Your Rights Under the FCRA: Disputes, Freezes, and Damages

Your rights under the Fair Credit Reporting Act let you see what consumer reporting agencies say about you, dispute anything that’s wrong, limit who can pull your file, block new creditors with a freeze, take extra protective steps after identity theft, and sue companies that break the law. The Consumer Financial Protection Bureau publishes a standardized “Summary of Your Rights Under the Fair Credit Reporting Act” that credit bureaus must hand you whenever they share your file, and it lays out these core protections in plain language.¹ Here is what each right actually means and how to use it.

The Right to See Your File and Get Free Reports

You can ask any consumer reporting agency for everything it has on file about you: credit accounts, payment history, inquiries, and the same data lenders and insurers use to evaluate you.¹ You can also request your credit score, though the bureau may charge a reasonable fee for it.²

Federal law guarantees at least one free report every 12 months from each of the three nationwide bureaus (Equifax, Experian, and TransUnion) and from nationwide specialty consumer reporting agencies. The three major bureaus have permanently extended a program that lets you pull each of your reports once a week at no cost through AnnualCreditReport.com. Equifax is separately offering six free reports per year through 2026.³

You also qualify for extra free reports in specific situations:

Within 60 days of a company denying you credit, insurance, or employment based on your report.
If you’re unemployed and plan to look for work within 60 days.
If you currently receive public welfare benefits.
If you believe your file is inaccurate because of fraud and you place a fraud alert.

Each trigger is written into the statute itself.⁴

The same rights apply to specialty agencies that track things like rental history, checking account behavior, insurance claims, and employment records. The CFPB keeps a searchable list of these companies, which is worth checking if you’ve been turned down for something and your regular credit report looks fine.⁵

The Right to Dispute Inaccurate Information

If something in your file is wrong or incomplete, you can dispute it directly with the bureau. Once the bureau receives your dispute, it must conduct a free investigation and resolve the matter within 30 days.⁶ During that period, the bureau forwards your evidence to the company that originally reported the information, and that company must review everything and report back. If the disputed item turns out to be inaccurate or cannot be verified, the bureau must correct or delete it.

The 30-day deadline can be extended by 15 days if you submit additional information mid-investigation. That extension disappears if the bureau already determined the data was inaccurate or unverifiable during the original window.⁶

After the investigation wraps, the bureau must send you written results within five business days. Those results include an updated copy of your report if anything changed, instructions for requesting a description of how the investigation was conducted, and notice that you can add a personal statement to your file if you still disagree with the outcome.⁶

One thing worth knowing: a bureau or data furnisher can reject your dispute as frivolous if you don’t provide enough information to investigate, or if you resubmit essentially the same dispute that’s already been resolved without new supporting evidence. If a company takes this route, it must notify you within five business days and explain what additional information it needs.⁷

How Long Negative Information Can Stay on Your Report

Consumer reporting agencies cannot report outdated negative information. The statute sets maximum reporting windows:

Bankruptcies: 10 years from the date of the court order.
Paid tax liens: 7 years from the date of payment.
Collection accounts and charge-offs: 7 years.
Civil suits and judgments: 7 years or until the governing statute of limitations expires, whichever is longer.
All other negative items (except criminal convictions): 7 years.

Criminal convictions have no expiration and can be reported indefinitely.⁸ These are ceilings, not floors. Some items fall off earlier if the original creditor reports a shorter timeline, but a bureau can never keep negative data longer than the statute allows.

The Right to Control Who Sees Your File

Access to your file is limited to those with a legally recognized reason, called a “permissible purpose.” The main categories are:

Lenders evaluating a loan or credit card application, or reviewing an existing account.
Insurers determining eligibility or rates.
Employers screening applicants or evaluating current employees, but only with your written consent.
Government agencies required by law to consider your financial status when granting a license or benefit.
Court orders and subpoenas.
Anyone you have authorized in writing.

