Has your credit report been viewed illegally?
Not everyone who can look at your credit report has a right to do so
By Minda Zetlin
Mari Frank couldn't figure out how an
identity thief got her Social Security number and birthdate -- until she noticed
that her credit report had been viewed by a company she never heard of.
"I had to go through my credit
report with a fine-tooth comb," said Frank, a California attorney who has
become an expert on identity theft since her run-in with it in 1996.
"There was an inquiry there from a mortgage company -- I wasn't buying a
house, I hadn't refinanced."
Though most credit report inquiries
are legitimate, there are several scenarios that can easily lead to it being
read by someone who shouldn't. The information contained there can be used
to steal your identity, damage your credit or, at the very least, invade your
A limited number of entities can
legally view your report, under provisions of the Fair Credit Reporting Act. Those
include a company planning to offer you insurance or credit (this includes
landlords and utilities), a company with which you have an existing debt, an
employer or prospective employer, or a court, state or law enforcement agency.
You do have the option to voluntarily give permission to anyone you choose to
see your report and, of course, you can see it yourself. That's it.
But there are a surprising number of
ways your credit report could wind up in the wrong hands.
In Frank's case, it turned out to be
a clerk at a law firm that was representing a mortgage company who misused her
credit report. The firm had legitimate access to the credit reporting system,
but the rogue employee used it to set up credit cards and get loans in Frank's name.
It took 11 months to clear up more than $50,000 in fraudulent debts that were
attributed to her, Frank said.
Illegal viewing of your credit
report should be taken seriously, says Cary Flitter, partner at consumer law
firm Flitter Lorenz in Philadelphia. "When people get your credit report
illegally, it's as if they had broken into your house, jimmied open your desk
and looked through all your manila folders. Here's your mortgage status, here's
a collection letter you received. It's all in one place and organized."
The Federal Trade Commission received more than 279,000
complaints about identity theft in 2011, which topped the complaint list for
the twelfth year running. Some portion of those are the result of credit report
abuse, but the scale of the problem is difficult to determine, an agency
spokesman said. It is rare that a victim can tell -- as Frank did through
painstaking research -- that their
credit report was misused. "People wouldn't know if someone is accessing their credit report who shouldn't access it," said Mitchell Katz, senior public affairs officer at the FTC.
Here are the most common scenarios
in which your credit report might be viewed illegally.
Love gone wrong
If you're in the midst of a divorce or a child custody battle, your ex, his or
her lawyer, or a private investigator working for that lawyer might pull your
credit report to check on your activities and look for accounts or assets you
may be keeping secret. Legally, they have no right to do this unless they've
obtained a court order. If they haven't, "you absolutely have the right to
sue them as this violates the Fair Credit Reporting Act," says personal
finance author David Bakke.
How to tell if your credit report
has been viewed illegally
When reviewing your report, carefully check the inquiry section, which will show who's viewed your report and when. You can pull your credit report for free once a year from each of the big three credit bureaus (Experian, Equifax and TransUnion) at AnnualCreditReport.com.
If you see anything you didn't set in motion (such as a loan or credit card application), make sure to investigate.
The exception is a bank or credit union's pre-screening before sending you a credit card offer, but any such inquiries will be clearly marked as promotional. Those inquiries are called "soft pulls" of your report and do not impact your credit score.
There's another possible scenario
even before lawyers and private investigators get involved: Your spouse or
partner could decide to take a look at your credit report in search of secret
accounts that may indicate infidelity (or at least financial infidelity). If he
or she has access to your Social Security number, bank or credit card account
numbers and is likely to know the answers to your security questions, it may be
easy enough to request a credit report or view one online while pretending to
What to do about it: Strictly
speaking, a spouse or partner who does this has committed identity theft, says
Rod Griffin, director of public education at credit bureau Experian. You'd be
well within your rights to file a police report, he says, but depending on the
situation, you may not want to go that far. "It's a difficult
challenge," he says. "You'll have to have some very difficult
discussions with that person."
A better option might be to freeze your credit report with each of the three bureaus, particularly if you know
that separation or divorce is on the horizon. Freezing your report renders it
inaccessible for most uses, although a company with which you already have debt
will still have access, as will courts and governments and private
investigators -- but only when performing government-sanctioned background
checks. The cost to freeze a report is set by state law and is usually quite
In most cases, you can
"thaw" a report temporarily, for instance, while shopping for a car
loan, and then refreeze it when you're done. Freezing and thawing can be done
online, by password.
In a divorce or child custody
situation, another possible scenario is that your spouse or spouse's attorney
will actually request that you obtain your own credit report and provide it
voluntarily. In this situation, your smartest move may be to comply, assuming
you have nothing to hide. The other side may well be able to get a court order
demanding it anyway, and your refusal will likely arouse suspicion. "If
there's hesitation in providing a credit report, that's smoke," says Lili
A. Vasileff, a certified financial planner who specializes in divorce. "It
means there may be something in there that's unknown to your spouse."
Unauthorized use scenarios, penalties
An entrepreneur -- and a client of Flitter's -- opened a business account at a
local branch of a national bank. A month or two later, while routinely
reviewing his credit report, he was surprised to see an inquiry from that bank.
The bank would have been well within its rights if he'd applied for a loan or a
line of credit, but he'd done neither.
"He inquired and didn't get a
very satisfactory answer," says Flitter, who is representing the
entrepreneur in a lawsuit against the bank. "When he pressed them, they
told him they should have gotten his authorization, but had made an
When people get your credit report illegally, it's as if they had broken into your house, jimmied open your desk and looked through all your manila folders.
