The Fair Credit Reporting Act is the federal law that controls credit reports and background-check reports. It requires the companies that build these reports to use reasonable procedures for accuracy. It also limits who may see a report, gives people the right to dispute errors, and sets how long most negative information may stay on a report.
Most people facing a credit-report problem arrive here after something specific has happened. They might have found an account they never opened, been turned down for a loan, or lost a job offer after a background check that got their history wrong. They want to know whether a law covers what happened, who answers for an error, and what the dispute process actually involves. This page walks through those questions one at a time, using the statute's own words where they matter.
What the Fair Credit Reporting Act Is
The FCRA is codified at 15 U.S.C. § 1681 et seq. Congress stated its purpose in 15 U.S.C. § 1681. The goal is to require that consumer reporting agencies "adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." Congress also found a need for these agencies to act "with fairness, impartiality, and a respect for the consumer's right to privacy."
A consumer reporting agency is a company that collects information about people and sells reports on them. The Consumer Financial Protection Bureau describes credit reporting companies as "companies that compile and sell credit reports," also called credit bureaus.
A consumer report is defined in 15 U.S.C. § 1681a(d). It means any written, oral or other communication of information by a consumer reporting agency "bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living." The information must be used or expected to be used as a factor in deciding a person's eligibility for consumer credit or insurance, for employment, or for another purpose the law authorizes.
A furnisher is a business that sends information about people to a consumer reporting agency. Examples include a lender, a card issuer or a collection agency that reports account data.
The FCRA governs three groups: consumer reporting agencies, furnishers, and users of consumer reports. It is separate from the federal law on debt collection conduct. Each law has its own rules and remedies.
Who the FCRA Covers: Consumer Reporting Agencies, Furnishers, and Users
The most familiar consumer reporting agencies are the three nationwide bureaus: Equifax, Experian and TransUnion. The CFPB notes that other companies are also covered. These include specialty consumer reporting companies, which "may collect personal information other than credit information including, but not limited to, your employment and tenant history." Tenant-screening and employment-screening companies fall into that group. Under 15 U.S.C. § 1681e(b), every consumer reporting agency preparing a report "shall follow reasonable procedures to assure maximum possible accuracy" of the information.
Furnishers are among the sources of what appears on a report. The CFPB lists "thousands of lenders across the country, public records such as bankruptcies, and collection agencies" among those sources. A furnisher's duties attach to its role as a source of information. They do not depend on what kind of business it is.
Users are the businesses that obtain reports, such as lenders, insurers, landlords and employers. A user must have a permissible purpose, meaning a reason the law allows for getting a report. Permissible purposes are set out in 15 U.S.C. § 1681b. Under 15 U.S.C. § 1681e(a), a consumer reporting agency's procedures must require that prospective users "identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose."
In the CFPB's summary of rights, adverse action includes a denial of an application for credit, insurance or employment based on a report. A background check prepared for a job by an outside screening company is a consumer report, because "employment purposes" is part of the statutory definition.
Consumer Rights Under the FCRA
Access comes first. Under 15 U.S.C. § 1681j(a), each nationwide consumer reporting agency must make its file disclosures "once during any 12-month period upon request of the consumer and without charge." For the three nationwide bureaus, that right applies when the request is made through the centralized source the law set up. The FTC's page on free credit reports identifies that source as AnnualCreditReport.com and calls it the only site authorized to fill these orders. The FTC also reports that the three bureaus have permanently extended a program that allows free weekly checks through that site.
Dispute rights come next. A consumer may dispute incomplete or inaccurate information directly with a consumer reporting agency, which then must reinvestigate. That process is described below. A consumer may also dispute with the furnisher. According to the CFPB, furnishers "generally must investigate and respond to your dispute within 30 days of when they receive the dispute."
Notice rights matter when a report leads to a bad result. The CFPB's Summary of Your Rights Under the Fair Credit Reporting Act states that anyone who uses a report to deny credit, insurance or employment, or to take another adverse action, "must tell you, and must give you the name, address, and phone number of the agency that provided the information."
