Fair Credit Reporting Act: Understand Your Rights
In 2017 alone, 2.7 million consumers filed reports of fraud, identity theft and other consumer concerns — resulting in a total of $905 million in losses — with the Federal Trade Commission. Many of the complaints consumers registered — such as credit card, loan and other types of fraud — were directly related to a company abusing and misusing their personal and credit information.
Although the number of reports the Federal Trade Commission received last year was staggering, there are laws in place related to information in consumers’ credit history and how companies can use that information. As a consumer, it is crucial you’re aware of those laws and the rights they afford you. Otherwise, you might become a victim of fraud or identity theft.
One significant piece of legislation in place related to the use of your credit information is the Fair Credit Reporting Act. Review the key parts that affect you as a consumer, how to leverage the rights it provides and what to do in the event your rights are violated.
What is the Fair Credit Reporting Act?
The Fair Credit Reporting Act is a federal law put into place in 1970 and amended extensively in 1996 and 2003. It outlines the rights consumers have regarding the information in their credit files, including who can access it and how they can use it. FCRA aims to protect consumers from the potential negative financial impact that can stem from the mishandling of their credit information.
Christopher Peterson, director of financial services at Consumer Federation of America, a research, advocacy, education, and service organization, said the FCRA provides necessary protection for the average consumer — especially to prevent and remedy identity theft.
“The FCRA provides the framework of the tools that consumers should use to try to start monitoring and seeing whether or not their identity has been stolen and to try to clean up their credit report information…if they are a victim of identity theft,” Peterson said.
The FCRA provides specific guidelines for the following groups:
Consumer reporting agencies (or credit reporting agencies). Any company that collects and stores credit information is in this group. This includes nationwide credit bureaus as well as specialty consumer reporting agencies that compile information related to specific industries and purposes, such as insurance underwriting, employee screening, tenant screening, etc.
Information furnishers. This group includes any entity that supplies data to consumer reporting agencies, such as a credit card company or mortgage lender with whom you hold an account.
Information users. This group includes any businesses — or other parties — that access your credit file, such as a prospective employer or a credit card company looking to extend you an offer.
Your rights under the FCRA
Most consumers are unaware of the rights afforded them under the FCRA. “There are some meaningful rights people don’t realize they have,” Peterson said.
Those rights, as outlined by the Consumer Financial Protection Bureau, include the following:
You must be told if the information in your file has been used against you.
If a company denies you credit, insurance, or employment — or someone takes another adverse action against you, such as giving you a lower interest rate than what you applied for — based on what’s in your credit report or another type of consumer report, the company or person must tell you which credit bureau or agency provided the information.
You have the right to know what is in your file.
You can request and receive the information in your credit report or other consumer records — this is called a file disclosure.
All consumers are entitled to one free file disclosure every 12 months upon request from the three large credit bureaus — Equifax, Experian and TransUnion — you can access yours at AnnualCreditReport.com and other nationwide credit bureaus and specialty consumer reporting agencies by contacting them directly and following their procedures.
Note: Residents of Colorado, Maine, Maryland, Massachusetts, New Jersey, and Vermont are entitled to two free, annual reports from each nationwide consumer reporting agency and Georgia residents are entitled to three free reports under state law.)
You are also entitled to a copy of your file for free if any of the following circumstances apply:
- Someone took adverse action against you because of information in your credit report.
- You are the victim of identity theft and place a fraud alert in your file.
- Your file contains inaccurate information as a result of fraud.
- You are on public assistance.
- You are unemployed but expect to apply for employment within 60 days.
Consumers can request their reports outside of these circumstances and in addition to the free annual report(s) at their expense.
You have the right to ask for a credit score.
You can request your credit score from consumer reporting agencies that create or distribute scores. There is typically a cost associated with obtaining your credit score, although in some mortgage transactions, the mortgage lender might disclose your score for free. In addition, your credit card company might offer you a free look at your FICO score, so check to see if it does.
