Fair Credit Reporting Act: Understand Your Rights
The Fair Credit Reporting Act (FCRA) is a federal law put into place in 1970 and amended extensively in 1996, 2003 and 2018. It outlines the rights consumers have regarding the information in their credit files, including who can access it and how they can use it. FCRA aims to protect consumers from the potential negative financial impact that can stem from the mishandling of their credit information.
Christopher Peterson, director of financial services at Consumer Federation of America (CFA), a research, advocacy, education and service organization, said the FCRA provides necessary protections for the average consumer — especially in regards to preventing and reporting identity theft.
“The FCRA provides the framework of the tools that consumers should use to try to start monitoring and seeing whether or not their identity has been stolen and to try to clean up their credit report information if they are a victim of identity theft,” Peterson said.
The FCRA provides specific guidelines for the following groups:
Consumer-reporting agencies (or credit-reporting agencies). Any company that collects and stores credit information is in this group. This includes nationwide credit bureaus as well as specialty consumer-reporting agencies that compile information related to specific industries and purposes, such as insurance underwriting, employee screening, tenant screening, etc.
Information furnishers. This includes any entity that supplies data to consumer-reporting agencies, such as a credit card company or mortgage lender with whom you hold an account.
Information users. This group includes any businesses — or other parties — that access your credit file, such as a prospective employer or a credit card company looking to extend you an offer.
What are your rights under the Fair Credit Reporting Act?
Most consumers are unaware of the rights afforded them under the FCRA. “There are some meaningful rights people don’t realize they have,” Peterson said.
Those rights, as outlined by the Consumer Financial Protection Bureau (CFPB), include the following:
You must be told if the information in your file has been used against you. If a lender denies your application for credit, insurance or employment or takes adverse action against you due to information in your credit report or another type of consumer report, they must inform you of the name, address and phone number of the agency that provided the information.
You have the right to know what is in your credit file. You can request and receive the information in your credit reports or other consumer records — called a file disclosure. All consumers are entitled to one free file disclosure every 12 months upon request from the three large credit bureaus — Equifax, Experian and TransUnion — via AnnualCreditReport.com (note, due to the COVID-19 pandemic, you can now access your online credit reports for free on a weekly basis through April 2022).
You can also request your free credit report from other nationwide credit bureaus and specialty consumer-reporting agencies by contacting them directly and following their procedures.
Additionally, you are entitled to a free copy of your credit report if any of the following circumstances apply:
- Someone took adverse action against you because of information in your credit report.
- You are the victim of identity theft and place a fraud alert in your file.
- Your file contains inaccurate information as a result of fraud.
- You are on public welfare assistance.
- You are unemployed but seeking employment.
- Your state law allows more frequent access of your credit reports.
Consumers can request their reports outside of these circumstances and in addition to the free annual report(s) at their expense, but know that it is a law that you cannot be charged more than $12.50 for a credit report if you need to access it beyond what’s allowed for free.
You have the right to ask for a credit score. You can request your credit score from consumer-reporting agencies that create or distribute scores. While there is sometimes a cost associated with obtaining your credit score, you may be able to access your score for free when you sign up for an account with the credit-reporting agency. For example, TransUnion charges $9.95 to view your VantageScore. However, Equifax offers free monthly access to your VantageScore when you sign up for Equifax Core Credit™. Experian also offers free monthly access to your FICO Score when you create an account.
Your bank, credit union or credit card issuer may also offer a free credit score tool, or you can view your free credit score at LendingTree.
You have the right to dispute incomplete or inaccurate information. If there is incorrect or incomplete information in your file, you can dispute it by following specific procedures. The consumer-reporting agency must investigate your dispute — unless it is frivolous. Know that you won’t be successful in disputing accurate negative information on your credit reports, such as late payments, defaults or bankruptcy. However, most negative information will eventually fall off your credit reports after seven years.
Consumer-reporting agencies must correct or delete inaccurate, incomplete or unverifiable information. When you dispute something in your file, the consumer-reporting agency typically has 30 days to remove or correct the information. If the agency is able to verify it as accurate, the information will remain in your file.
