones consumers usually pursue.
Criminally, anyone who knowingly obtains credit information under false pretenses faces up to two years in prison, a fine, or both.10Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses That provision targets outright fraud: someone impersonating a landlord or fabricating a business relationship to reach your data. If an unauthorized pull caused real harm, talk to a consumer rights attorney about the civil provisions. Many FCRA attorneys work on contingency because the statute awards fees to prevailing consumers.