A Summary of Your Rights Under the Fair Credit Reporting Act is a one-page federal disclosure, written by the Consumer Financial Protection Bureau, that lists the protections the FCRA gives you over the information credit bureaus collect, sell, and share about you.1Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act It tells you that you can see your file, dispute what’s wrong in it, control who gets to look at it, lock it down against new accounts, and sue anyone who breaks the rules. The document itself is short. The rights behind it are the substance, and they’re worth knowing in plain terms before you need them.
When You’re Supposed to Receive It
You should get a copy of the Summary at a few specific moments. Credit bureaus must include it any time they send you your file. Employers must hand it to you before they take any negative employment action based on a background check, and again after that decision becomes final.2Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Lenders and insurers who deny you credit, revoke an existing account, or charge you more because of your report must send an adverse action notice that identifies the bureau that supplied the report, states that the bureau didn’t make the decision, and tells you how to dispute and get a free copy.3Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports Landlords who turn you down for an apartment based on a tenant screening report owe you the same adverse action notice. Many don’t send one. If an apartment denial arrived with nothing but a “no,” your rights were likely skipped.
The employer process adds a step the others don’t have. Before the final decision, you’re supposed to receive a pre-adverse action notice that includes a copy of the actual report and a copy of the Summary of Rights, so you have a chance to flag mistakes before you lose the job.2Federal Trade Commission. Using Consumer Reports: What Employers Need to Know This two-step process applies whether the action is a denial, a rescinded offer, a reassignment, or a firing. An employer also needs your written authorization before pulling the report in the first place, on a standalone disclosure that isn’t buried inside an application.4Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
Your Right to See Your Credit File
You can ask any credit bureau for everything it has on you. The bureau must disclose all information in your file, the sources of that information, every entity that pulled your report in the past year (two years for employment-related inquiries), and a record of recent inquiries connected to credit or insurance offers you didn’t request.5Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
Federal law entitles you to a free copy once every 12 months from each nationwide bureau and each nationwide specialty reporting agency, plus a free copy after an adverse action, if you’re on public assistance, if you’re unemployed and expect to apply for work within 60 days, or if you believe your file contains errors from fraud.1Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act In practice, Equifax, Experian, and TransUnion have made free weekly reports permanently available through AnnualCreditReport.com, so you can check more often than the statute requires.6Federal Trade Commission. Free Credit Reports Errors are common. The sooner you spot one, the easier it is to fix.
Your Right to Dispute Errors
When something in your file is wrong or incomplete, you can dispute it directly with the bureau. The bureau must conduct a free reinvestigation and either correct the entry, delete it, or confirm its accuracy within 30 days of receiving your dispute.7Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy If you send additional supporting material during that window, the bureau can extend the review by up to 15 more days, but only if it hasn’t already found the item inaccurate or unverifiable.
If the bureau can’t verify a disputed item, it must delete or modify it. When the investigation ends, you’re entitled to written results and a free copy of the updated report if anything changed. Be specific when you dispute. Point to the exact entry, say why it’s wrong, and send documents if you have them. Vague complaints get dismissed as frivolous; precise ones force a real look.
Who Can Legally Pull Your Report
A bureau can’t hand your report to just anyone. The FCRA limits access to a closed list of permissible purposes:
- A lender evaluating a credit application, reviewing an existing account, or collecting a debt.
- An employer or prospective employer running a background check with your written consent.
- An insurer underwriting a policy or setting a premium.
- A landlord or property manager screening a rental application.
- A government agency determining eligibility for a license or benefit tied to your financial status.
- A valid court order or federal grand jury subpoena.
- Your own written instructions.
No one outside those categories has a legal right to pull your file.8Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports If an inquiry shows up on your report from a company that had no business looking, that itself is an FCRA violation.
How Long Negative Information Can Stay
The FCRA sets outer limits on how long negative items can be reported. When the clock runs out, the bureau has to stop reporting them.