Consumer-reporting agencies cannot report outdated negative information. Reporting agencies can report negative information for only seven years in most cases, or 10 years for a Chapter 7 bankruptcy.
Access to your file is limited. A consumer-reporting agency can provide the information in your file only to someone with a valid need — typically to consider an application with a creditor, insurer, employer, landlord or other business.
You must give your consent for reports to be provided to employers. A current or prospective employer can access information about you only with your written permission. One exception to this rule is if you work in the trucking industry.
You can limit prescreened credit and insurance offers you get based on information in your credit report. Creditors and insurance companies must provide a toll-free number when extending unsolicited credit and insurance offers in case you want to opt out of future offers. Additionally, you can opt out with the nationwide credit bureaus by calling 888-5-OPTOUT (888-567-8688).
You have the right to place a freeze on your credit for free. This will prohibit a consumer-reporting agency from releasing information in your credit report without your explicit authorization. Just know, a security freeze may delay, interfere with or prohibit the timely approval of a future request of application for a new loan, credit, mortgage or any other account involving the extension of credit unless you unfreeze your credit first.
You can seek damages from violators. If a consumer-reporting agency or another company — or someone who furnishes your information to the reporting agencies — violates the FCRA, you may be able to sue them in state or federal court.
The FCRA and related laws
The FCRA is an extensive law that encompasses and overlaps several other federal laws that promote fair practices regarding consumers and their finances. Take a look at some of them and how they relate to the FCRA.
The Credit Card Accountability Responsibility and Disclosure Act
The Credit Card Accountability Responsibility and Disclosure (CARD) Act of 2009 is a federal law that provides consumers with protections specifically related to credit cards. Separate from the FCRA, the CARD Act passed in 2009 after the financial crisis, putting an end to some of the bad practices that were prevalent in the credit card industry at the time.
Ed Mierzwinski, a senior director at U.S. Public Interest Research Group (PIRG), a consumer advocacy group, upholds its importance to consumers. “The CARD Act banned some of the most unfair, outrageous credit card company practices,” he said. “[For example,] making your credit card bill due on a Sunday and then charging you a fee if they received payment on a Monday, or saying that they could raise your rate for any reason including no reason.”
Among other changes, the law placed limits on the interest rates and fees credit card companies could charge and forced them to be more transparent about communicating those rates and fees to consumers.
The Dodd-Frank Wall Street Reform and Consumer Protection Act
In 2010, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act. Established in direct response to the financial crisis of 2008, the Dodd-Frank Act is named after its sponsors, U.S. Senator Christopher J. Dodd and U.S. Representative Barney Frank, and is intended to help improve accountability and transparency in the financial system, end “too big to fail” and protect the American taxpayer by ending bailouts and protect consumers from abusive financial services and practices.
While the Dodd-Frank Act is extremely comprehensive and complex, simply put, it places limitations on banks, mortgage lenders and credit-rating agencies to prevent a repeat of some of the market conditions that led to the crisis.
The Dodd-Frank Act is responsible for establishing the following federal agencies and reforms:
Financial Stability Oversight Council
The Financial Stability Oversight Council (FSOC) identifies risks that affect the U.S. financial industry and coordinates regulatory actions to address them. For example, if a bank becomes too big, the FSOC can turn it over to the Federal Reserve for closer supervision. As a result, the Federal Reserve may require the bank to increase its reserve requirement, which would help ensure the bank has enough cash on hand to prevent bankruptcy. The Council also plays a significant role in determining whether action should be taken to break up firms that pose a “grave threat” to the financial stability of the U.S.
Consumer Financial Protection Bureau
The Consumer Financial Protection Bureau (CFPB) enforces the FCRA and the CARD Act. Prior to the Dodd-Frank Act, multiple agencies were tasked with enforcing different parts of the FCRA. Now, that responsibility lies solely with the CFPB, an organization that provides education and resources to consumers and serves as a direct point of contact for those experiencing unfair practices and takes action against companies that violate the FCRA.