There are also limits on who may look at a report. A consumer reporting agency may not furnish a report to anyone it has "reasonable grounds for believing" will not use it for a permissible purpose (15 U.S.C. § 1681e(a)).
How the FCRA Dispute Process Works
A reinvestigation is the review a consumer reporting agency must carry out after a consumer disputes an item in their file. Under 15 U.S.C. § 1681i(a)(1), when a consumer disputes "the completeness or accuracy of any item of information," the agency "shall, free of charge, conduct a reasonable reinvestigation." It must record the item's current status or delete it, and it must do so "before the end of the 30-day period beginning on the date on which the agency receives the notice of the dispute."
That period may be extended by up to 15 days. The extension applies only if the consumer sends relevant information during the first 30 days. It does not apply if, during those 30 days, the item is found inaccurate or incomplete or the agency decides it cannot be verified. The CFPB summary notes that the agency need not investigate a dispute that is frivolous.
The furnisher becomes involved quickly. Under 15 U.S.C. § 1681i(a)(2), the agency must notify the furnisher before the end of five business days after receiving the dispute. The notice must include "all relevant information regarding the dispute" the agency received. The FTC explains that the business must then investigate and report back. If it finds its information inaccurate, it "must notify all three nationwide credit bureaus."
According to the CFPB summary, information that is inaccurate, incomplete or unverifiable "must be removed or corrected, usually within 30 days." An agency may continue to report information it has verified. The CFPB's page on disputing an error says the agency must report the results back to the consumer. That page also describes explaining the error in writing, including supporting documents, and keeping copies. A walkthrough for one bureau appears on this site's page on disputing Experian report errors.
A mixed file is a report that contains another person's information, often accounts belonging to someone with the same or a similar name. A consumer may dispute mixed-file entries through the same process. If the reinvestigation does not resolve the dispute, 15 U.S.C. § 1681i(b) lets the consumer file a brief statement setting forth the nature of the dispute.
How Long Information May Remain on a Consumer Report
Time limits on old negative information appear in 15 U.S.C. § 1681c(a). Except as another subsection of the statute authorizes, a consumer reporting agency generally may not report:
- bankruptcy cases that predate the report by more than 10 years, counted from the order for relief or the date of adjudication;
- civil suits, civil judgments and arrest records older than seven years from entry, or until the governing statute of limitations has expired, whichever is longer;
- paid tax liens more than seven years after payment;
- accounts placed for collection or charged to profit and loss that antedate the report by more than seven years, where the seven years begins 180 days after the delinquency that preceded the collection activity or charge-off (15 U.S.C. § 1681c(c)(1));
- any other adverse item older than seven years, except records of criminal convictions.
The list also includes rules on medical information furnishers and on certain veterans' medical debt. Under 15 U.S.C. § 1681c(b), paragraphs (1) through (5) of subsection (a) do not apply to a consumer credit report used in connection with a credit transaction involving, or reasonably expected to involve, a principal amount of $150,000 or more; the underwriting of life insurance involving, or reasonably expected to involve, a face amount of $150,000 or more; or the employment of an individual at an annual salary that equals, or may reasonably be expected to equal, $75,000 or more.
The FTC summarizes the general rule plainly: "As long as the information is correct, a credit bureau can report most negative information for seven years, and bankruptcy information for 10 years." For accounts placed for collection, the seven-year period in 15 U.S.C. § 1681c(a)(4) runs as 15 U.S.C. § 1681c(c)(1) describes, subject to the exceptions in 15 U.S.C. § 1681c(b).
The reporting limit is a separate rule from any deadline for suing on the debt itself. That deadline is set by other law. An item can drop off a report while the debt remains, and the reverse can also happen.
What Conduct the FCRA Prohibits and What the Law Makes Available When It Is Violated
Several kinds of conduct may violate the statute, depending on the conduct and the facts.