You have the right to dispute incomplete or inaccurate information.
If there is incorrect or incomplete information in your file, you can dispute it by following specific procedures. The consumer reporting agency must investigate your dispute — unless it is frivolous.
Consumer reporting agencies must correct or delete inaccurate, incomplete or unverifiable information.
When you dispute something in your file, the consumer reporting agency typically has 30 days to remove or correct the information. If the agency is able to verify it as accurate, the information will remain in your file.
Consumer reporting agencies cannot report outdated negative information.
Reporting agencies can report negative information for only seven years in most cases, or 10 years if you’ve had a bankruptcy.
Access to your file is limited.
A consumer reporting agency can provide the information in your file to only someone with a valid need. The FCRA spells out what constitutes as a need for access.
You must give your consent for reports to be provided to employers.
A current or prospective employer can access information about you only with your written permission. One exception to this rule is if you work in the trucking industry.
You can limit prescreened credit and insurance offers you get based on information in your credit report.
Creditors and insurance companies must provide a toll-free number when extending unsolicited offers of credit and insurance so you can opt out of future offers. Additionally, you can opt-out with the nationwide credit bureaus at 888-5-OPTOUT (888-567-8688).
You can seek damages from violators.
If a consumer reporting agency or another company — or someone who furnishes your information to the reporting agencies — violates the FCRA, you might be able to sue them in state or federal court.
You have the right to place a freeze on your credit for free.
Beginning in September 2018, you will be able to put a freeze on the information in your credit file. Most states currently provide this protection — usually at your expense — but this change entitles you to a free freeze under the FCRA.
There are some limitations, according to Peterson. “It doesn’t freeze reports for the purpose of monitoring existing accounts, insurance companies [or] employers,” he said.
A freeze itself does not guarantee that someone won’t open fraudulent accounts in your name, but it does prevent credit reporting agencies from supplying your information to companies that request it, a move that should raise a red flag if an identity thief is attempting to open credit in your name.
The FCRA also provides additional rights for identity theft victims and active duty military personnel. Although the FCRA is a federal law, some states might enforce their own consumer reporting laws. For information on your state’s laws, contact your state or local consumer protection agency or your state attorney general.
The FCRA and related laws
The FCRA is an extensive law that encompasses and overlaps several other federal laws that promote fair practices regarding consumers and their finances. Take a look at some of them and how they relate to the FCRA.
The Credit Card Accountability Responsibility and Disclosure Act
The Credit Card Accountability Responsibility and Disclosure Act of 2009 is a federal law that provides consumers with protections specifically related to credit cards. Separate from the FCRA, the CARD Act passed in 2009 after the financial crisis, putting an end to some of the negative practices that were prevalent in the credit card industry at the time.
Ed Mierzwinski, a senior director at U.S. Public Interest Research Group, a consumer advocacy group, said it’s a very important law.
“The CARD Act banned some of the most unfair, outrageous credit card company practices,” he said. “[For example,] making your credit card bill due on a Sunday and then charging you a fee if they received it on a Monday, or saying that they could raise your rate for any reason including no reason.”
Among other changes, the law placed limits on the interest rates and fees credit card companies could charge and force them to be more transparent about communicating those rates and fees to consumers.
The Dodd-Frank Wall Street Reform and Consumer Protection Act
In 2010, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act. Established in direct response to the financial crisis of 2008, the Dodd-Frank Act is named after its sponsors, U.S. Senator Christopher J. Dodd and U.S. Representative Barney Frank. Simply put, it places limitations on banks to prevent a repeat of some of the market conditions that led to the crisis.
Consumer Financial Protection Bureau
The Dodd-Frank Act is responsible for establishing the Consumer Financial Protection Bureau, which enforces the FCRA and the CARD Act. Prior to the Dodd-Frank Act, multiple agencies were tasked with enforcing different parts of the FCRA. Now that responsibility lies solely with the CFPB, an organization that provides education and resources to consumers and serves as a direct point of contact for those experiencing unfair practices and takes action against companies that violate the FCRA.
