Yes, it is illegal to check someone else’s credit report unless you have their written permission or one of the specific legal reasons listed in the Fair Credit Reporting Act. Pulling a report without a qualifying purpose can expose you to a civil lawsuit, statutory damages of up to $1,000 per violation, punitive damages, attorney’s fees, and in deliberate cases up to two years in federal prison. The rule applies equally to companies, coworkers, family members, and anyone else who gets access to a report they weren’t entitled to see.
The Federal Law That Controls Access
The Fair Credit Reporting Act, enacted in 1970, governs who can see a consumer’s credit history and under what circumstances.1Federal Trade Commission. Fair Credit Reporting Act It covers the three national bureaus (Equifax, Experian, and TransUnion) along with specialty agencies that compile tenant, medical, and similar records. The statute’s central rule is short: a credit reporting agency may not release a consumer’s report to anyone who lacks a “permissible purpose” defined by Congress.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports No permissible purpose, no legal access. A curious neighbor, a suspicious spouse, or a business with no relationship to you cannot legally obtain your report just because they want to see it.
Who Is Actually Allowed to Pull a Report
The FCRA’s list of permissible purposes is exhaustive. If a reason doesn’t fit one of the categories below, the pull is unlawful.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
- A lender evaluating a credit application, reviewing an existing account, or collecting on a debt.
- Anyone the consumer has authorized in writing, which is how background-check firms and financial advisors get access.
- An insurer underwriting a policy.
- A landlord or property manager screening a rental application.
- An employer, but only after a standalone written disclosure and the applicant’s signed authorization.
- A government agency that must by law consider financial status before granting a license or benefit.
- A court with jurisdiction or a federal grand jury acting through a subpoena.
- A state or local child support agency establishing or enforcing a support order.
- A business the consumer approached, where the report is relevant to the transaction the consumer initiated.
Written consent is the clean path for anyone outside those categories. Without it, pulling the report is a violation whether the person doing it is a stranger, a relative, a coworker, or a company that already has some of your information for other reasons.
Penalties for Pulling a Report Without Permission
The FCRA splits violations into willful and negligent conduct, and layers a criminal statute on top for the worst cases.
Willful Violations
When someone intentionally obtains your report without a permissible purpose, you can recover your actual damages (lost money, emotional distress, time spent cleaning up the mess) or statutory damages between $100 and $1,000 per violation, whichever benefits you more. Courts can add punitive damages on top of that, plus attorney’s fees and costs. The floor is higher when the violator is an individual person rather than a company: at least $1,000 or actual damages, whichever is greater, for anyone who obtains a report under false pretenses or knowingly without a permissible purpose.3Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
Negligent Violations
Not every unauthorized access is deliberate. A company with weak compliance procedures or a bureau that releases the wrong consumer’s file can still be sued, but only for actual damages plus attorney’s fees and costs.4Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance No statutory or punitive damages are available for negligence, which is why proving willfulness often drives FCRA litigation.
Criminal Penalties
Deliberately obtaining a credit report under false pretenses is a federal crime punishable by a fine and up to two years in prison.5Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses A parallel provision carries the same penalties for any officer or employee of a credit reporting agency who knowingly releases consumer information to someone not authorized to receive it.6Office of the Law Revision Counsel. 15 USC 1681r – Unauthorized Disclosures by Officers or Employees Criminal prosecutions are less common than civil suits but do occur, particularly in identity theft rings and corrupt-insider cases.
What to Do If Someone Pulled Your Report
Spotting the unauthorized access quickly protects both your credit and your ability to recover damages.
Check all three reports. You can pull your file from each bureau once a week at no charge through AnnualCreditReport.com.7Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports Focus on the hard inquiries section, since those reflect lending-related pulls that stay on your report for two years. Scan soft inquiries too, but hard inquiries are where unauthorized access does the most damage.
Contact the company behind the inquiry. Ask them to identify the permissible purpose they relied on. If they can’t produce one, ask them to request removal of the inquiry. Keep a dated record of every call and letter, including names and what was said.
Dispute with the bureau. If the company won’t cooperate, file a written dispute with each bureau showing the inquiry you believe was unauthorized. The bureau has to investigate and respond.
File regulatory complaints. The Consumer Financial Protection Bureau and the Federal Trade Commission both enforce the FCRA.1Federal Trade Commission. Fair Credit Reporting Act A complaint creates a paper trail and can prompt enforcement action against repeat offenders.
Talk to an FCRA attorney. Because the statute lets courts award attorney’s fees to successful plaintiffs, many lawyers who handle these cases work on contingency. That matters when actual damages are hard to quantify but statutory and punitive damages are on the table.
How Long You Have to Sue
An FCRA lawsuit generally must be filed within two years of when you discover the violation or within five years of when it occurred, whichever hits first. The discovery rule is important here, because unauthorized pulls can sit on a report unnoticed for months. The clock starts when you find the inquiry or otherwise learn about the violation, not when the pull itself happened.
How to Keep It From Happening Again
The strongest preventive measure is a security freeze. With a freeze in place, the bureau cannot release your report to a new creditor, so an identity thief who has your Social Security number still cannot open accounts in your name. Federal law requires the bureaus to place a freeze for free within one business day of a phone or online request and to lift it within one hour when you’re ready to apply for credit.8GovInfo. 15 USC 1681c-1 – Identity Theft Prevention and Credit History Restoration A freeze does not interfere with existing creditors reviewing accounts you already hold.
A fraud alert is a lighter alternative. Instead of blocking access, it flags your file and tells lenders to verify your identity before opening new accounts. An initial fraud alert lasts one year and only requires contacting one bureau, which must notify the other two. Confirmed identity theft victims can request an extended alert that lasts seven years. For someone who isn’t actively applying for credit, a freeze at all three bureaus is the stronger choice; for someone shopping for a mortgage or car loan, a fraud alert is easier to live with.