Your Credit Report Rights Under the FCRA, FDCPA and CROA
Your credit report rights in plain English: free reports, 30-day disputes, debt validation and credit repair protections under the FCRA, FDCPA and CROA.
The short answer
Under the Fair Credit Reporting Act you can see your credit reports for free, dispute errors and have them investigated within 30 days, and sue for violations; under the Fair Debt Collection Practices Act you can demand that a collector validate a debt and stop harassment; and under the Credit Repair Organizations Act a credit repair company cannot charge you before doing the work and must let you cancel within 3 business days. These rights are written into federal statutes, so they stay in force regardless of CFPB staffing or budget.
- The FCRA (15 U.S.C. 1681 to 1681x) covers what goes on your credit report, who can see it and how errors get fixed.
- A credit bureau must investigate a dispute within 30 days, extended to 45 days in some cases (15 U.S.C. 1681i and 1681j(a)(3)).
- The FDCPA (15 U.S.C. 1692 to 1692p) gives you 30 days to request validation of a debt from a collector (1692g).
- CROA (15 U.S.C. 1679 to 1679j) bans credit repair fees before services are performed and gives you 3 business days to cancel.
- Each law lets you sue for violations and recover attorney's fees, and the FTC and state attorneys general also enforce them.
Three federal laws protect you when it comes to credit reports: the Fair Credit Reporting Act, the Fair Debt Collection Practices Act and the Credit Repair Organizations Act. This guide lists each right in plain English with the section that creates it, so you know exactly what you can ask for and where to go when someone does not follow the law.
Your rights at a glance
| Right | Law and section | What it means for you |
|---|---|---|
| Free credit reports | FCRA, 15 U.S.C. 1681j | One free report per bureau every 12 months, and the bureaus now offer them weekly |
| See everything in your file | FCRA, 1681g | Every item, its source and who has pulled your report |
| Dispute errors | FCRA, 1681i | Bureau must investigate within 30 days (45 in some cases) |
| Dispute with the lender directly | FCRA, 1681s-2 | Lender or collector must investigate and fix its reporting |
| Old negatives removed | FCRA, 1681c | Most negatives drop off after 7 years, some bankruptcies after 10 |
| Fraud alerts and freezes | FCRA, 1681c-1 | Free alerts and free security freezes at each bureau |
| Identity theft blocks | FCRA, 1681c-2 | Fraudulent items blocked within 4 business days |
| Limits on who sees your report | FCRA, 1681b | Only those with a permissible purpose; employers need written consent |
| Adverse action notice | FCRA, 1681m | You are told when a report is used against you, and get a free copy |
| Debt validation | FDCPA, 1692g | Collector must verify a debt if you ask in writing within 30 days |
| Freedom from harassment | FDCPA, 1692c to 1692f | Limits on calls, contacts, threats and false statements |
| Credit repair protections | CROA, 1679 to 1679j | No fees before work, written contract, 3-day cancellation |
| Right to sue | FCRA 1681n and 1681o, FDCPA 1692k, CROA 1679g | Damages and attorney's fees for violations |
Fair Credit Reporting Act rights
The Fair Credit Reporting Act, passed in 1970, governs the three nationwide credit bureaus (Equifax, Experian and TransUnion), other consumer reporting agencies, and the lenders and collectors that send them data.
Free credit reports (1681j)
You are entitled to one free report from each nationwide bureau every 12 months through AnnualCreditReport.com, the only official site for free reports. The three bureaus now offer free reports there every week. You can also get a free report within 60 days of an adverse action notice, if you are unemployed and plan to look for work within 60 days, if you receive public welfare assistance, or if you believe your file contains errors due to fraud.
Full file disclosure (1681g)
When you ask with proper identification, a bureau must disclose all information in your file, the sources of that information, and who received your report in the past year (2 years for employment purposes). This is the "section 609" right. It is a right to information, not a right to have items deleted. Our 609 letter guide explains the difference.
Disputes with the credit bureaus (1681i)
If you dispute information as inaccurate or incomplete:
- The bureau must notify the furnisher within 5 business days and pass along your documents.
- It must finish a reasonable investigation within 30 days, or up to 45 days if you send more information during the 30 days or dispute after getting your free annual report (1681j(a)(3)).
- It must correct or delete information that is inaccurate, incomplete or cannot be verified.
- It must send you the results within 5 business days of finishing, with an updated report if anything changed.
