15 USC 1681: Consumer Rights, Disputes, and FCRA Lawsuits

The Fair Credit Reporting Act is the federal law, codified at 15 U.S.C. § 1681, that governs how your credit information is collected, shared, and used. It gives you the right to see what’s in your credit file, dispute anything wrong, limit who can pull your report, and sue when the rules are broken. It also puts hard obligations on the credit bureaus and on the banks, lenders, and collectors that feed them data.¹

Who and What the Law Covers

The FCRA reaches three groups: consumer reporting agencies (the credit bureaus), the companies that furnish data to those bureaus, and anyone who uses a credit report to make a decision about you. Equifax, Experian, and TransUnion are the biggest names, but the law also covers specialized agencies that do tenant screening, insurance claims histories, and employment background checks.¹

A “consumer report” is any communication from one of these agencies that bears on your creditworthiness, character, or reputation when it’s used to evaluate you for credit, insurance, employment, or another authorized purpose.¹

Your Core Rights

A Free Report Every Year

You can request a free copy of your credit report from each nationwide consumer reporting agency once every 12 months.² That’s separate from the free reports you’re entitled to after a triggering event, like a credit denial or a fraud alert. Checking annually is the simplest way to catch errors and spot identity theft early.

Adverse Action Notices

When a company denies you credit, raises your rate, turns down your rental application, or takes any other negative action based on your credit report, it has to tell you. The notice must identify the reporting agency that supplied the report, give the agency’s contact information, and make clear that the agency didn’t make the decision and can’t explain why.³ It also has to tell you about your right to a free copy of the report and to dispute anything inaccurate. For many people, this notice is the first sign something is wrong in their file.

Opting Out of Prescreened Offers

Credit card issuers and insurers can use prescreened lists from the bureaus to send you unsolicited offers, and you have the right to opt out. A phone or online opt-out lasts five years; a signed written request makes it permanent.⁴ The opt-out takes effect five business days after the bureau receives your request. It won’t affect your score, but it cuts down on mail-based identity theft.

Permissible Purposes

A bureau can only release your report to someone with a legally recognized reason for wanting it. The statute lists the permissible purposes: evaluating you for credit, reviewing an existing account, underwriting insurance, employment screening with your consent, and responding to a court order, among others.⁴ The bureau has to verify that anyone requesting a report has a legitimate reason, and releasing one without a permissible purpose is a violation.

How Long Negative Information Stays

Old negative information eventually ages off. The law sets maximum reporting periods:

Bankruptcy: 10 years from the date of the order for relief or adjudication.
Collection accounts and charge-offs: 7 years.
Civil judgments and arrest records: 7 years from entry, or until the statute of limitations expires, whichever is longer.
Paid tax liens: 7 years from the date of payment.
Other adverse items (except criminal convictions): 7 years.

Criminal convictions have no expiration and can stay on your report indefinitely.⁵ These limits stop the bureau from reporting the item; they don’t erase the underlying debt. A creditor can still try to collect.

Disputing Errors on Your Report

You can dispute inaccurate or incomplete information directly with the credit bureau. The bureau has to conduct a free reinvestigation and resolve the dispute within 30 days. That extends to 45 days if you send additional relevant information during the initial 30-day window.⁶

Within five business days of getting your dispute, the bureau has to forward the relevant details to the furnisher that reported the information. The furnisher investigates and reports back. If the entry can’t be verified, the bureau has to delete or correct it.⁶

If a deleted item is later reinserted, the furnisher has to certify the information is complete and accurate first. The bureau then has to notify you in writing within five business days of the reinsertion, including the furnisher’s name and contact information and a reminder that you can add a statement to your file.⁶

Send disputes by certified mail with return receipt requested. Keep your originals and send only copies. Online and phone disputes are faster but harder to document if the process breaks down.⁷ The paper trail is what you’ll need if you ever have to sue.

Fraud Alerts, Freezes, and Identity Theft Blocks

Fraud Alerts

If you think you’re a victim of fraud, you can place an initial fraud alert on your credit file. It lasts one year and tells anyone pulling your report to take extra steps to verify your identity before extending credit. You only have to contact one bureau; that bureau is required to share the alert with the other two.⁸

If you already have an identity theft report, you can request an extended fraud alert lasting seven years. Extended alerts also automatically opt you out of prescreened credit and insurance offers for five years. Active-duty military members get their own alert lasting at least 12 months, with a two-year prescreened-offer exclusion.⁸

Security Freezes

A security freeze goes further. It blocks the bureau from releasing your report to anyone new, making it nearly impossible for a thief to open accounts in your name. Freezes are free to place, free to lift, and stay in effect until you remove them.⁸

Phone or online freeze requests must be placed within one business day. If you later need to lift the freeze, say for a mortgage application, the bureau has to remove it within one hour of an electronic or phone request. Mail requests take up to three business days in either direction.⁸

Identity Theft Blocks

If fraudulent accounts are already on your report, you can go one step further. Under the identity theft blocking provision, a bureau has to block the reporting of any information you identify as resulting from identity theft within four business days of receiving your request, proof of identity, an identity theft report, and your statement identifying the fraudulent entries.⁹ A block removes the data entirely rather than just marking it as disputed.