“The Dodd-Frank Act created the CFPB with only one job: protecting consumers. The agency has the authority to investigate and fine credit bureaus with much more authority than the FTC ever had,” Mierzwinski said.
In 2018, a bill was passed that “rolls back” some parts of the Dodd-Frank Act, although much of it — including the CFPB’s role — remains unchanged.
The Volcker Rule
Within the Dodd-Frank Act, the Volcker Rule, established in 2013, prevents “big banks” from engaging in certain investing and trading activity — for their own benefit. Although this regulation isn’t directly related to consumers, it does provide protection in the sense that banks are prohibited from making the same types of investments that contributed to the financial crisis of 2008.
SEC Office of Credit Ratings
The Dodd-Frank Act is also responsible for establishing the Office of Credit Ratings, a function of the U.S. Securities and Exchange Commission. The primary role of the office is to monitor and hold accountable agencies that assess and establish credit ratings to businesses and other entities and to ensure those ratings are unbiased and in the public’s best interest.
The Fair and Accurate Credit Transactions Act
In 2003, the FCRA was amended extensively to address the issue of identity theft. That amendment, called the Fair and Accurate Credit Transactions Act, put measures in place to protect consumers from the threat of identity theft and established consumer rights and procedures for credit reporting agencies to follow in the event identity theft does occur.
Linda Sherry, director of National Priorities at Consumer Action, a nonprofit, consumer education and advocacy organization, said FACTA brought consumers necessary protection. “Identity theft had become such an issue,” she said. “If [someone] had [a consumer’s] social security number or their address or some bits of personal information about them, [they] could open instant credit in their name,” Sherry said
FACTA allows consumers to do the following:
Place fraud alerts on credit reports.
If you are or think you might be a victim of identity theft, you can ask any one of the three major nationwide credit bureaus — Equifax, Experian, and TransUnion — to place a fraud alert in your file.
Having an alert in your file will make it difficult for anyone to obtain new credit. A fraud alert remains in your file for at least 90 days. You can place an extended fraud alert that can last up to seven years but to do that, you’ll need to provide an identity theft report that includes a police report and any additional information the credit bureau requests. Once you place a fraud alert with one credit bureau, it must notify the other two.
Receive free copies of credit reports.
If a fraud alert is placed in your file, you are entitled to a free credit report with each of the three nationwide credit bureaus. This is in addition to the free annual credit report you are entitled to under the FCRA. If you have an extended fraud alert on your file, you can request two additional free copies of your file within a 12-month period following placing the alert.
You can also request and receive access to your file with any consumer reporting agency once in a 12-month period if you believe its reporting incorrect information as a result of identity theft or another kind of fraud.
Request and obtain copies of documents related to fraudulent transactions or accounts.
Upon your written request, businesses must provide you with copies of any records related to transactions or accounts someone opened in your name as a result of identity theft, provided you meet any other criteria specified by the creditor or company.
Request and obtain information from a debt collector.
Debt collectors must provide, upon your request, information about a debt you believe you incurred as a result of identity theft.
Request a block on information related to identity theft.
If the information in your file stems from identity theft, you can place a block on the data. Businesses with notice of the block cannot sell, transfer or put the debt into a collection.
Request consumer reporting agencies do not report identity theft-related info.
You can stop consumer reporting agencies from reporting any information in your file that resulted from identity theft.
Understanding FCRA rules for consumer reporting agencies
The FCRA establishes specific guidelines for consumer reporting agencies. Again, a consumer reporting agency or credit reporting agency is any company that maintains a file on you and provides that information to businesses or other parties. Most consumers are unaware of the various companies that have files on them, according to Peterson.