“The Dodd-Frank Act created the CFPB with only one job: protecting consumers. The agency has the authority to investigate and penalize credit bureaus with much more authority than the FTC ever had,” Mierzwinski said.
In 2018, a bill was passed that “rolls back” some parts of the Dodd-Frank Act, although much of it — including the CFPB’s role — remains unchanged.
The Volcker Rule
Within the Dodd-Frank Act, the Volcker Rule, established in 2013, prevents “big banks” from engaging in certain investing and trading activity — for their own benefit. Although this regulation isn’t directly related to consumers, it does provide protection in the sense that banks are prohibited from making the same types of investments that contributed to the financial crisis of 2008.
SEC Office of Credit Ratings
The Dodd-Frank Act is also responsible for establishing the Office of Credit Ratings, a function of the U.S. Securities and Exchange Commission (SEC). The primary role of the office is to monitor and hold accountable agencies that assess and establish credit ratings to businesses and other entities and to ensure those ratings are unbiased and in the public’s best interest.
What is the Fair and Accurate Credit Transactions Act?
In 2003, the FCRA was amended extensively to address the issue of identity theft. That amendment, called the Fair and Accurate Credit Transactions Act (FACTA), put measures in place to protect consumers from the threat of identity theft and established consumer rights and procedures for credit-reporting agencies to follow in the event identity theft does occur.
Linda Sherry, director of National Priorities at Consumer Action, a nonprofit, consumer education and advocacy organization, said FACTA brought consumers necessary protection. “Identity theft had become such an issue,” she said. “If [someone] had [a consumer’s] Social Security number or their address or some bits of personal information about them, [they] could open instant credit in their name,” Sherry said
FACTA allows consumers to do the following:
Place fraud alerts on credit reports.
If you are or think you may be a victim of identity theft, you can ask any one of the three major nationwide credit bureaus — Equifax, Experian and TransUnion — to place a fraud alert in your file.
Having an alert in your file will make it more difficult for anyone to obtain new credit in your name. A fraud alert remains in your file for at least 90 days. You can place an extended fraud alert that can last up to seven years, but to do that you’ll need to provide an identity theft report that includes a police report and any additional information the credit bureau requests. Once you place a fraud alert with one credit bureau, it must notify the other two.
Receive free copies of credit reports.
If a fraud alert is placed in your file, you are entitled to a free credit report with each of the three nationwide credit bureaus. This is in addition to the free annual credit report you are entitled to under the FCRA. If you have an extended fraud alert on your file, you can request two additional free copies of your file within a 12-month period following placing the alert.
You can also request and receive access to your file with any consumer-reporting agency once in a 12-month period if you believe its reporting incorrect information as a result of identity theft or another kind of fraud.
Request and obtain copies of documents related to fraudulent transactions or accounts.
Upon your written request, businesses must provide you with copies of any records related to transactions or accounts someone opened in your name as a result of identity theft, provided you meet any other criteria specified by the creditor or company.
Request and obtain information from a debt collector.
Debt collectors must provide, upon your request, information about a debt you believe you incurred as a result of identity theft.
Request a block on information related to identity theft.
If the information in your file stems from identity theft, you can place a block on the data. Businesses with notice of the block cannot sell, transfer or put the debt into a collection.
Request consumer-reporting agencies do not report identity theft-related info.
You can stop consumer-reporting agencies from reporting any information in your file that resulted from identity theft.
Understanding FCRA rules for consumer-reporting agencies
The FCRA establishes specific guidelines for consumer-reporting agencies. Again, a consumer-reporting agency or credit-reporting agency (CRA) is any company that maintains a file on you and provides that information to businesses or other parties. Most consumers are unaware of the various companies that have files on them, according to Peterson.
“People have this sort of impression that there is [only one] credit report — that it’s one thing. But it’s much more complicated than that,” Peterson said. “There are lots of companies that are building databases that have associations between different bits of information and personal identifiers. And what’s on any given credit report depends on what tools are used to acquire that database at any given point in time.”