Employment Screening

Employers cannot pull your credit report without your written permission, and the request for consent has to appear on a standalone document. It can’t be buried in a job application or bundled with other paperwork.⁴

If the employer decides to take an adverse action based on your report, the process happens in two steps. First, before the action is final, the employer has to give you a copy of the report and a summary of your rights so you can review what’s there. Second, after the adverse action, the employer sends a formal notice identifying the reporting agency, stating that the agency did not make the decision, and telling you about your right to dispute inaccuracies and request another free report within 60 days.¹⁰ Employers most often trip up by skipping the pre-adverse notice or combining both steps into one letter.

What Banks and Lenders Have to Do

The companies that report your account information to the bureaus have their own set of obligations. A furnisher cannot report information it knows or has reasonable cause to believe is inaccurate. Once it learns something it sent is incomplete or wrong, it has to promptly notify the bureau and supply corrections.¹¹

When a bureau forwards your dispute to a furnisher, the furnisher has to investigate, review any evidence the bureau sends, and report back. If the furnisher finds the information is inaccurate, it has to notify every bureau it sent the bad data to.¹¹ Many disputes stall not at the bureau but at the furnisher. If your bank insists its data is right without actually checking, that itself may be a violation.

Furnishers also have to flag disputed accounts. If you’ve told the company you contest the debt, it can’t keep reporting the account without noting the dispute.¹¹ Bureaus themselves must follow reasonable procedures to ensure the maximum possible accuracy of the information in your file.¹²

Suing Under the FCRA

Willful Violations

If a bureau, furnisher, or user of credit reports willfully violates the FCRA, you can sue for either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. A court can also award punitive damages plus your attorney’s fees and court costs.¹³ Willfulness doesn’t require malice. It covers situations where a company knew about its obligations and disregarded them or acted with reckless disregard for whether its conduct was lawful.

Negligent Violations

When a violation is negligent rather than willful, you can still recover actual damages and attorney’s fees, but statutory and punitive damages are off the table.¹⁴ The hard part with negligence claims is proving actual damages: you have to show concrete financial harm, like a higher interest rate or a lost job, tied to the violation.

Criminal Penalties

Anyone who knowingly obtains information from a credit bureau under false pretenses faces fines and up to two years in prison.¹⁵ A bureau employee who knowingly gives consumer information to someone not authorized to receive it faces the same penalties.¹⁶ The Consumer Financial Protection Bureau and the Federal Trade Commission also have enforcement authority against companies engaged in systemic violations.

Deadlines to File

You can’t wait indefinitely. The FCRA gives you the earlier of two deadlines: two years from the date you discovered the violation, or five years from the date the violation actually occurred.¹⁷ The five-year outer limit is a hard cap. If you discover an error four years after it was reported, you have one year to file, not two. If you don’t discover it until after five years, the window is already closed. That’s the practical reason to check your reports regularly, not only when you need credit.

1
Office of the Law Revision Counsel. 15 U.S. Code 1681a – Definitions; Rules of Construction
2
Office of the Law Revision Counsel. 15 U.S. Code 1681j – Charges for Certain Disclosures
3
Office of the Law Revision Counsel. 15 U.S. Code 1681m – Requirements on Users of Consumer Reports
4
Office of the Law Revision Counsel. 15 U.S.C. 1681b – Permissible Purposes of Consumer Reports
5
Office of the Law Revision Counsel. 15 U.S. Code 1681c – Requirements Relating to Information Contained in Consumer Reports
6
Office of the Law Revision Counsel. 15 U.S.C. 1681i – Procedure in Case of Disputed Accuracy
7
Consumer Advice. Sample Letter to Credit Bureaus Disputing Errors on Credit Reports
8
Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
10
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
11
Office of the Law Revision Counsel. 15 U.S. Code 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
12
Office of the Law Revision Counsel. 15 U.S. Code 1681e – Compliance Procedures
13
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
14
Office of the Law Revision Counsel. 15 U.S. Code 1681o – Civil Liability for Negligent Noncompliance
15
Office of the Law Revision Counsel. 15 U.S. Code 1681q – Obtaining Information Under False Pretenses
16
Office of the Law Revision Counsel. 15 U.S. Code 1681r – Unauthorized Disclosures by Officers or Employees
17
Office of the Law Revision Counsel. 15 U.S.C. 1681p – Jurisdiction of Courts; Limitation of Actions