“People have this sort of impression that there is [only one] credit report — that it’s one thing. But it’s much more complicated than that,” Peterson said. “There are lots of companies that are building databases that have associations between different bits of information and personal identifiers. And what’s on any given credit report depends on what tools are used to acquire that database at any given point in time.”
With so many companies reporting your data, holding those companies to uniformed guidelines is crucial. “The FCRA imposes a number of obligations on CRAs,” Juliana Gruenwald, from the office of public affairs at the U.S. Federal Trade Commission, said.
Regardless of size or specialty, all CRAs must abide by the following requirements:
Provide a copy of your credit file at your request.
All consumer reporting agencies are required to give you a copy of your file upon request. This includes the free annual credit report and the specific circumstances outlined earlier. In addition to those circumstances, credit reporting agencies must provide you your report anytime you ask. Sometimes it will be at your expense.
Investigate disputed information.
Consumer reporting agencies are required to investigate your dispute if you’ve followed accurate disputing procedures.
Correct or delete inaccurate information.
Consumer reporting agencies must remove, correct or verify info, usually within 30 days of your dispute.
Delete outdated, negative information.
Agencies cannot report negative information past seven years — or 10 years if related to bankruptcy.
Limit access to your file.
Agencies can provide your file only to those with a “permissible need;” this would include businesses to which you applied for credit, insurance, employment or housing.
Provide your credit report to employers.
Consumer reporting agencies must provide your file to current or prospective employers if you gave permission.
Provide you a copy of your credit score.
Consumer reporting agencies that create and issue credit scores are required to provide your score upon your request. Usually, this is at your expense.
How the FCRA affects information furnishers
To ensure the privacy and accuracy of consumer file information, the FCRA has guidelines for all groups that will come in contact with your information.
“The FCRA imposes obligations on those who furnish information about consumers to CRAs, such as entities extending credit,” Gruenwald said.
Under the FCRA, information furnishers have the following legal obligations:
Furnish information that is accurate and complete.
Information furnishers cannot report data that they know to be incorrect or incomplete.
Investigate consumer disputes
About the accuracy of the information they provide.
Identify disputed information.
Data furnishers must let credit reporting agencies know if the information they provide them is in dispute.
Must notify credit bureaus if an account had been voluntarily closed.
Doing this makes it clear that the consumer chose to close the account, not the creditor.
Correct and update information.
Information furnishers must notify credit reporting agencies of any corrections and additions to information they previously supplied.
Must update and correct negative information within 30 days.
If you dispute an item in your credit report, the company supplying that data must investigate it and correct or remove it within 30 days.
Establish procedures for identity theft notices by credit bureaus.
Information furnishers must have procedures in place to prevent the re-reporting of information that is blocked because of identity theft.
Must not report accounts that resulted from identity theft.
If you notify a data furnisher that an account resulted from identity theft, it cannot continue to supply information on that account.
FCRA and businesses that use credit information
The FCRA places limitations on who can access your credit file and how they can use that information. Some guidelines the FCRA established for information users include:
Users must have what is called a “permissible purpose.” This means you submitted an application with a creditor, insurer, employer, landlord or other business. An exception would be if a court order were issued.
Users must tell you if your file has been used against you. If a company or business denies you credit, employment or insurance — or takes another adverse action against you — as a result of what is in your credit report, it must provide the name and contact information of the credit bureau or agency that provided the information.
FCRA violations and remedies
Although the FCRA was established to protect consumers from the misuse and abuse of their credit information, you still might have your data mishandled — either willfully or out of negligence. Here are some common FCRA violations — and information about what to do if your rights are infringed upon.
Reporting and supplying old information.
Under the FCRA, credit reporting agencies and information furnishers can report and provide only information that is current. If your information regarding an account has changed and an information furnisher provides old information, it might be in violation of the FCRA.
Reporting and supplying inaccurate information.
Credit reporting agencies and data furnishers cannot report or provide information they know to be incorrect.
Credit reporting agencies often mix up the files of consumers with similar Social Security numbers are similar or when they have names that include suffixes, such as Jr. and Sr.