With so many companies reporting your data, holding those companies to uniformed guidelines is crucial. “The FCRA imposes a number of obligations on CRAs,” said Juliana Gruenwald, senior public affairs specialist at the U.S. Federal Trade Commission (FTC).
Regardless of size or specialty, all CRAs must abide by the following requirements:
Provide a copy of your credit file at your request. All consumer-reporting agencies are required to give you a copy of your file upon request. This includes the free annual credit report and the specific circumstances outlined earlier. In addition to those circumstances, credit-reporting agencies must provide you your report anytime you ask. Sometimes it will be at your expense.
Investigate disputed information. Consumer-reporting agencies are required to investigate your dispute if you’ve followed accurate disputing procedures.
Correct or delete inaccurate information. Consumer-reporting agencies must remove, correct or verify info, usually within 30 days of your dispute.
Delete outdated, negative information. Agencies cannot report negative information past seven years — or 10 years if related to Chapter 7 bankruptcy.
Limit access to your file. Agencies can provide your file only to those with a “permissible need;” this would include businesses to which you applied for credit, insurance, employment or housing.
Provide your credit report to employers. Consumer-reporting agencies must provide your file to current or prospective employers if you gave permission.
Provide you a copy of your credit score. Consumer-reporting agencies that create and issue credit scores are required to provide your score upon your request. Usually, this is at your expense.
Understanding FCRA rules for information furnishers
To ensure the privacy and accuracy of consumer file information, the FCRA has guidelines for all groups that will come in contact with your information.
“The FCRA imposes obligations on those who furnish information about consumers to CRAs, such as entities extending credit,” Gruenwald said.
Under the FCRA, information furnishers have the following legal obligations:
Furnish information that is accurate and complete. Information furnishers cannot report data that they know to be incorrect or incomplete.
Investigate consumer disputes. Information furnishers must conduct a reasonable investigation, review all relevant information provided by the consumer and report the results to the consumers (usually within 30 days).
Identify disputed information. Data furnishers must let credit-reporting agencies know if the information they provide them is in dispute.
Notify credit bureaus if an account had been voluntarily closed. Doing this makes it clear that the consumer chose to close the account, not the creditor.
Correct and update information. Information furnishers must notify credit-reporting agencies of any corrections and additions to information they previously supplied.
Update and correct negative information within 30 days. If you dispute an item in your credit report, the company supplying that data must investigate it and correct or remove it within 30 days.
Establish procedures for identity theft notices by credit bureaus. Information furnishers must have procedures in place to prevent the re-reporting of information that is blocked because of identity theft.
Cannot report accounts that resulted from identity theft. If you notify a data furnisher that an account resulted from identity theft, it cannot continue to supply information on that account.
FCRA and businesses that use credit information
The FCRA also places limitations on who can access your credit file and how they can use that information. Some guidelines the FCRA established for information users include:
Users must have what is called a “permissible purpose.” This means you submitted an application with a creditor, insurer, employer, landlord or other business. An exception would be if a court order were issued.
Users must tell you if your file has been used against you. If a company or business denies you credit, employment or insurance — or takes another adverse action against you — as a result of what is in your credit report, it must provide the name and contact information of the credit bureau or agency that provided the information.
FCRA violations and remedies
Although the FCRA was established to protect consumers from the misuse and abuse of their credit information, you still might have your data mishandled — either willfully or out of negligence. Here are some common FCRA violations — and information about what to do if your rights are infringed upon.
Reporting and supplying old information. Under the FCRA, credit-reporting agencies and information furnishers can report and provide only information that is current. If your information regarding an account has changed and an information furnisher provides old information, it might be in violation of the FCRA.
Reporting and supplying inaccurate information. Credit-reporting agencies and data furnishers cannot report or provide information they know to be incorrect.