Flitter Lorenz law firm
The Fair Credit Reporting Act caps
actual damages at $1,000 if the error was due to an oversight, but consumers
can also sue for punitive damages, attorney's fees and court costs, Flitter
says. In this instance where the bank admitted wrongdoing, he's confident it
will have to pay for its mistake. The question is how much and depends in part
on whether this truly was a one-time oversight as the bank claims, or part of a
pattern of pulling reports illegally.
A more sinister unauthorized use is
when an institution with access to your credit reports uses that information to
take advantage of you. For instance, an insurance company is legally entitled
to view your credit report when deciding whether to issue you insurance, but
not because you filed a claim. It matters because they can use that information
to unfair advantage in negotiations.
"Let's say you were in a car
accident and couldn't work," Flitter says. "You have a lawyer who
says your case is worth $200,000, but the insurance company offers you
$40,000." If the insurance company views your credit report at that point,
it may be able to determine how desperately you need cash by viewing debt
amounts and any unpaid bills. As a result, the insurer may not raise its
"That's absolutely illegal --
it gives them an impermissible view into your finances," Flitter says. But
sometimes they do it anyway. In fact, this happened to another client of
Flitter's who was hit by a drunken driver. "The insurance company pulled
both his and his wife's credit reports," he says. When the couple sued,
the insurance company claimed it had never done this before. "We found out
they had done it four times in the previous year alone," Flitter says.
What to do about it: If a company
has looked at your credit report without a legitimate reason or permission, you
should consider contacting a consumer law attorney. Even if you aren't harmed
by illicit access of your credit report, "privacy loss always has
value," Flitter says. Beyond that, illegal access may lead to very real
harm. Years ago, Flitter says a client of his took a test drive at a car
dealership and while he was on the drive, a sales rep pulled his credit report.
This in itself was illegal: Dealerships are not allowed to view a customer's
credit reports until that customer specifically asks for credit terms. Three
weeks later, Flitter's client began seeing suspicious credit activity. It
turned out the sales rep was on parole for theft, and had apparently sold the
Employers who don't know the law
Depending on the laws in your state, a prospective employer may be able to view
your credit report before making a job offer. But did you know that a current
employer can also access your report while you're an employee? Some employers
make a practice of period spot checks for employees in sensitive positions.
"We have a client that's an armored car company, and they check employees'
credit reports once a year," says Marc Bourne, vice president, Know It All
Intelligence Group, a Philadelphia-area firm that offers employment screening.
A growing number of states, including
California, Connecticut and Illinois, enacted laws severely restricting in what
circumstances employers can view credit reports. Because new laws are being
introduced all the time, affected employers may not be current on the rules.
"We have a legal staff that keeps up to date and issues alerts,"
Bourne says. "It's pretty much a full-time job." For companies that
don't have staff devoted to these issues, it would be easy to mistakenly break
the law, he says.
What to do about it: It's illegal
for an employer to obtain your credit report without providing written
notification first. And that notification must be presented on its own page
(not buried in the fine print on a lengthy application form, for instance). So
carefully read any documents a prospective or current employer gives you. Be
aware that granting authorization for a "background check" includes
permission to view your credit report.
Make sure you know the law in your
state, so that if an employer does plan to see a credit report, you'll know whether
it has that right. Of course, refusing permission could cost you the job, so
that can be a tough decision to make. On the other hand, if you don't get or
don't want the job and an employer has checked your credit report illegally,
there's plenty you can do.
"Dispute it with the credit
bureau," Bourne says. "Most people think they can dispute only credit
information, but you can dispute anything including an inquiry." Next, he
advises, file a complaint with the Federal Trade Commission, which you can do
online. "We have to investigate any time an applicant calls and makes any
kind of FTC complaint," he says. "You can also go to your state's
attorney general's office and county bureaus of consumer protection and make
Garden-variety identity theft
Then there is the scenario that Mari Frank lived through. Credit reports are
like manna from heaven for identity thieves. Your credit report contains
current and former addresses and accounts that can be used to impersonate you.
In 2005, this happened on a grand scale: Ambitious identity thieves set up fake
businesses specifically to obtain credit reports from consumer data broker
ChoicePoint, and ultimately gained access to up to 160,000 records. That event
spurred most states to enact laws requiring that consumers be notified of any
security breach that could put their personal data at risk of theft. Another
result of this breach is that credit reports now only show partial Social
Security and account numbers as an added layer of protection, but a criminal
who obtains your credit report illegally can still use it to do plenty of
What to do about it: If a miscreant
is indeed trying to steal your identity, the first sign may be a credit report
inquiry from a company you don't recognize, so it's important to investigate
any unfamiliar inquiry. If your investigation turns up anything suspicious --
for instance, someone trying to obtain credit in your name -- contact all three
credit bureaus to alert them about the fraud and ask them to put a temporary
security alert on your information that will tell creditors to take extra steps
to verify your identity if credit is requested.
"By law, lenders cannot ignore
security alerts," Griffin says. "So if a fraudster applies for
credit, they should ask for extra documentation." In addition, he says,
contact lenders or other companies where you appear to have accounts you didn't
open and alert them to the fraud.
Your next step should be to file a
fraud report with local law enforcement, he says. "Once you have that, you
can add a victim statement to your credit report." That allows the credit
bureau to remove fraudulent accounts from your report, he says. And you can ask
to have creditors contact you before granting any credit in your name.
Additional reporting by Fred O. Williams.
See related: 6 myths about credit report checks by employers
, 10 surefire steps to get errors off your credit reports
, Credit reports falsely tag consumers as terrorists, drug traffickers
Published: March 5, 2013