What Is a CRA Notice? Types, Deadlines, and Next Steps

A CRA notice is a written communication required by the federal Fair Credit Reporting Act that tells you a consumer reporting agency’s data about you was just used, changed, or restored. It might mean a lender denied your application, an employer is about to act on a background check, a fraud alert was placed, a dispute was decided, or deleted information came back into your file. Each type carries a specific set of rights and a clock, and ignoring one can quietly cost you a free report, a shot at correcting bad data, or a job offer.

Why You Received One

Consumer Reporting Agencies (CRAs) like Equifax, Experian, and TransUnion sell your borrowing and payment history to lenders, employers, insurers, and landlords. Every time one of those parties uses your report to make a decision that hurts you, or every time the CRA itself changes something in your file, federal law creates a notice obligation. The FCRA aims for accuracy, fairness, and privacy in consumer reporting, and notices are the primary mechanism it uses to keep you informed.1Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act

These are not courtesy letters. Each type has legally required contents, a required sender, and a required timing window. Which type you got determines what you should do next.

The Notice Types You Might Receive

Adverse Action Notice

The most common one. When a lender, insurer, employer, or landlord denies you or gives you worse terms because of something in your credit report, they have to tell you. The notice must include the name, address, and phone number of the CRA that supplied the report, a statement that the CRA didn’t make the decision, your right to a free copy of the report within 60 days, and your right to dispute anything inaccurate.2Federal Trade Commission. Using Consumer Reports for Credit Decisions: What to Know About Adverse Action and Risk-Based Pricing Notices If a credit score was used, the notice must include that score.

Adverse action isn’t limited to outright denials. Revoking existing credit, refusing the amount or terms you asked for, and cutting your terms after an unfavorable account review all qualify.2Federal Trade Commission. Using Consumer Reports for Credit Decisions: What to Know About Adverse Action and Risk-Based Pricing Notices

Pre-Adverse Action Notice from an Employer

Employers follow a stricter two-step process. Before making a final hiring, promotion, or termination decision based on your credit report, the employer must send you a pre-adverse action notice with a copy of the report and a written summary of your FCRA rights.3Federal Trade Commission. Using Consumer Reports: What Employers Need to Know The point is to give you time to catch errors before the decision is locked in. The FCRA requires a reasonable waiting period between the pre-adverse notice and any final action, and five business days is a widely followed federal baseline.

Risk-Based Pricing Notice

Sometimes you’re approved but on worse terms than the lender’s best-qualified borrowers get. When your credit report drove the worse terms, the lender must send a risk-based pricing notice.4eCFR. Subpart H Duties of Users Regarding Risk-Based Pricing If they already sent an adverse action notice for the same transaction, the risk-based pricing notice isn’t required. When a score was used, the notice must include your score, the range of possible scores under that model, up to four or five key factors that hurt your score, and the name of the CRA or scoring company that supplied it.2Federal Trade Commission. Using Consumer Reports for Credit Decisions: What to Know About Adverse Action and Risk-Based Pricing Notices

Fraud Alert Confirmation

When you request a fraud alert, the CRA must confirm it was placed. An initial fraud alert lasts at least one year and signals creditors to take extra steps to verify your identity before opening new accounts. Identity theft victims who file an identity theft report can get an extended fraud alert lasting seven years.5Office of the Law Revision Counsel. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts Placing an alert at one of the three major CRAs obligates that agency to notify the other two.

Dispute Outcome Notice

After you dispute something on your report, the CRA has to investigate and send you the results. The investigation normally must be completed within 30 days of the CRA receiving your dispute; if you provide additional relevant information during that window, the agency gets up to 15 more days.6Federal Trade Commission. Consumer Reports: What Information Furnishers Need to Know The outcome notice tells you whether the item was corrected, deleted, or verified as accurate.

Reinsertion Notice

This one catches people off guard. If a CRA deleted information after a dispute but later puts it back, the agency must notify you in writing within five business days. The notice has to say the item was reinserted, name the furnisher who certified it, and remind you of your right to add a statement to your file disputing the item.7Office of the Law Revision Counsel. 15 US Code 1681i – Procedure in Case of Disputed Accuracy The furnisher must certify the information is complete and accurate before the CRA can reinsert.