Anyone who pulls your report without a permissible purpose violates federal law.⁹ A person who knowingly obtains your report under false pretenses faces damages of at least $1,000 or your actual losses, whichever is greater.¹⁰ The inquiry history in your file shows you who has accessed your data, with employment-related inquiries going back a full two years.¹¹

The Right to Opt Out of Prescreened Offers

Those unsolicited credit card and insurance offers you get in the mail happen because lenders ask bureaus to identify consumers who meet certain criteria, and your file gets flagged. Every prescreened offer must include a toll-free number for stopping them.²

To opt out, call 1-888-5-OPT-OUT (1-888-567-8688) or visit optoutprescreen.com. A phone or online request removes you for five years. For a permanent opt-out, you start the request online or by phone and then sign and return a written form. You’ll need to provide your name, address, Social Security number, and date of birth. Requests are processed within five days, though offers already in the pipeline can take several weeks to stop arriving.¹²

The Right to Freeze Your Credit

You can place a security freeze on your credit report, which prevents the bureau from releasing your information to new creditors without your explicit permission.¹ Since September 2018, placing, lifting, and removing a freeze is free by federal law.¹³

When you request a freeze online or by phone, the bureau must place it within one business day. Lifting a freeze through the same channels must happen within one hour. Mail requests get a three-business-day window.¹³ A freeze doesn’t affect your credit score or prevent existing creditors from reviewing your account. It just blocks new applications until you lift it. For people who aren’t actively shopping for credit, a freeze is the strongest tool against unauthorized accounts being opened in your name.

Rights If You’ve Been an Identity Theft Victim

If you suspect you’ve been targeted, you can place an initial fraud alert on your file that lasts one year. The alert requires potential creditors to take reasonable steps to verify your identity before opening new credit.¹⁴ You only need to contact one of the three major bureaus; it must refer the alert to the other two. Placing a fraud alert also entitles you to a free copy of your report from each bureau.

Victims who have filed an identity theft report can request an extended fraud alert lasting seven years.¹⁴ Beyond fraud alerts, identity theft victims can demand that businesses provide copies of application records and transaction documents tied to fraudulent accounts opened in their name. Businesses must turn over these records within 30 days of receiving a proper request.¹¹ Those records are often critical for building a case and clearing your name with creditors.

Service members deployed away from home can place a separate active duty alert on their credit file. It lasts at least 12 months and requires creditors to verify the service member’s identity before approving new credit. A personal representative can place or remove the alert on a service member’s behalf during deployment.¹⁴

The Right to Sue and Recover Damages

You can sue companies that violate the FCRA. The damages available depend on whether the violation was intentional or careless. For willful violations, you can recover statutory damages between $100 and $1,000 per violation, even without proving a specific financial loss. On top of that, a court can award punitive damages and require the violator to cover your attorney fees and court costs.¹⁰

Negligent violations carry a lower bar. You can only recover your actual damages (the real financial harm you can prove), plus attorney fees and costs if you win.¹⁵ The distinction matters in practice. A bureau that carelessly fails to fix a proven error might owe you whatever financial damage resulted. A bureau that deliberately ignores your disputes faces the statutory minimum plus potential punitive damages, which is where most significant FCRA verdicts come from.

How to File a Complaint

If a bureau or data furnisher ignores your dispute or violates your rights, the fastest route is filing a complaint through the CFPB’s online portal at consumerfinance.gov/complaint. The CFPB forwards your complaint directly to the company, which generally responds within 15 days. More complex cases can take up to 60 days. You’ll receive email updates throughout the process, and the complaint becomes part of a public database (with your personal information removed) that regulators use to track industry problems.¹⁶ Filing a complaint doesn’t replace your right to sue, but it creates a paper trail and sometimes resolves the issue without litigation. The FTC also retains enforcement authority over the FCRA.¹⁷

State Law Can Give You More

The federal rules described above are a floor, not a ceiling. Some states impose stricter limits on how long negative information can be reported or provide broader grounds for free credit reports. To find out what extra protections apply where you live, contact your state attorney general’s office or a local consumer protection agency.¹

1
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
2
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
3
Federal Trade Commission. Free Credit Reports
4
Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures
5
Consumer Financial Protection Bureau. List of Consumer Reporting Companies
6
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
7
eCFR. 12 CFR 1022.43 – Direct Disputes
8
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
9
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
10
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
11
Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
12
Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance
13
Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
14
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention, Fraud Alerts, and Active Duty Alerts
15
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
16
Consumer Financial Protection Bureau. Submit a Complaint
17
Federal Trade Commission. Fair Credit Reporting Act