Mixing files. If credit-reporting agencies mix up one person’s file with another person’s because of similar information, such as nearly identical last names or Social Security numbers, they will be in violation of the FCRA if the issue isn’t fixed when identified and reported.
Not following debt dispute procedures. Credit-reporting agencies and information furnishers have specific roles to play in the event of a debt dispute — they are in violation if they don’t follow through.
Violating consumer privacy. Credit-reporting agencies cannot give your credit report to parties without a valid need.
Requesting a credit report for an impermissible purpose. Any information user requesting your report for a reason outside of what is permissible is in violation. For example, someone viewing your credit report to determine if you have assets prior to filing certain types of lawsuits is a violation.
Withholding notices. Consumer-reporting agencies and users are required to provide notices to consumers in specific instances — for instance, if you are turned down for a loan. Failing to do so is a violation.
Damages for violations
If your rights have been violated, you can pursue legal action. Violations fall in one of two categories: willful or negligent.
A willful violation means the business knew it was operating outside of the FCRA rules. Or it means that it should have known it was in violation.
If you can provide proof that the company or individual violated the FCRA willfully, you can sue for the following damages:
- Basic damages
If the violator was a business you choose between:
- Actual (provable) damages (no limit) or
- Statutory damages between $100 and $1,000 (to get these you don’t have to prove that the violation harmed you).
If the violator was an individual you choose the greater of:
- Your actual, provable damages (no limit) or
- $1,000 flat (no minimum)
- Punitive damages, decided by the court
- Attorney fees and costs
If you can prove the other party acted negligently and failed to comply with its obligations under the FCRA, you can pursue the following damages:
- Actual damages (no set limit or minimum)
- Attorney fees and costs
Penalties for frivolous FCRA lawsuits
Before you take legal action, make sure you have a valid complaint. The FCRA imposes a penalty on anyone who attempts to sue an individual or company if it determines it’s a frivolous lawsuit. And if it does, you might be responsible for the other side’s lawyer fees.
When and where to file a lawsuit for FCRA violations
To file a lawsuit for an FCRA violation, you can file a complaint in either federal court or your state’s court. The statute of limitations states you must file your complaint no later than:
- Two years after the date you discovered the violation or
- Five years after the date of the violation
How to leverage your FCRA rights
The FCRA is in place to protect you, but you have to be proactive and use the rights the act provides you. Familiarize yourself with the rights outlined in this guide — and be willing to exercise them.
Keep the following tips in mind to leverage these rights to your benefit:
Regularly review your credit reports. Take advantage of the free annual credit reports you’re entitled to every year. Peterson said that is one of the best ways to remain vigilant about the information in your credit report.
“Spend a little bit of time each year as you’re working on your finances auditing your credit reports — at least for the big three credit-reporting agencies,” he said.
Sherry agrees. And she reminds consumers what to look for in getting a copy of their credit reports. “What you’re really looking for is information that isn’t about you, because there are lots of mistakes on [credit reports], she said. “People with similar names get mixed up; accounts are put on there that may be too old … that kind of thing.”
Dispute incorrect information. Use established channels to dispute inaccurate information on your report. Having mistakes on your report can cost you. “About 5% of Americans have a pretty bad mistake on their credit reports that will cause them to be denied or pay more for credit,” Mierzwinski said. “People should understand that mistakes on credit reports deny or cause problems in your employment or your financial opportunities. You need to be constantly vigilant; look at your credit reports and fix mistakes.”
Pursue legal action if necessary. If you have a legitimate reason to pursue legal action against an entity or individual that has violated your rights under the FCRA, pursue it. Sherry wants consumers to remember that they have the right to seek paid damages. “There is an active legal community that helps consumers get things off their credit reports if they won’t come off through the usual means,” she said.
In some cases, you might not need to pay for a lawyer upfront. “Many lawyers will accept cases on a contingency clause because they are likely to recoup payment after the judgment,” Sherry said.
As a consumer, the main thing to keep in mind is that these rights have been established to protect you, and enforcing your rights is the best way to leverage that protection and prevent any issues down the road.