- Bankruptcy: 10 years from the date filed or the order for relief.
- Civil suits and civil judgments: 7 years from entry, or until the governing statute of limitations expires, whichever is longer.
- Paid tax liens: 7 years from the date of payment.
- Collections and charge-offs: 7 years from the date the account was placed for collection or charged off.
- Most other negative items: 7 years.
- Criminal convictions: no federal time limit. Non-conviction records like arrests and dismissals do fall under the 7-year cap.9Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
Bureaus are supposed to drop expired items on their own, but they miss things. Spot a stale entry, dispute it.
Medical debt sits in an unsettled place. The CFPB finalized a rule in 2024 to remove most medical bills from credit reports, and a federal court in Texas vacated that rule in July 2025 as exceeding the agency’s authority under the FCRA.10Consumer Financial Protection Bureau. CFPB Finalizes Rule to Remove Medical Bills from Credit Reports Medical debt can still appear on your report, though it has to be coded so it doesn’t identify your specific provider or the services you received. The seven-year window applies to medical collections just like other debts.
Locking Down Your File
Two tools let you stop unauthorized access to your credit. They work differently.
Security Freeze
A freeze blocks all new access to your file. While it’s on, no one can open a new account in your name, including you. Anyone can place one, for any reason, and it stays until you lift it. Placing and lifting a freeze is free under federal law.11Consumer Financial Protection Bureau. Bureau of Consumer Financial Protection Issues Updated FCRA Model Disclosures You need to contact all three major bureaus separately to place one. When you need to lift a freeze for a legitimate application, the bureau must do it within one hour of a phone or online request, or within three business days by mail.12Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report? A freeze is the strongest protection against new fraudulent accounts.
Fraud Alert
A fraud alert is lighter. It doesn’t block access; it tells lenders to verify your identity before opening new credit. You only need to contact one bureau, which is legally required to tell the other two.13Federal Trade Commission. Credit Freezes and Fraud Alerts An initial alert lasts one year and is available to anyone who suspects identity theft. An extended alert lasts seven years but requires an identity theft report filed with the FTC or a police report. Active-duty service members deployed away from their usual station can place a 12-month active duty alert that works like a fraud alert and also removes them from unsolicited credit and insurance marketing lists for two years.14Consumer Financial Protection Bureau. Fraud Protection Tools to Help Safeguard Servicemembers
Identity Theft Block
If fraudulent accounts have already appeared in your file, you can go further than a dispute. Submit proof of identity, a copy of your identity theft report, and a statement identifying the fraudulent items, and the bureau must block those items within four business days.15Federal Trade Commission. FCRA Section 605B – Block of Information Resulting From Identity Theft A block is stronger than a dispute: it prevents the furnisher from putting the entry back. You also have the right to demand transaction records from businesses where fraudulent accounts were opened, free of charge, within 30 days of a written request.16Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft
Your Right to Sue
The FCRA lets you file suit in federal or state court against anyone who violates it: a bureau, a creditor, an employer, or a company that fed inaccurate information to a bureau.1Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
For willful violations, you can recover either actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater, plus possible punitive damages and reasonable attorney’s fees if you win.17Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance The $100 floor is what keeps smaller cases viable even when your actual loss is hard to pin down. For merely negligent violations, you can recover actual damages and attorney’s fees, but statutory and punitive damages aren’t available.18Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance That makes willful claims much more attractive.
Watch the clock. You have two years from the date you discover a violation to sue, with a hard outer limit of five years from the date the violation occurred.19Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions If you don’t notice the problem until after the five-year mark, the right to sue is gone. Pulling your report regularly is how you keep violations from aging out before you find them.
Suing isn’t the only option. The CFPB holds primary rulemaking authority over the FCRA and the FTC retains full enforcement power.20Federal Trade Commission. Fair Credit Reporting Act If a bureau is stonewalling you on a dispute, filing a complaint at consumerfinance.gov/complaint is often the fastest way to get its attention.