Summary of Your Rights Under the Fair Credit Reporting Act

Your rights under the Fair Credit Reporting Act give you legal control over the personal data that credit bureaus, tenant screeners, and background check companies collect about you. You can see your file, limit who else sees it, force errors to be corrected, block fraudulent accounts, and sue for money damages when a company breaks the rules. The sections below walk through each right and what to do with it.

Seeing What’s in Your Credit File

Any credit bureau must show you everything in your file when you ask. That includes payment history, account balances, public records, and a list of every company that pulled your report in the past one or two years, depending on whether the inquiry was for employment.¹ Your credit score is treated separately and does not have to be included.

The three major bureaus now let you check your reports free every week through AnnualCreditReport.com, a program that was originally temporary and has been made permanent.² On top of that weekly access, you’re entitled to another free report if you’re unemployed and plan to apply for work within 60 days, if you receive public assistance, or if you believe your file contains errors from fraud.³

If you want your actual credit score, the bureau can charge a fee. For 2026 that fee is capped at $16, and the ceiling adjusts each January for inflation.⁴

Who Can Legally Pull Your Report

A bureau cannot release your report to anyone who asks. The law limits access to parties with a recognized reason: considering you for a loan, reviewing an account you already have, underwriting insurance, or evaluating you for a government license that depends on financial responsibility.⁵ Landlords screening rental applications and child support agencies also qualify.

Employers are handled differently. A company cannot pull your credit report for hiring or promotion decisions unless it first gives you a standalone written notice and gets your written permission.⁶ The trucking industry is the main exception, where written consent generally is not required.⁷

Notice When You’re Turned Down

When a company denies your application for credit, insurance, employment, or housing based on your credit report, it has to tell you. The notice must name the bureau that supplied the report and provide its address and phone number.⁸ It must also make clear that the bureau did not make the decision and cannot explain it; only the company that denied you can do that.

An adverse action notice is often how people first discover errors. Once you know which bureau’s data drove the denial, you can request that file and check whether the information was accurate.

How Long Negative Information Can Stay

Most bad marks have a legal shelf life. Collection accounts, late payments, and other adverse items must drop off after seven years. Bankruptcy filings can remain up to ten years from the date the court entered the order for relief.⁹ Criminal convictions have no time limit and can be reported indefinitely.

These are maximums. A bureau cannot keep negative information longer than the statute allows, and a derogatory item older than the legal window is grounds for a dispute on that basis alone.

Fixing Errors: Disputing with a Credit Bureau

If something in your report is wrong, you can dispute it directly with the bureau. Once the bureau receives your dispute, it must investigate for free and finish within 30 days.¹⁰ That window can stretch to 45 days if you submit additional supporting information during the initial period, or if you filed the dispute after receiving your free annual report.¹¹ If the disputed item turns out to be inaccurate or cannot be verified, the bureau must correct or delete it.

Be specific when you file. Include the account number, identify exactly what is wrong, and attach proof. A dispute that says “this account is wrong” gives the bureau little to work with. One that says “this account shows a $2,400 balance but was paid in full on March 15, 2025 — see attached bank statement” gets results. You can file online through each bureau’s portal or by certified mail, which creates a paper trail confirming when the bureau received the dispute.

If the investigation does not fix the problem, you can add a brief statement to your file explaining your side. The bureau can limit the statement to 100 words but must help you draft a clear summary, and it will then appear in future reports pulled by lenders, landlords, or other users.¹⁰

Disputing Directly with the Company That Reported the Data

You can also send the dispute straight to the furnisher: your bank, credit card issuer, or whichever company reported the item.¹² The dispute must identify the specific information you’re challenging, explain why it’s wrong, and include supporting documentation.

Once the company receives a valid direct dispute, it must conduct a reasonable investigation, review everything you submitted, and finish within the same timeframe that applies to a bureau investigation. If the company confirms the information was wrong, it must notify every bureau it reported to and send the corrected data.¹²

One catch: the company only has to investigate if you send the dispute to the right address. Check your credit report or the company’s website for a designated disputes address. If none is specified, any of the company’s business addresses will work. A furnisher can also reject a dispute as frivolous if you haven’t provided enough to investigate, but it must notify you of that decision within five business days.

Freezing Your File

A security freeze blocks a bureau from releasing your report to anyone new, which stops identity thieves from opening accounts in your name. Placing and lifting a freeze is free under federal law.¹³

If you request a freeze online or by phone, the bureau must put it in place within one business day. Mail requests get three business days. The freeze stays until you ask to remove it. When you need to lift it temporarily for a mortgage application or similar, the bureau must remove it within one hour of an online or phone request, or within three business days for a mail request.¹³

A freeze doesn’t affect your existing accounts, and it doesn’t prevent you from pulling your own free report. The main inconvenience is remembering to lift it before applying for new credit.

