The Fair Credit Reporting Act is the federal law, codified at 15 U.S.C. ยง 1681, that controls how your credit information is collected, shared, and corrected.1Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose Enacted in 1970, it regulates the credit bureaus, the banks and creditors that feed them your data, and the businesses that pull your report to make decisions about you. It gives you specific rights: free access to your file, the ability to dispute errors, limits on who can see your data, and the power to sue when someone breaks the rules.
Who the Law Covers
Three groups sit inside the FCRA’s reach. Consumer reporting agencies are the companies that compile your data into reports, including the three national bureaus and a long list of specialty agencies that track narrower slices of your financial life, from insurance claims to tenant history.2Consumer Financial Protection Bureau. List of Consumer Reporting Companies Information furnishers are the banks, card issuers, and loan servicers that send your payment history to those agencies. Users of consumer reports are the lenders, landlords, insurers, and employers who pull the file to evaluate you. If a company touches your credit data at any point in that chain, the FCRA almost certainly imposes duties on it.
Your Core Rights Over Your Credit File
The most practically useful right the FCRA gives you is the right to see what’s in your file. You can request a free report from each of the three national bureaus once every twelve months through AnnualCreditReport.com.3eCFR. 12 CFR Part 1022 – Fair Credit Reporting (Regulation V) The three bureaus have also made free weekly online reports permanently available, and Equifax is offering six additional free reports per year through 2026.4Federal Trade Commission. Free Credit Reports
You also have the right to be told when information in your file leads to a negative decision about credit, insurance, or employment; to dispute anything you believe is inaccurate and force an investigation; and to request your credit score, though agencies can charge a reasonable fee. Mortgage lenders are an exception: when you apply for a home loan, the lender must provide your score along with a notice showing how it compares to other consumers and which factors affected it.5eCFR. 12 CFR 1022.74 – Exceptions
Who Can Legally Pull Your Report
Not just anyone can access your credit file. The FCRA restricts access to parties with a “permissible purpose,” and the statute lists them specifically: considering you for credit, reviewing an existing account, evaluating an insurance application, or assessing eligibility for a government license or benefit that requires a financial responsibility check.6Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports A court can also order disclosure through a subpoena.
Employers face an extra hurdle. Before pulling a background check or credit report on a job applicant or current employee, the employer must give the person a standalone written notice explaining what they plan to do and get written permission first.7Federal Trade Commission. Using Consumer Reports – What Employers Need to Know Verbal consent does not count, and the notice cannot be buried inside a job application.
Using a report without a permissible purpose is a federal offense. Anyone who knowingly obtains consumer report information under false pretenses faces up to two years in prison, a fine, or both.8Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses
How Long Negative Information Can Follow You
The FCRA sets hard limits on how long unfavorable data can stay on your report. Most negative items, including late payments, accounts sent to collections, and civil judgments, drop off after seven years. A Chapter 7 bankruptcy stays for ten years from the filing date, while Chapter 13 cases are typically removed after seven.9Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports Paid tax liens also fall off seven years from the date of payment.
For collection accounts, the seven-year clock starts 180 days after the delinquency that led to the collection action, not from the date a collector first reports the debt. A debt collector buying an old account and re-reporting it does not reset the clock. If you see a collection that should have aged off, that is a strong basis for a dispute.
Security Freezes and Fraud Alerts
A security freeze blocks credit bureaus from releasing your report to new creditors, which effectively prevents anyone from opening accounts in your name. Under federal law, placing and lifting a freeze is free. Online or phone requests must be honored within one business day for placement and within one hour when you need to lift the freeze to apply for new credit.10Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Security Freezes Mail requests get a three-business-day window in both directions. Because a freeze at one bureau does not carry over, you have to contact each of the three separately.
Fraud alerts work differently. Rather than blocking access, an alert tells creditors to take extra steps to verify your identity before opening a new account. An initial alert lasts at least one year and requires only a good-faith belief that you may be a fraud victim. An extended alert lasts seven years but requires filing an identity theft report first. Unlike a freeze, a fraud alert placed with one national bureau is shared with the other two automatically.
Adverse Action Notices
When a lender, insurer, landlord, or employer takes negative action based on your credit report, they must tell you. The law calls this an adverse action notice, and it must include the name and contact information of the bureau that supplied the report, a statement that the bureau itself did not make the decision, and notice of your right to a free copy of that report and to dispute anything inaccurate.11Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
For credit decisions specifically, the notice must also include your credit score if one was used, the range of possible scores under that model, the date the score was generated, and the top four factors that hurt your score. If recent inquiries were one of those factors, the creditor must list five factors instead of four.12Federal Trade Commission. Using Consumer Reports for Credit Decisions – What to Know About Adverse Action and Risk-Based Pricing Notices Those factors tell you exactly what to work on before applying again.
How to Dispute Errors
If you spot an error, you can dispute it with the bureau reporting it, with the furnisher that supplied the data, or both. Once a bureau receives your dispute, it has 30 days to investigate. If you send additional supporting evidence during that window, the deadline extends by 15 days, for a total of 45.13Federal Trade Commission. Consumer Reports – What Information Furnishers Need to Know The bureau must forward the information you provide to the furnisher, and the furnisher must review its records and report back.
If the investigation confirms the information is wrong or the furnisher cannot verify it, the bureau must delete or correct the entry. Within five business days of completing the investigation, the bureau must send you written results and a free copy of your updated report. If the furnisher fails to investigate within the required timeframe, the bureau must delete the disputed item.
Disputes that get results are specific. Include the account number, the exact information you believe is wrong, and why. Attach documentation: a payment confirmation, a court order, a letter from the creditor. Vague disputes with no supporting details are the ones most likely to be dismissed as frivolous or to result in the furnisher simply verifying its existing records without digging deeper.
Suing Under the FCRA
The Consumer Financial Protection Bureau enforces the FCRA at the federal level, with the Federal Trade Commission and federal banking regulators holding overlapping authority for certain entities. But the law also gives you a private right of action, so you can sue directly without waiting for a government agency to act.
Willful Violations
When a bureau, furnisher, or report user willfully violates the FCRA, you can recover statutory damages between $100 and $1,000 per violation even without proof of a specific dollar amount of harm. Courts can also award punitive damages and require the violator to pay your attorney fees.14Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Punitive damages are uncapped. Someone who obtains your report under false pretenses is liable for the greater of your actual damages or $1,000.
Negligent Violations
Not every violation is intentional. When it is negligent rather than willful, you can recover only your actual damages plus attorney fees. There are no statutory minimums and no punitive damages.15Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance You have to show concrete harm: a denied loan, a higher interest rate, lost time, documented emotional distress. The willful-versus-negligent line is often the central fight in FCRA cases.
Filing Deadlines
You must file suit within the earlier of two deadlines: two years from the date you discovered the violation, or five years from the date the violation occurred.16Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery rule matters. If a bureau has been reporting inaccurate information for four years and you only found out last month, your two-year window starts from last month. Once five years have passed from the violation itself, the door closes regardless of when you learned about it.