How the Fair Credit Reporting Act Protects Consumers: Rights, Disputes, and Enforcement

The 1970 Law That Controls What Banks Know About You

Before the Fair Credit Reporting Act became law in 1970, credit reporting agencies operated largely without oversight. Consumers had no right to see their own credit files, no mechanism to dispute errors, and no way to know why they'd been denied credit. Reports sometimes included information about mental health history, personal relationships, political views, and neighborhood assessments. A 1968 Senate subcommittee investigation found that credit bureaus maintained files on over 100 million Americans with virtually no accountability. The FCRA imposed the first comprehensive federal framework on this industry—one that governs over 200 million consumer credit files held by the three major bureaus (Equifax, Experian, and TransUnion) today.

What Information Credit Bureaus Can Report

The FCRA limits the types of negative information that can remain on a credit report and for how long—the so-called "7-year rule."

The 7-year clock for collections starts from the date of first delinquency on the original account—not the date the account was sold to a collector. This prevents the clock from resetting each time a debt is sold to a new collection agency, a practice that had kept old debts appearing on reports indefinitely before the FCRA was strengthened.

The Right to Dispute Inaccurate Information

Section 611 of the FCRA gives consumers the right to dispute any information they believe is inaccurate or incomplete. The dispute process has specific procedural requirements on both the consumer and the bureau.

• Consumers can dispute directly with the credit bureau (Equifax, Experian, TransUnion) online, by mail, or by phone
• The bureau must investigate and respond within 30 days of receiving the dispute (45 days if the consumer provides additional information)
• The bureau must forward the dispute to the original furnisher (the creditor or lender who reported the information)
• If the furnisher cannot verify the information, the bureau must delete or correct it
• The bureau must provide the consumer a written notice of results and a free copy of the corrected report if a change is made
• Consumers can also dispute directly with the furnisher under Section 623 of the FCRA

Disputing directly with the original creditor (furnisher dispute) is often more effective than disputing with the bureau alone—because the furnisher has the underlying account records that the bureau doesn't. A furnisher that receives a dispute must conduct a reasonable investigation and report corrections to all bureaus where it furnished the information.

Adverse Action Notices: Your Right to Know Why

Any time a creditor, employer, landlord, or insurer takes an adverse action based in whole or in part on information in a consumer report, FCRA requires them to notify the consumer.

• Credit adverse action notices must include: the name and contact info of the bureau that provided the report, a statement that the bureau did not make the decision, the consumer's right to a free copy of the report within 60 days, and the right to dispute accuracy
• Credit score disclosure is required when a score was used in the decision: the score used, the date it was pulled, the score range, and up to four key factors that most affected the score
• Employment adverse action based on a background check requires two notices: one before the adverse action (with a copy of the report and summary of rights) and one after
• Insurance adverse action based on a credit-based insurance score requires notice of the right to a free copy of the report

Free Annual Credit Reports

The FCRA's Section 612 requires that credit bureaus provide consumers with one free credit report every 12 months upon request. AnnualCreditReport.com—the federally mandated website—is the only official source for this right. During the COVID-19 pandemic, the bureaus voluntarily offered free weekly reports, a practice they continued through late 2023 before reverting to weekly access for a fee for most consumers.

CFPB Enforcement and Penalties

The Consumer Financial Protection Bureau, created by the Dodd-Frank Act in 2010, assumed enforcement authority over large credit bureaus (those with more than $7 million in annual receipts). The Federal Trade Commission retains authority over smaller entities and shares enforcement with the CFPB. Individual consumers can also sue for FCRA violations under a private right of action.

• Willful FCRA violations: actual damages or statutory damages of $100–$1,000 per violation, plus punitive damages and attorney's fees
• Negligent FCRA violations: actual damages plus attorney's fees
• In 2022, the CFPB ordered TransUnion to pay $23 million in penalties for deceptive practices related to credit monitoring subscriptions and improperly marketing VantageScore as an equivalent to FICO scores
• Class action lawsuits are common when systemic errors affect large numbers of consumers; Trans Union and Equifax have each paid tens of millions in class action settlements

This article is for informational purposes only and does not constitute legal advice. The FCRA is a complex statute with specific procedural requirements. Consult a consumer rights attorney if you believe your FCRA rights have been violated.