What this answers
On this page
Your credit report is not public. Section 1681b of the Fair Credit Reporting Act lists the specific purposes for which a consumer report may be furnished, and obtaining one without a permissible purpose is a violation with its own liability.
The Permissible Purposes
The main ones:
- Credit transactions. A creditor considering whether to extend credit, or reviewing an existing account. This covers most legitimate pulls.
- Employment purposes. An employer considering you for hiring, promotion, reassignment, or retention, and only with your written authorization first.
- Insurance underwriting. An insurer deciding whether to issue or renew a policy, or setting a premium.
- A legitimate business need in connection with a transaction you initiated, such as a landlord running credit on your rental application.
- Account review. A creditor you already have an account with may periodically review your file as part of managing it.
- Child support enforcement by authorized government agencies.
- A valid court order or a federal grand jury subpoena.
Note the pattern. Almost every permissible purpose traces back to something you did: an application, an existing relationship, a transaction you began. That is the test worth carrying around, because it makes the impermissible cases easy to recognise.
What Is Not Permissible
Curiosity is not a purpose. Nobody may pull your report simply to see what is on it, and that holds however legitimate the person's job is.
Marketing is not a purpose on its own either. A company cannot pull your file to decide whether to market to you unless it is making a firm offer of credit or insurance that you could actually accept. That requirement is what separates a prescreened offer from a fishing expedition through consumer files.
Employment requires your written authorization, obtained first. There is no implied consent here, and an employer that runs a report without it has a problem regardless of what the report said or whether it hired you.
Personal reasons never qualify. An ex-spouse, a neighbour, a relative, or a former business partner has no right to your credit information, and the fact that one of them works somewhere with access to a credit database does not create one. That scenario, an employee using legitimate credentials for a personal reason, is one of the more common sources of genuinely unauthorized access.
Debt collection sits in between. Courts have recognised that collecting a debt can be a permissible purpose, but the facts matter, and a pull with no genuine collection or credit purpose behind it can be challenged. If you doubt a collector's basis, ask it to state its permissible purpose in writing. The request itself is useful, because the answer is either a defensible reason or a document you keep.
How to Spot Unauthorized Access
Your report has an inquiries section listing everyone who accessed it, and it is the part of the report most people skip. Read it line by line against your own memory of the period it covers.
What you are looking for is anything that does not correspond to something you did: a company you do not recognise at all, a creditor you never applied to, or several inquiries from one company with no application behind any of them. Store card inquiries from a retailer you have shopped at but never applied for credit with are worth a second look, and so is a cluster of inquiries in a short window, which is a common signature of someone shopping an application around in your name.
Hard and Soft Inquiries
A hard inquiry happens when you apply for credit. It can affect your score, generally stays on the report for about two years, and should match an application you actually submitted.
A soft inquiry happens when a company checks your file for a non lending purpose, such as an account review, a prescreened offer, or your own request for your report. Soft inquiries do not affect your score and are visible only to you.
Unauthorized access can show up as either. Do not dismiss a soft inquiry on the ground that it did no damage to your score, because the violation is the access, not the scoring effect.
There is also a reason to care about inquiries that has nothing to do with this: they age off after about two years, and the inquiry list is what proves a third party saw your file while bad information was on it. That is why saved, dated reports matter.
What You Can Do
- Dispute the inquiry with the bureau, identifying it and stating you did not authorize it
- Write to the company directly and ask it to state its permissible purpose, and to remove the inquiry if it cannot
- Note the timing. If the access lines up with a denial or worse terms, that connection is worth documenting now rather than reconstructing later
- Keep the reports showing the inquiry, because this is the category of evidence that disappears on its own
Reducing Your Exposure
- Place a security freeze. It stops new creditors from accessing your file at all, and it is free to place, lift, and remove.
- Pull your free reports from each nationwide bureau at AnnualCreditReport.com and actually read the inquiry section.
- Opt out of prescreened offers at optoutprescreen.com or 1-888-5-OPT-OUT, which reduces the soft inquiries and the live credit offers arriving in your mail.
What a Violation Is Worth
The question consumers reasonably ask is whether an unauthorized pull is worth pursuing when the score effect is trivial.
Obtaining a consumer report without a permissible purpose, or under false pretenses, violates 15 U.S.C. § 1681b(f), and liability falls on the party that obtained it. The claim does not depend on the inquiry having lowered your score, because the wrong is the access rather than the scoring consequence.
Where it becomes substantial is in the surrounding facts. A single unexplained pull is one thing. A former employer, an ex spouse with access through work, or a company that pulled repeatedly over months is another, and so is a pull that coincided with a denial or worse terms.
That is why the timing note matters more than the inquiry itself. Record what happened around the date while you remember it.
Asking a Company to Justify Itself
The letter is short and it does most of the work.
Identify the inquiry by the company name and the date exactly as the report shows them. State that you did not apply for credit with that company and did not authorise access to your report. Ask it to identify the permissible purpose under § 1681b on which it obtained the report, and to provide any authorization it relies on.
Send it certified mail and keep the receipt.
The answer resolves it one way or the other. A company with a legitimate purpose usually says so quickly, often explaining an account review or a prescreened offer you had forgotten. A company with no answer, or no reply at all, has created a useful document by its silence.
Common Questions
Who can legally pull my credit report?
Only parties with a permissible purpose under 15 U.S.C. § 1681b: creditors considering an application or reviewing an account, employers with your written authorization, insurers underwriting a policy, landlords in connection with a rental you applied for, agencies enforcing child support, and parties with a valid court order.
Can someone check my credit without permission?
Some permissible purposes do not require your separate consent, such as account review by a creditor you already have. Employment is the clearest exception: written authorization is required first.
Is it illegal to pull a credit report without a permissible purpose?
How do I find out who has pulled my report?
The inquiries section lists them. A full file disclosure also identifies everyone who received a report about you, generally for the past year and two years for employment purposes.
What is the difference between a hard and a soft inquiry?
A hard inquiry follows a credit application, can affect your score, and generally stays about two years. A soft inquiry comes from account reviews, prescreened offers, or your own requests, does not affect your score, and is visible only to you.
How do I dispute an unauthorized inquiry?
Dispute it in writing with the bureau and write separately to the company asking it to state its permissible purpose. Keep both letters and both responses.