Fair Credit Reporting Act: a guide to your rights
US law guarantees you can fix credit report mistakes; recent changes make it easier
It's not always easy to correct errors on your credit reports. However, don't give up just yet: You have a decades-old law on your side that requires credit reporting agencies and data providers to correct their mistakes -- and recent changes make it easier.
The Fair Credit Reporting Act was enacted in October 1970, just as consumer credit was exploding -- and so was the power of the private companies that keep track of consumers' payment behavior. Credit reporting agencies, once small and local, were consolidating to create a national credit reporting system, and the law offered a consumer-friendly counterweight to keep the playing field even.
"As laws go, the Fair Credit Reporting Act is a pretty strong one," says Cary Flitter, a consumer lawyer and law professor in Philadelphia. Per the law, credit reporting companies -- as well as the data furnishers that give them the information they file -- are required to follow a strict set of guidelines, fix mistakes and are legally on the hook if they fail to do so.
That said, "there are little pitfalls the consumer has to navigate," says Flitter, so it's important to be your own best advocate. If you're not quite sure what your rights are when it comes to your credit information, here are six things you need to know about the Fair Credit Reporting Act (FCRA) -- and how you can use it to protect yourself.
You have the right to know what's in your credit reports.
The act requires credit reporting agencies to give you free access to the information they have collected about you and your financial habits once every 12 months.
You can access a free copy of each of your generic credit reports -- which contain information about how you have handled credit in the past -- from the three biggest credit bureaus (Experian, Equifax and TransUnion) by writing to them or through the Web at AnnualCreditReport.com.
You are also entitled to a free annual copy of any reports that are compiled about you by , such as CoreLogic, LexisNexis and Certegy Check Services. These agencies keep records of financial data not tied to a loan -- such as your rental payments, insurance claims or check-writing history -- and sell them to landlords, banks, insurance representatives and others considering doing business with you.
"You hear the terminology Fair Credit Reporting Act and you think that's an act that only applies to credit reports," says Paul Stephens, director of privacy and advocacy at Privacy Rights Clearinghouse. However, "there are these other types of agencies that exist that are essentially maintaining dossiers of consumers that go well beyond the traditional concept of credit."
Any credit reporting agency that collects financial information on you is required to honor your request for a free annual copy of your credit file. Getting your credit report from a smaller agency will take a little more work, says Stephens. "Those reports you must get directly from those companies. There is no central source to obtain [them]."
To help consumers identify which companies may be collecting their information, the Consumer Financial Protection Bureau has compiled a list of specialty reporting companies that are actively collecting consumer information. However, the list doesn't include every consumer reporting company on the market, nor does it include explicit instructions for pulling your reports. You'll have to contact each company directly and request specific directions.Every company has a different policy for responding to requests. Some companies will require that you mail a request for the report, others will provide a toll-free number.
Access is limited to your credit report.
If you're worried that your boss or potential sweetheart can access your credit information without your permission, don't sweat it. The act bars individuals from seeing your credit reports, unless they can prove that they have a legitimate need to see it.
"There's something that is known as the permissible purpose doctrine and that basically says that you can't just go to a credit reporting agency and say, 'I want to take a look at this person's file,'" says Stephens. "You have to have a reason to look at that file."
According to the FCRA, a person can access your credit report only if:
- A court has ordered that the credit information be shared.
- That person is a lender and you are applying for some form of credit. A creditor may also pull your report if you currently have an account open with them or if you have a balance that's past due.
- The person is working on behalf of an insurance company that's underwriting your insurance or a government agency that is considering giving you a license or other public benefit, such as social services.
- An individual has requested your report for employment purposes and has obtained your written authorization to view it.
- A person can prove a legitimate business need to view the report. For example, if a landlord is considering your rental application or a person is working on behalf of a retailer and has accepted a check as a form of payment, he or she can request a copy of your report.
- You have given clear instructions to the credit reporting agency to release your information to a particular person.
Authorized state officials or child support enforcement agents may also access your credit report if they need to verify your ability to make child support payments or determine how much you should pay.
You have the right to dispute information that is not accurate.
Privacy Rights Clearinghouse
Sometimes, however, credit reports do get into the wrong hands. Flitter recommends you periodically check the section of your report that lists who's pulled it. "The second-to-last page of your credit report will list everyone who has looked at your report in the last two years," he says. If someone pulls your report without proper authorization, speak up. There are serious penalties for people who break this section of the law, says Flitter. "It's actually a felony to obtain someone else's credit report under a false pretense," he adds.
If there is an error on your report, you can do something about it.
"You have the right to dispute information that is not accurate," says Stephens.
The FCRA requires credit reporting agencies to "maintain reasonable procedures that ensure maximum possible accuracy," says Flitter, the consumer lawyer. Even so, errors can show up on your credit report, so it's important to review your files regularly.
"Get the credit report and look at it," says Flitter. "Examine it for accuracy to the best of your knowledge."
If you spot an error, "you must notify the credit bureau and it must conduct an investigation," he says. If you find out about an error through other means, but don't have a fresh copy of your credit report to prove it, don't worry. As of September 2015, the credit bureaus can no longer ask for a credit report identification number when you submit a dispute.
The credit bureau has 30 days to look into your dispute, based on the information you provide to it. The credit reporting agency must also notify the furnisher of the information, such as a bank or credit card issuer, within five days of receiving your dispute and provide the furnisher with the same evidence that you gave when you flagged the error.