Notice of Negative Information

A financial institution that reports negative information about you to a nationwide CRA must notify you either before or shortly after doing so. It’s separate from any collection letter or late-payment warning. The FCRA provides model language institutions can use, and it essentially says negative information has been or will be furnished to credit bureaus and could affect your credit.8Legal Information Institute. 12 CFR Appendix B to Part 1022 – Model Notices of Furnishing Negative Information

What a Valid Notice Must Contain

The specifics vary by type, but most CRA notices share a core:

Many notices must also include or come with the CFPB’s Summary of Your Rights Under the Fair Credit Reporting Act, a standardized document covering your major FCRA rights.1Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act If a notice you received is missing one of these required pieces, hold onto it. That gap can matter later.

Deadlines That Matter to You

What to Do Next

Start by identifying which type of notice you’re holding. The right response after a credit denial is different from the right response after a dispute outcome. Read the whole document, and compare every account and detail to your own records. If it references an account you don’t recognize, treat that as a possible identity theft signal.

If you got an adverse action notice, use the 60-day window. Request your free report from the CRA named in the notice, and review it for errors. If the denial rested on incorrect information, file a dispute with the CRA right away. You can also pull all three of your reports for free every week through AnnualCreditReport.com, so you don’t have to wait for a denial to check.11FTC: Consumer Advice. You Now Have Permanent Access to Free Weekly Credit Reports

If you got a pre-adverse action notice from an employer, act quickly. That’s your window to flag errors in the background report before the employer makes a final decision.

If you suspect fraud, place a fraud alert or a security freeze. An initial fraud alert lasts one year and requires creditors to verify your identity before opening accounts. A security freeze goes further by blocking access to your report until you lift it, and under federal law, placing and lifting one is free.12FTC: Consumer Advice. Free Credit Freezes Are Here The freeze is the stronger protection, but you’ll have to temporarily lift it whenever you apply for new credit.

If your dispute outcome notice says the information was verified as accurate but you still think it’s wrong, you can add a personal statement to your file explaining your position, file a complaint with the Consumer Financial Protection Bureau, or send a direct dispute to the furnisher.13eCFR. 16 CFR Part 660 – Duties of Furnishers of Information to Consumer Reporting Agencies – Section: 660.4 Direct Disputes

When a Required Notice Never Arrives

If a company should have sent a notice and didn’t, or sent one missing required contents, the FCRA gives you two tracks depending on how the violation happened.

Willful violations let you recover either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater, plus punitive damages and attorney’s fees.14Office of the Law Revision Counsel. 15 US Code 1681n – Civil Liability for Willful Noncompliance Negligent violations are limited to actual damages plus attorney’s fees, with no statutory minimum, so you have to show real financial harm.15Office of the Law Revision Counsel. 15 USC 1681o Civil Liability for Negligent Noncompliance

The deadline for suing is the earlier of two years from when you discovered the violation or five years from when it occurred.16Federal Trade Commission. Fair Credit Reporting Act The discovery clock matters: if a lender quietly denied you without sending the required adverse action notice, the two-year period doesn’t start until you learn the notice was missing.

Notices From Specialty Reporting Agencies

Equifax, Experian, and TransUnion get most of the attention, but they aren’t the only players. Dozens of specialty CRAs collect data too, and the same notice rules apply. If a bank declined your checking account application based on a ChexSystems report, or a landlord rejected you using a tenant screening company, you should receive an adverse action notice naming that agency.

Common categories include deposit account screening (ChexSystems, Early Warning Services), insurance claims history (LexisNexis C.L.U.E., Verisk’s A-PLUS), employment screening (Checkr, HireRight), and tenant screening (TransUnion SmartMove, Contemporary Information Corp.).17Consumer Financial Protection Bureau. List of Consumer Reporting Companies You have the same right to request your file and dispute errors with these agencies as you do with the big three.

If a notice names a company you’ve never heard of, that’s your cue to request your file from that specialty CRA. The bad data is often in a niche database you didn’t know existed.