Not following debt dispute procedures.
Credit reporting agencies and information furnishers have specific roles to play in the event of a debt dispute — they are in violation if they don’t follow through.
Violating consumer privacy.
Credit reporting agencies cannot give your credit report to parties without a valid need.
Requesting a credit report for an impermissible purpose.
Any information user requesting your report for a reason outside of what is permissible is in violation. For example, if an employee requests your credit report without your permission, he or she is in violation.
Consumer reporting agencies and users are required to provide notices to consumers in specific instances — for instance, if you are turned down for a loan. Failing to do so is a violation.
Damages for violations
If your rights have been violated, you can pursue legal action. Violations fall in one of two categories: willful or negligent.
A willful violation means the business knew it was operating outside of the FCRA rules. Or it means that it should have known it was in violation.
If you can provide proof that the company or individual violated the FCRA willfully, you can sue for the following damages:
- Basic damages
If the violator was a business you choose between:
- Actual (provable) damages (no limit) or
- Statutory damages between $100 and $1,000 (to get these you don’t have to prove that the violation harmed you).
If the violator was an individual you choose the greater of:
- Your actual, provable damages (no limit) or
- $1,000 flat (no minimum)
- Punitive damages, decided by the court
- Attorney fees and costs
If you can prove the other party acted negligently and failed to comply with its obligations under the FCRA, you can pursue the following damages,
- Actual damages (no set limit or minimum)
- Attorney fees and costs
Penalties for frivolous FCRA lawsuits
Before you take legal action, make sure you have a valid complaint. The FCRA imposes a penalty on anyone who attempts to sue an individual or company if it determines it’s a frivolous lawsuit. And if it does, you might be responsible for the other side’s lawyer fees.
When and where to file a lawsuit for FCRA violations
To file a lawsuit for an FCRA violation, you can file a complaint in either federal court or your state’s court. The statute of limitations states you must file your complaint no later than:
- Two years after the date you discovered the violation or
- Five years after the date of the violation
How to leverage your FCRA rights
The FCRA is in place to protect you, but you have to be proactive and use the rights the act provides you. Familiarize yourself with the rights outlined in this guide — and be willing to exercise them.
Keep the following tips in mind to leverage these rights to your benefit.
Regularly review your credit reports. Take advantage of the free annual credit reports you’re entitled to every year. Peterson said that is one of the best ways to remain vigilant about the information in your credit report.
“Spend a little bit of time each year as you’re working on your finances auditing your credit reports — at least for the big three credit reporting agencies [Experian, Equifax, and TransUnion],” he said.
Sherry agrees. And she reminds consumers what to look for in getting a copy of their credit reports. “What you’re really looking for is information that isn’t about you, because there are lots of mistakes on [credit reports], she said. “People with similar names get mixed up; accounts are put on there that may be too old … that kind of thing.”
Dispute incorrect information.
Use established channels to dispute inaccurate information on your report. Having mistakes on your report can cost you. “Five percent of Americans have a pretty bad mistake on their credit reports that will cause them to be denied or pay more for credit,” Mierzwinski said. “People should understand that mistakes on credit reports deny or cause problems in your employment or your financial opportunities. You need to be constantly vigilant; look at your credit reports and fix mistakes.”
Pursue legal action if necessary.
If you have a legitimate reason to pursue legal action against an entity or individual that has violated your rights under the FCRA, pursue it. Sherry wants consumers to remember that they have the right to seek paid damages. “There is an active legal community that helps consumers get things off their credit reports if they won’t come off through the usual means,” she said.
In some cases, you might not need to pay for a lawyer upfront. “Many lawyers will accept cases on a contingency clause because they are likely to recoup payment after the judgment,” Sherry said.
As a consumer, the main thing to keep in mind is that these rights have been established to protect you, and enforcing your rights is the best way to leverage that protection and prevent any issues down the road.