Is It Illegal to Check Someone Else’s Credit Report?

Yes, in most situations it is illegal to check someone’s credit report. The Fair Credit Reporting Act lets a credit bureau release a report only when the requester has one of a short list of “permissible purposes.” Anyone who pulls a report outside those reasons can be sued for damages, and pulling one under false pretenses is a federal crime that carries prison time.1Federal Trade Commission. Fair Credit Reporting Act

The rule applies to reports from the three national bureaus (Equifax, Experian, and TransUnion) and to specialty reporting companies that track tenant histories, medical payments, and similar data. A curious relative, a suspicious partner, an ex, a coworker, or a business with no relationship to you cannot legally obtain your report just because they want to see it.

The Only Legal Reasons to Pull Someone’s Credit Report

The FCRA’s list of permissible purposes is exhaustive. If a requester’s reason isn’t on it, the pull is unlawful.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports

  • A credit transaction you started, such as applying for a mortgage, auto loan, or credit card, or a creditor reviewing or collecting on an existing account.
  • Your own written instructions authorizing someone (a background-check company, a financial advisor) to access the report.
  • Insurance underwriting when a carrier is deciding whether to issue a policy or how to price it.
  • Tenant screening by a landlord or property manager evaluating a rental application.
  • Employment, but only with your standalone written notice and signed authorization first.
  • A government agency required by law to consider your financial status before granting a license or benefit.
  • A court order with proper jurisdiction or a federal grand jury subpoena.
  • State and local child support enforcement, to establish ability to pay or enforce an existing order.
  • A legitimate business need tied to a transaction you initiated with that specific business.

Notice what’s missing. There is no “I’m worried about them,” no “we’re getting divorced,” no “I want to know if they can afford this.” A parent cannot pull an adult child’s report, and a spouse cannot pull the other spouse’s report, without written permission or another permissible purpose.

Employment sits in its own bucket because it’s the most restricted purpose. An employer cannot quietly obtain your report the way a lender can. Federal law requires a separate written disclosure (not buried inside a job application) and your signed authorization before any pull.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports If the employer then decides not to hire you based on the report, they have to give you a copy and a summary of your rights before finalizing the decision so you can dispute errors.3Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Several states also ban employer credit checks outright except for specific roles like finance or law enforcement.

What Someone Who Pulls Your Report Illegally Faces

The FCRA sets three penalty tracks, and which one applies depends on the state of mind behind the pull.

Willful Violations

When the access is deliberate, you can sue for your actual damages (lost money, emotional distress, time spent cleaning up the mess) or for statutory damages between $100 and $1,000, whichever is greater. Courts can add punitive damages and must award your attorney’s fees and costs if you win. For an individual person, not a company, who obtained your report under false pretenses or knowingly without a permissible purpose, the floor rises: actual damages or $1,000, whichever is greater.4Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance

Negligent Violations

Some unauthorized pulls come from sloppy compliance rather than bad intent. A negligent violation still entitles you to your actual damages plus attorney’s fees and costs, but no statutory or punitive damages. That is why proving the violation was willful matters so much in FCRA litigation.5Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance

Criminal Penalties

Obtaining a credit report under false pretenses (lying about who you are or why you need it) is a federal crime punishable by a fine and up to two years in prison.6Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses The same penalty applies to an officer or employee of a credit reporting agency who knowingly hands consumer information to someone not authorized to receive it.7Office of the Law Revision Counsel. 15 USC 1681r – Unauthorized Disclosures by Officers or Employees Criminal prosecutions are less common than civil suits, but they do occur, particularly in identity theft rings and cases involving corrupt insiders at the bureaus.

You do have a filing window. An FCRA suit must be brought within two years of discovering the violation or within five years of when it happened, whichever comes first. Because unauthorized pulls often sit unnoticed for months, the discovery clock is what usually matters.

How to Tell If Someone Pulled Your Report Without Permission

The evidence lives on your own credit report, in the inquiries section. Pull all three reports at AnnualCreditReport.com, which is now free every week.8Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports

Focus on hard inquiries. These are the pulls tied to lending decisions, they can dent your score, and they stay on the report for two years. An unfamiliar company name in that list is the clearest signal that someone applied for credit in your name or ran a pull they shouldn’t have. Soft inquiries (prescreened offers, your own monitoring, some background checks) don’t affect your score and are only visible to you, but scan them too since the permissible-purpose rules still apply.

What to Do About an Unauthorized Pull

Move quickly. The stronger your paper trail, the stronger your dispute and any later legal claim.

Start with the company on the inquiry. Call or write and ask what permissible purpose they had. If they can’t produce one, ask them to request removal of the inquiry from your report. Log every call: date, name, what was said.

If the company won’t cooperate, file a formal dispute with each bureau that shows the inquiry. Attach your documentation and explain why you believe the pull was unauthorized. The bureau has to investigate and respond.

File complaints with the Consumer Financial Protection Bureau and the Federal Trade Commission. Both agencies enforce the FCRA, and complaints build the record that regulators use against repeat offenders.1Federal Trade Commission. Fair Credit Reporting Act

If your damages are meaningful, talk to a lawyer who handles FCRA cases. Because the statute shifts attorney’s fees to a winning plaintiff, many of these lawyers work on contingency.

Blocking Future Unauthorized Access

The most effective step you can take on your own is a security freeze at each of the three bureaus. A freeze tells the bureau not to release your report to new creditors, so an application filed in your name (by an identity thief or anyone else without your permission) gets kicked back because the lender can’t see your file. The bureaus must place a freeze for free within one business day of a phone or online request and lift it within one hour when you’re ready to apply for credit yourself.9GovInfo. 15 USC 1681c-1 – Identity Theft Prevention and Credit History Restoration Existing creditors and prescreened offers are unaffected.

A fraud alert is the lighter option. It doesn’t block access; it flags your file so creditors take extra steps to verify identity before opening new accounts. An initial alert lasts one year and only requires contacting one bureau, which notifies the others. Confirmed identity theft victims can request an extended alert lasting seven years. Both are free.

For most people who aren’t actively applying for credit, freezes at all three bureaus are the stronger choice. If you expect to shop for a loan soon and don’t want to keep lifting freezes, a fraud alert may fit better in the meantime.