Fraud Alerts

A fraud alert is lighter than a freeze. Instead of blocking access, it tells businesses to verify your identity before opening new accounts. You only need to contact one of the three major bureaus, which is required to notify the other two.

There are three types. An initial fraud alert lasts one year and can be placed by anyone who suspects they might be a fraud victim, with no proof required. An extended fraud alert lasts seven years but requires an identity theft report showing you have actually been victimized.¹⁴ An active duty alert, available to military service members, lasts one year, can be renewed for the length of a deployment, and also removes you from prescreened offer lists for two years.¹⁵

Blocking Identity Theft Information

If someone has already used your identity to open accounts or run up debt, you can force the bureau to block the fraudulent information from your report. To trigger the block, give the bureau proof of your identity, a copy of your identity theft report (typically filed with the FTC or local law enforcement), and a statement identifying which items are fraudulent.¹⁶

The bureau must block the information within four business days and notify the company that reported it. The bureau can later reverse the block if it finds the request rested on a material misrepresentation or if you actually benefited from the transaction, but it must notify you before rescinding.¹⁶

Stopping Prescreened Offers

Preapproved credit card and insurance offers exist because bureaus sell lists of consumers who meet certain criteria. You can stop them. Visit optoutprescreen.com or call 1-888-567-8688 to opt out for five years. To opt out permanently, use the same site or number and then sign and return a written form.¹⁷

Opting out only affects offers based on bureau lists. It won’t stop mail from companies you already do business with, and it doesn’t touch other kinds of junk mail.

Investigative Consumer Reports

An investigative consumer report goes beyond your credit file. It can include interviews with neighbors, former employers, or associates about your character, reputation, and lifestyle, and it shows up most often in employment screening, security clearances, and insurance underwriting.

When a company orders one, it must send you written notice within three days of requesting the report. That notice must tell you an investigative report may be prepared and that you can request a full description of its scope.¹⁸ If you make that request, the company must respond in writing within five days of receiving it, or five days after the report was first ordered, whichever is later.

Suing When a Company Breaks the Rules

The FCRA has real teeth. If a bureau or a furnisher breaks the rules, you can sue in federal or state court. What you can recover depends on whether the violation was deliberate or careless.

For willful violations, where a company knowingly or recklessly disregarded the law, you can recover either your actual losses or statutory damages of $100 to $1,000, whichever is greater. Courts can also award punitive damages, with no cap set in the statute.¹⁹

For negligent violations, where a company should have followed the law but didn’t, you can recover your actual damages. Actual damages include things like a higher interest rate you paid because of bad information, a lost job offer, or other financial harm you can trace directly to the violation.²⁰

Either way, if you win, the defendant pays your attorney’s fees and court costs.¹⁹ That fee-shifting rule is what makes these cases financially viable for most consumers.

How Long You Have to Sue

You have two years from the date you discover the violation to file suit, with an absolute outer limit of five years from the date the violation actually happened.²¹ Miss either deadline and courts will dismiss the case regardless of the merits. If you’ve found an error and the company won’t fix it, the clock is already running.

1
Office of the Law Revision Counsel. 15 US Code 1681g – Disclosures to Consumers
2
Federal Trade Commission. Free Credit Reports
3
GovInfo. 15 USC 1681g – Disclosures to Consumers
4
Consumer Financial Protection Bureau. Fair Credit Reporting Act Disclosures
5
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
6
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
7
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
8
Office of the Law Revision Counsel. 15 US Code 1681m – Requirements on Users of Consumer Reports
9
Office of the Law Revision Counsel. 15 US Code 1681c – Requirements Relating to Information Contained in Consumer Reports
10
Office of the Law Revision Counsel. 15 US Code 1681i – Procedure in Case of Disputed Accuracy
11
Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report
12
Consumer Financial Protection Bureau. 12 CFR 1022.43 – Direct Disputes
13
Office of the Law Revision Counsel. 15 US Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
14
TransUnion. Fraud Alerts
15
Military OneSource. FTC Active-Duty Fraud Alert
16
Office of the Law Revision Counsel. 15 US Code 1681c-2 – Block of Information Resulting from Identity Theft
17
Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance
18
Office of the Law Revision Counsel. 15 US Code 1681d – Disclosure of Investigative Consumer Reports
19
Office of the Law Revision Counsel. 15 US Code 1681n – Civil Liability for Willful Noncompliance
20
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
21
Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions