The Fair Credit Reporting Act is the federal law that lets you see what’s in your credit file, dispute anything that’s wrong, control who can pull your report, and sue when a company mishandles your information. It applies not just to Equifax, Experian, and TransUnion, but to any business that assembles consumer information used for decisions about credit, housing, insurance, or employment, along with the banks, lenders, and other companies that feed data into those reports.1Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose
What the Law Requires of Credit Bureaus
Every consumer reporting agency must follow reasonable procedures to ensure the maximum possible accuracy of your file.2Office of the Law Revision Counsel. 15 USC 1681e – Compliance Procedures That duty reaches beyond the three big bureaus. Tenant screening companies, employment background check firms, and specialty agencies that track things like check-writing history or insurance claims all count as consumer reporting agencies when they provide information used to make decisions about you.3Federal Trade Commission. What Tenant Background Screening Companies Need to Know About the Fair Credit Reporting Act You can request free reports from those specialty agencies too.4Consumer Financial Protection Bureau. What Are Specialty Consumer Reporting Agencies and What Types of Information Do They Collect
The law also puts hard limits on how long negative information can follow you. Most adverse items drop off after seven years, including collection accounts, late payments, civil judgments, paid tax liens, and arrest records. Bankruptcies stay for ten years from the date the court entered the order for relief.5Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports Criminal convictions have no time limit and can be reported indefinitely.
Your Right to See Your Credit File
You’re entitled to one free report every twelve months from each of the three nationwide bureaus through AnnualCreditReport.com, the only federally authorized source for these free disclosures.6Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures When you request your file, the agency must hand over everything it holds on you, the sources of that information, and a record of who has pulled your report.
How far that inquiry record reaches depends on why the report was pulled. Employment-related inquiries show up for two years. All others show up for one.7Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers Scanning that list is one of the easiest ways to catch identity theft early, since an inquiry you don’t recognize usually means someone applied for credit in your name.
Credit scores are handled separately. A bureau isn’t required to fold your score into a standard file disclosure, but you can request it. When a lender uses your score to offer you worse terms, the lender must tell you the key factors that pulled your score down, up to four (or five if one of them is the number of recent inquiries).8eCFR. 12 CFR Part 1022 – Fair Credit Reporting (Regulation V)
Who Can Access Your Credit Report
The law tightly limits who gets to see your file. A bureau can only release your report for a recognized permissible purpose: evaluating a credit application, reviewing an existing account, underwriting insurance, screening a rental application, and a handful of other legitimate business needs.9Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports A company that pulls your report out of curiosity or for marketing has no legal basis for doing so and faces liability.
Employers face stricter rules. Before an employer can even pull your report, it must give you a standalone written disclosure explaining that a report may be obtained, and you must authorize it in writing. That disclosure has to sit on its own page, not buried in a stack of onboarding paperwork. Government agencies can access your report through a court order or qualifying subpoena, but they don’t get blanket access simply because they’re the government.9Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Locking Down Your File
The FCRA gives you two main ways to protect your file: security freezes and fraud alerts. They work differently.
A security freeze blocks the bureau from releasing your report to anyone new. No lender, no landlord, and no one else can open a new account in your name while the freeze is in place, including you, unless you temporarily lift it. Freezes are free to place and free to lift. If you request one by phone or online, the bureau must put it in place within one business day. Mail requests get three business days.10Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention, Fraud Alerts and Active Duty Alerts A freeze stays until you remove it, and you have to contact each of the three bureaus separately.
Fraud alerts are lighter. Instead of blocking access, an alert tells businesses to verify your identity before opening a new account. You only need to contact one bureau, which then notifies the other two.10Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention, Fraud Alerts and Active Duty Alerts Three versions exist:
- An initial fraud alert is available to anyone who suspects fraud. It lasts one year and can be renewed.
- An extended fraud alert is available if you’ve filed an identity theft report with the FTC or police. It lasts seven years and also removes you from prescreened credit offer lists for five years.
- An active duty alert is available to servicemembers on active duty. It lasts one year and removes you from prescreened offer lists for two years.
Active duty servicemembers also get free electronic credit monitoring from each nationwide bureau, with notifications within 48 hours of significant changes to their file, such as new accounts, address changes, or delinquencies.11eCFR. 16 CFR Part 609 – Free Electronic Credit Monitoring for Active Duty Military
How to Dispute Errors
When you spot an error, the FCRA requires the bureau to investigate for free. Identify the specific item that’s wrong and gather supporting evidence: bank statements, payment confirmations, court records, anything that shows the entry is inaccurate. Then submit your dispute to the agency, either online through its portal or by certified mail if you want a paper trail.
Once the agency receives your dispute, it has 30 days to complete its investigation. That deadline can stretch to 45 days if you provide additional relevant information during the investigation period.12Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy The agency contacts the original creditor or data furnisher to verify the item. If the furnisher can’t verify it, the agency must delete or correct it. When the investigation ends, you get a written notice of the results and a free updated copy of your report if anything changed.
The Furnisher’s Role
The company that originally reported the disputed information, whether a bank, credit card issuer, or collection agency, has its own duties. A furnisher that knows or has reasonable cause to believe information is inaccurate cannot keep sending it to credit bureaus. When a furnisher discovers on its own that previously reported data is incomplete or wrong, it must promptly notify the bureau and provide corrections.13Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
You can also send your dispute directly to the furnisher instead of the bureau. In that case the furnisher must investigate, review everything you provided, and report its findings back to you within the same 30-day window. If it determines the information was wrong, it must promptly notify every bureau it reported to and send corrections.13Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies This direct route is underused but can be effective, especially when the bureau keeps rubber-stamping what the furnisher reports.
Not every dispute has to be investigated. A dispute can be deemed frivolous if you didn’t provide enough information to investigate, or if it repeats a dispute already resolved with no new supporting evidence. If a company makes that call, it has to notify you within five business days, explain why, and tell you what information it would need to proceed.14eCFR. 12 CFR 1022.43 – Direct Disputes That’s why the initial submission matters so much. A vague dispute with no documentation is easy to dismiss.
When You’re Denied Because of Your Report
When a company denies you credit, insurance, housing, or employment based on information in your credit report, it must send you an adverse action notice. That notice identifies the bureau that supplied the data, makes clear the bureau didn’t make the decision, and tells you that you can get a free copy of your report within 60 days.15Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports This free report is separate from your standard annual free report, so a denial gets you an additional look at your file.
Employment decisions carry an extra step that trips up many companies. Before an employer finalizes an adverse action like rescinding a job offer or denying a promotion, it must first give you a copy of the report it relied on and a written summary of your rights under the FCRA.9Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports That pre-adverse action step has to happen before the final decision, giving you a chance to see the data and flag errors before it costs you the job. Only after providing that notice and a reasonable waiting period can the employer send the standard adverse action notice and make its decision final.
A full denial isn’t the only trigger. If a lender approves you but gives you a higher rate or worse terms than what it offers to a large share of its other borrowers, it must send you a risk-based pricing notice explaining that your credit report influenced those terms.16eCFR. 12 CFR 1022.72 – General Requirements for Risk-Based Pricing Notices The notice must include the key factors that dragged your score down. Many consumers never realize they’re paying more than necessary because they don’t understand the notice or assume any approval is good news. If a lender approved your credit card at 22% instead of the 16% it offers stronger applicants, you deserve to know why.
Suing When the Law Is Broken
The FCRA lets you sue in federal court when a bureau, furnisher, or report user violates the law. What you can recover depends on whether the violation was negligent or willful.
When a company carelessly fails to follow the law’s requirements, you can recover actual damages, meaning the real financial harm you suffered, plus attorney’s fees and court costs if you win.17Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance The challenge is proving those damages: you need to show a dollar amount you lost, whether from a denied loan, a higher interest rate, or emotional distress with documented evidence.
If the violation was intentional or reckless, the stakes rise. You can recover actual damages or statutory damages between $100 and $1,000 (whichever you choose), plus punitive damages in whatever amount the court deems appropriate, plus attorney’s fees and costs.18Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Statutory damages matter because you don’t have to prove a specific dollar loss to recover something. Anyone who obtains your report under false pretenses or knowingly without a permissible purpose owes you actual damages or $1,000, whichever is greater.
You must file your lawsuit by the earlier of two deadlines: two years after you discover the violation, or five years after the violation actually occurred.19Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts, Limitation of Actions The discovery rule helps when a bureau has been reporting inaccurate information for years and you only recently learned about it. But the five-year backstop means undiscovered violations eventually become too old to sue over. If you find an error on your report, don’t sit on it.