Can You Sue for an Unauthorized Credit Inquiry?

Yes, you can sue for an unauthorized credit inquiry under the federal Fair Credit Reporting Act. If a company pulled your credit report without a legally recognized reason, the statute lets you recover $100 to $1,000 per willful violation even with no out-of-pocket loss, plus any actual damages, punitive damages in serious cases, and your attorney’s fees. You have two years from the date you discovered the inquiry to file, with a five-year outer limit from the date it occurred.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions

What Makes an Inquiry Unauthorized

The FCRA requires anyone requesting your credit report to have a “permissible purpose,” meaning a specific reason the statute lists.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The recognized reasons include:

  • A lender evaluating you for a loan, credit card, or credit line increase
  • An insurer underwriting your application
  • An employer or prospective employer with your written consent
  • A landlord evaluating a rental application
  • An existing creditor reviewing your account
  • A legitimate business need tied to a transaction you initiated

If a company pulled your file for a reason outside those categories, the inquiry is unauthorized and violates the FCRA.3Federal Trade Commission. Fair Credit Reporting Act Obtaining a consumer report under false pretenses is a willful violation and can carry criminal penalties of up to two years in prison.4Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses

One boundary matters here. Lawsuits over unauthorized inquiries almost always involve hard inquiries, which are the ones tied to an application you submitted and which can lower your score.5myFICO. Does Checking Your Credit Score Lower It Soft inquiries, such as prescreened offers, an existing creditor reviewing your account, or you checking your own credit, don’t require your permission and don’t affect your score.6Consumer Financial Protection Bureau. What Kind of Credit Inquiry Has No Effect on My Credit Score? A soft inquiry rarely supports a lawsuit.

Willful vs. Negligent: Where the Money Is

The single most important question in any FCRA inquiry case is whether the violation was willful or merely negligent. It changes what you can recover by an order of magnitude.

A willful violation means the company either knew it was breaking the law or acted with reckless disregard for your rights. A business that pulled your credit with no application on file and no other permissible purpose has a hard time explaining that as an honest mistake. For willful violations, the FCRA allows statutory damages of $100 to $1,000 per violation without any proof of financial loss, plus punitive damages and attorney’s fees.7Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance

A negligent violation means the company failed to follow the law but didn’t do so intentionally or recklessly. Here you can only recover actual damages you can prove, plus attorney’s fees. No statutory damages. No punitive damages.8Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance A negligent-only case with no documented financial harm is worth very little, even when the inquiry was clearly improper.

Damages You Can Recover

The FCRA offers four categories of compensation, with willfulness gating the biggest ones.

  • Actual damages: real financial harm traceable to the inquiry, such as a credit denial, a higher interest rate caused by the score drop, or a lost job offer. You need documentation connecting the loss to the inquiry. General testimony about stress or frustration typically won’t carry the day on its own.
  • Statutory damages: $100 to $1,000 per willful violation, at the court’s discretion, available even without proof of actual loss.7Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
  • Punitive damages: available only for willful violations, in whatever amount the court considers appropriate for reckless or egregious conduct.7Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
  • Attorney’s fees and costs: available for both willful and negligent violations if you win, which is what makes it economically possible for lawyers to take these cases when the underlying dollars are modest.8Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance

A caution runs the other direction as well. If a court decides you filed in bad faith or for harassment, it can order you to pay the defendant’s attorney’s fees instead.8Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance

Who You Can Sue

Two categories of defendant show up in these cases, and they’re on the hook for different reasons.

The company that pulled your report is the primary target. That could be a lender, a debt collector, a car dealership, a landlord, or any other entity that accessed your file without a permissible purpose. Their liability doesn’t depend on whether you filed a dispute first. The violation happened the moment they pulled the report.

A credit reporting agency, meaning Experian, Equifax, or TransUnion, becomes a separate defendant when it mishandles your dispute. If you notify the agency of the unauthorized inquiry and it refuses to investigate, runs a sham investigation, or fails to remove the inquiry after finding it unverifiable, that failure is its own FCRA violation.9Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2022-07 – Reasonable Investigation of Consumer Reporting Disputes The agency also can’t demand documentation the statute doesn’t require, such as a police report, as a precondition to investigating.

The Filing Deadline

You have two years from the date you discovered the inquiry, with an absolute outer limit of five years from the date it occurred.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery date is when you first learned or reasonably should have learned about the inquiry. If you pull your credit report and spot an unfamiliar hard inquiry, the two-year clock starts that day.

You can file in any U.S. district court regardless of the dollar amount at stake, or in any other court with jurisdiction. There’s no minimum threshold to get an FCRA claim into federal court.1Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions

What to Do Before You Sue

The FCRA doesn’t require you to dispute the inquiry before suing the company that pulled your report. The violation is complete on access. Still, disputing serves two purposes: it builds a paper trail showing you objected, and it’s the only way to trigger the credit reporting agency’s independent investigation duty, which opens the door to a second claim if the agency fails to handle it properly.

Send a dispute letter to the credit reporting agency (or agencies) showing the inquiry. Identify the specific inquiry, the date it appeared, and the company that made it. State clearly that you did not authorize the inquiry and did not initiate any transaction with that company. Send it by certified mail with return receipt requested.10Consumer Financial Protection Bureau. How Do I Dispute an Error on My Credit Report?

Also write directly to the company that made the inquiry. Demand that they identify the permissible purpose they relied on and ask them to contact the bureaus to remove the inquiry. If they can’t produce a valid reason, their response (or silence) becomes evidence.

Once the credit reporting agency receives your dispute, it has 30 days to conduct a reasonable investigation. That window can extend by 15 days if you send additional information during the initial 30, but the extension disappears the moment the agency finds the information inaccurate or unverifiable.11Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy Disputes filed after receiving your free annual credit report can take up to 45 days total.12Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report? Save every letter, receipt, and response.

If Identity Theft Caused the Inquiry

An unauthorized inquiry is sometimes the first sign someone applied for credit in your name. If that’s the situation, the FCRA gives you an extra tool. Credit reporting agencies must block information resulting from identity theft within four business days of receiving proper documentation.13Federal Trade Commission. FCRA 605B – Block of Information Resulting from Identity Theft You need to provide:

  • Proof of your identity
  • An identity theft report, filed at IdentityTheft.gov or with local law enforcement
  • Identification of the specific information you’re disputing
  • A statement that the inquiry and any associated accounts are not yours

The agency must then tell the company that made the inquiry about the block and the identity theft report. It can decline or reverse the block only if the request was made in error, was based on a material misrepresentation, or you benefited from the transaction.13Federal Trade Commission. FCRA 605B – Block of Information Resulting from Identity Theft Identity theft also opens claims against the thief and against any company that granted credit in your name without adequate verification.

A security freeze prevents the next round. Federal law gives every consumer the right to place a free freeze on their file, which stops the credit reporting agency from releasing your report to anyone without your express authorization.14Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act You’ll need to lift it temporarily whenever you apply for credit yourself.