- If you ask, it must describe how it verified an item, including the furnisher's contact information, within 15 days.
- It cannot put a deleted item back unless the furnisher certifies it is accurate, and it must tell you in writing within 5 business days if it does.
- If you still disagree, you can add a brief statement of dispute that appears on future reports (1681i(b) and (c)).
- You can ask the bureau to send corrections to anyone who received your report in the past 6 months, or 2 years for employment (1681i(d)).
A bureau may decline a dispute it reasonably finds frivolous, such as one with no new information, but must tell you within 5 business days and explain why. Step-by-step instructions and a sample letter are in how to dispute negative items on your credit report.
Disputes with lenders and collectors (1681s-2)
Companies that furnish information to the bureaus must not report information they know or have reasonable cause to believe is inaccurate (1681s-2(a)(1)). If you dispute directly with a furnisher at its dispute address, it generally must investigate within the same 30-day window and correct its reporting to every bureau if it was wrong (1681s-2(a)(8) and 12 CFR 1022.43). While a dispute is open, it cannot report the item without noting that you dispute it (1681s-2(a)(3)). When a bureau forwards your dispute, the furnisher must investigate under 1681s-2(b).
Note that a private lawsuit against a furnisher generally must be based on its duties after a bureau forwards your dispute, so disputing through the bureau as well as directly keeps your options open.
Time limits on negative information (1681c)
| Item | How long it can report |
|---|---|
| Late payments | 7 years |
| Collections and charge-offs | 7 years, starting 180 days after the delinquency began (1681c(c)) |
| Bankruptcy | Up to 10 years from the order for relief; the bureaus remove Chapter 13 after 7 by policy |
| Other adverse items | 7 years |
| Hard inquiries | About 2 years in practice |
These limits do not apply to credit or life insurance applications of $150,000 or more, or jobs paying $75,000 or more a year (1681c(b)).
Fraud alerts, freezes and identity theft (1681c-1, 1681c-2)
- Initial fraud alert: free, lasts 1 year. Placing it with one bureau notifies the other two.
- Extended fraud alert: free, lasts 7 years with an identity theft report.
- Active duty alert: free, lasts 1 year for service members.
- Security freeze: free to place and lift at each bureau. Requests by phone or online must be placed within 1 business day and lifted within 1 hour.
- Identity theft block: with an identity theft report from IdentityTheft.gov, the bureau must block fraudulent information within 4 business days.
Who can see your report (1681b and 1681m)
A bureau can share your report only with someone who has a permissible purpose, such as a lender reviewing your application, a landlord, an insurer or an employer with your written permission. Before an employer takes action based on your report, it must give you a copy and a summary of your rights (1681b(b)(3)). You can opt out of prescreened credit offers for 5 years or permanently at OptOutPrescreen.com. When a report leads to a denial or worse terms, the company must send an adverse action notice naming the bureau, and you can get a free copy within 60 days (1681m).
Your right to sue (1681n, 1681o, 1681p)
For willful violations you can recover actual damages or statutory damages of $100 to $1,000, plus punitive damages and attorney's fees. For negligent violations you can recover actual damages and attorney's fees. You generally must file within 2 years of discovering the violation and no more than 5 years after it occurred. If you believe your rights were violated, consult an attorney for your situation. You can also read about FCRA lawsuits and credit report rights.
Want a specialist to handle this for you?
We write and send the challenges, follow up with creditors, and track every bureau response. Plans from $79.99 a month with a 90-day money-back guarantee.
Fair Debt Collection Practices Act rights
The FDCPA applies to third-party debt collectors (not, in most cases, the original lender). The CFPB's Regulation F, 12 CFR part 1006, adds detail.
- Validation notice (1692g). Within 5 days of first contacting you, the collector must send a notice with the amount, the creditor and your rights.
- Validation request (1692g(b)). If you dispute the debt or ask for the original creditor's name in writing within the 30-day validation period, the collector must stop collecting until it mails you verification.
- Time and place (1692c(a)). No calls before 8 a.m. or after 9 p.m. your local time, no contact at work if you say your employer prohibits it, and no contact with you directly if it knows you have a lawyer.
- Stop contact (1692c(c)). If you tell a collector in writing to stop contacting you, it must stop, except to confirm it is stopping or to notify you of a specific action like a lawsuit.
- Privacy (1692c(b)). A collector generally cannot discuss your debt with third parties other than your spouse or attorney.