The data furnisher must then investigate your dispute and verify whether the information it gave to the credit bureau is correct. "If it's not verified within 30 days, then the credit bureau has to remove [the disputed error] from the credit report," says Flitter.
Beginning in September 2016, the credit bureau must also provide you with an additional free report through AnnualCreditReport.com if it corrects an error on your report. That way, you can check to make sure all the information is correct.
Starting in September 2018, credit bureaus will also be required to send you a detailed report after an investigation is complete outlining what the investigation found and what steps you can take if you're unhappy with its findings. The notices will also provide you with the contact information of the data furnishers supplying the misinformation so you can initiate an additional dispute.
Sometimes credit bureaus and data furnishers will mistakenly verify information that you know is inaccurate, forcing you to send a second dispute. However, recent changes to the credit report dispute process should make that less likely.
In March 2015, the credit bureaus agreed in a settlement with the New York State Attorney General to overhaul the bureaus' dispute resolution process and conduct more thorough investigations of mistakes resulting from identity theft or mixed up credit report files. The credit bureaus also agreed to change their reporting practices in order to lessen the number of inaccuracies that appear on consumers' reports and monitor data furnishers more aggressively. In June 2015, the credit bureaus also struck a deal with 31 states to bolster their dispute resolution and credit reporting procedures and end deceptive practices, such as trying to sell products to consumers who have called about an inaccuracy.
Consumer advocates who have previously criticized the credit reporting agencies for conducting perfunctory investigations say the new rules should make it easier for consumers to successfully dispute errors on their reports.
"We're hopeful," says Chi Chi Wu, a staff attorney with the National Consumer Law Center. However, you should still take precautions when initiating your dispute, she says. "The disputes should be in writing. Don't make them over the telephone," she says. Include as much information as possible in your dispute and attach supporting evidence. As of September 2015, credit reporting companies must take a closer look at any documentation you provide if an initial investigation doesn't find a mistake.
Credit reporting companies allow you to upload supporting documentation online. But Wu recommends mailing your dispute by certified mail instead. That way, you have a clear paper trail showing that the credit bureau received your dispute and you have clear evidence of what it received, she says. It's also important to mail your dispute if a credit bureau inserts an arbitration clause in the online dispute agreement, barring you from taking the credit bureau to court.
If, after sending multiple disputes, you feel like you're getting nowhere, consult a lawyer experienced in these cases, says Wu. You are entitled under the Fair Credit Reporting Act to seek legal action. You can also file a complaint with the Consumer Financial Protection Bureau after you've submitted an unsuccessful dispute.
Negative information on
your credit report is subject to a time limit.
You can't dispute accurate negative information. However, you can make sure that the adverse information in your report is limited to the time frame set out by the Fair Credit Reporting Act. "The general rule is if there's something negative on your credit report, it's supposed to drop off after seven years," says Stephens. "One exception to that is bankruptcy. Bankruptcy can stay on your credit reports for 10 years."
Consumers never should send in their disputes online. Always in writing, [by] certified mail.
Chi Chi Wu
National Consumer Law Center
Occasionally, debt mistakenly gets re-aged, says Stephens, so make sure you watch out for debts that are older than 7 years or bankruptcy listings that are more than a decade old.
You have the right to know if you've been passed over because of information in
Creditors and employers are also required by the FCRA to notify you if they've rejected you or taken some other kind of adverse action (such as a higher interest rate) based on information in your report. That way, you can make sure that the information they're using to judge you is correct. "They don't want people being denied a job or a promotion based on a credit report and the credit report has false or misleading information," says Flitter.
You have the right to place a red flag on your credit report if you think your information
has been compromised.
The Fair Credit Reporting Act also gives you the power to exert at least some control over your credit report if you think your personal information is in danger from fraud or identity theft. "One of the rights that a consumer has under the FCRA is the right to place a fraud alert on their credit report," says Stephens. The fraud alert won't lock down your credit report the way a credit freeze will. Anyone with a permissible purpose, such as a credit card lender, will be able to still see the credit report. However, it will let lenders know that they need to double-check your identity before they give you extend you credit. "It warns the creditors to take extra precautions," says Stephens.
The free fraud alert will last for 90 days, but it can be renewed indefinitely, he adds.
Don't stop checking your reports
Finally, once you have determined that your credit information is safe and your reports are error-free, continue to periodically check them to make sure the information is still accurate and your data hasn't fallen into the wrong hands. A mistake can turn up at any time and sometimes errors that were corrected once will show up again. "Obtain a current credit report and get one at least once a year," says Flitter. "That's the first thing everyone can do for himself or herself."
- Credit freezes are now free – but do you need one? – Credit freezes, which keep lenders and other companies from viewing your credit, are now free. We compared them to other credit protection tools, including locks and monitoring services. Here's how to use them all to protect yourself ...
- Employer credit checks: Who does them, how they work and what laws apply – If you're applying for a new job, a credit check could determine your fate, depending on the position and where it's based. Here's how they work and what to expect ...
- My card issuer of 25 years suddenly wants to know more about me – Under the Patriot Act, banks are required to verify the identities of their customers and maintain accurate information on them. But my bank's demand to know how I earn my income is an invasion of my privacy ...