Consumer reporting agencies. An agency may violate the FCRA if it:
- reports obsolete items beyond the 15 U.S.C. § 1681c(a) periods;
- fails to complete a reasonable reinvestigation within the 15 U.S.C. § 1681i(a)(1) timeframe;
- fails to follow reasonable procedures to assure maximum possible accuracy;
- furnishes a report it has reasonable grounds to believe will not be used for a permissible purpose.
Furnishers. Under 15 U.S.C. § 1681s-2(a)(1), a person "shall not furnish any information relating to a consumer to any consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate." "Reasonable cause" means "specific knowledge, other than solely allegations by the consumer," that would cause a reasonable person substantial doubts. A furnisher that has been notified at its specified address that specific information is inaccurate also may not report it, if the information is in fact inaccurate.
Users. A user may violate the FCRA by obtaining a report without a permissible purpose, or by failing to give the required notice after an adverse action.
Remedies depend on the kind of failure. Under 15 U.S.C. § 1681n, a person who "willfully fails to comply" is liable for:
- actual damages, or damages of "not less than $100 and not more than $1,000";
- for a natural person who obtained a report under false pretenses or knowingly without a permissible purpose, actual damages or $1,000, whichever is greater;
- punitive damages the court may allow;
- in a successful action, costs and reasonable attorney's fees.
Under 15 U.S.C. § 1681o, negligent noncompliance generally makes available actual damages sustained as a result of the failure, plus costs and fees in a successful action, although under 15 U.S.C. § 1681s-2(c), sections 1681n and 1681o generally do not apply to a violation of subsection (a) of 15 U.S.C. § 1681s-2, which under 15 U.S.C. § 1681s-2(d) is enforced exclusively by the Federal agencies and officials and the State officials the FCRA identifies. Whether any of these applies turns on proof of the violation, its willfulness or negligence, and the harm it caused.
Under 15 U.S.C. § 1681p, an action must be brought by the earlier of two dates: two years after the violation is discovered, or five years after it occurs. Whether a particular situation violates the law depends on its facts. This site's page on consumer lawsuits under federal law covers that topic more broadly.
The FCRA and Background Checks for Employment
A job decision that turns on a background report is one of the most painful ways people meet the FCRA, and the law adds specific steps for it. Under 15 U.S.C. § 1681b(b)(1), a consumer reporting agency may furnish a report for employment purposes only if the employer certifies that it has followed the disclosure rules and will follow the adverse-action rules. The employer must also certify that the information will not be used in violation of equal employment opportunity laws. In addition, the agency must provide a summary of the consumer's rights.
Before obtaining the report, the employer generally must make "a clear and conspicuous disclosure" in writing "in a document that consists solely of the disclosure." The disclosure must state that a report may be obtained, and the consumer must authorize the report in writing; that authorization may be made on the disclosure document itself (15 U.S.C. § 1681b(b)(2)(A)). The FTC's page on employer background checks adds a caution: a person may say no, "but if you do, you may not get the job." The CFPB summary notes that written consent generally is not required in the trucking industry; consent is still required, however. Under 15 U.S.C. § 1681b(b)(2)(B) and (C), an applicant for a position over which the Secretary of Transportation has the power to establish qualifications and maximum hours of service, or a position subject to safety regulation by a State transportation agency, whose only interaction with the person procuring the report has been by mail, telephone, computer or similar means, must receive notice that a report may be obtained and may consent orally, in writing or electronically.
Before deciding not to hire, keep or promote someone because of the report, the FTC says the employer must give the person a copy of the report and a "Summary of Rights." After an adverse decision, the notice rules described earlier apply. The FTC also states that a person may get an additional free report from the background reporting company if they ask within 60 days of the employer's decision. A consumer may dispute inaccurate items with that company and ask it to send a corrected copy to the employer.
If You'd Like a Consumer Rights Case Review
FCRA questions rarely turn on one fact. They depend on who supplied the item, when the dispute reached the bureau, what the reinvestigation found, and whether a denial letter named the reporting company. This page does not cover state credit-reporting laws, which differ from state to state and may add protections. An overview of related federal laws appears on this site's page about a consumer rights attorney's role.
A reader may request a consumer rights case review through Federal Consumer Rights.