- No harassment (1692d). No threats, abusive language or repeated calls meant to annoy. Under Regulation F, more than 7 calls in 7 days about a debt is presumed to be harassment (12 CFR 1006.14).
- No false statements (1692e). A collector cannot lie about the amount, threaten action it cannot or will not take, or report credit information it knows is false. If it reports a debt you have disputed, it must report it as disputed (1692e(8)).
- No unfair practices (1692f). It cannot collect amounts not allowed by your agreement or by law.
- No reporting before contact. Under Regulation F, a collector cannot report a debt to a credit bureau before it has communicated with you about it (12 CFR 1006.30(a)).
You can sue for actual damages, statutory damages of up to $1,000 and attorney's fees, generally within 1 year of the violation (1692k). For collection-specific steps, see what to do if a debt collector never sent a written notice.
Credit Repair Organizations Act rights
CROA protects you when you pay a company to improve your credit.
- Rights disclosure first (1679c). Before you sign, the company must give you a written statement titled "Consumer Credit File Rights Under State and Federal Law," which says you can dispute errors yourself.
- Written contract (1679d). It must state the total cost, a full description of services, the time frame and the company's name and address.
- No fees before work (1679b(b)). The company cannot charge or receive payment for any service before it is fully performed.
- Three-day cancellation (1679e). You can cancel within 3 business days for any reason, using a form the company must provide.
- No false claims (1679b(a)). The company cannot make untrue or misleading statements, or advise you to give false information to a bureau or creditor, or to change your identity to hide your history.
- No waivers (1679f). Any waiver you sign is void.
- Right to sue (1679g, 1679i). You can recover the greater of actual damages or what you paid, plus punitive damages and attorney's fees, generally within 5 years.
Companies that sell credit repair by phone must also follow the FTC's Telemarketing Sales Rule, which bars fees until promised results are documented. Our guide to legitimate credit repair companies shows how to apply these rules when choosing a company, and is credit repair still regulated covers recent enforcement.
Do these rights depend on the CFPB
No. Each right above comes from a statute passed by Congress, and only Congress can change it. The CFPB writes rules, supervises large companies and brings enforcement cases, and it still accepts complaints. If its capacity shrinks, federal enforcement may slow, but:
- Bureaus and furnishers still owe you the same investigations and deadlines.
- The FTC still enforces the FCRA, FDCPA and CROA for many companies.
- State attorneys general can enforce these laws and their own state laws.
- Your private right to sue, with attorney's fees, is in each statute.
Where to complain
| Problem | Where to go |
|---|---|
| Credit bureau error or slow investigation | The bureau first, then the CFPB and your state attorney general |
| Lender or collector reporting wrong information | The furnisher's dispute address, then the CFPB |
| Debt collector harassment | The CFPB, the FTC and your state attorney general |
| Credit repair company charging upfront or misleading you | The FTC, the CFPB and your state attorney general |
| Identity theft | IdentityTheft.gov and each bureau |
Keep copies of every letter, receipt and response. They support your complaint and any later legal claim. People comparing financial providers can also research consumer credit and finance providers before committing.
Using your rights
You can use every right in this guide yourself, at no cost. Credit Saint uses the FCRA dispute process on behalf of clients, sending challenges to all three bureaus and letters to creditors for the items they authorize, with plans from $79.99 a month and a 90-day money-back guarantee. We cannot promise that any item will be removed, and accurate items that are verified stay on your report. You can see how it works for details.
Frequently asked questions
What are my rights under the Fair Credit Reporting Act?
You can get your credit reports for free, learn what is in your file and who has seen it, dispute inaccurate or incomplete information, have outdated negative information removed after the legal period, place fraud alerts and free security freezes, and sue for violations. Access to your report is limited to people with a permissible purpose.
How long does a credit bureau have to investigate a dispute?
Thirty days from receiving it under 15 U.S.C. 1681i. The deadline extends to 45 days if you send more information during the investigation or if you dispute after receiving your free annual report. The bureau must send you the results within 5 business days after finishing.
Will my credit report rights go away if the CFPB is cut back?
No. The FCRA, FDCPA and CROA are federal statutes passed by Congress, and only Congress can change them. The bureaus' duty to investigate, your right to free reports and your right to sue all come from the statutes. Fewer CFPB staff can slow federal enforcement, but the FTC, state attorneys general and private lawsuits still enforce these laws.
Can I sue a credit bureau or lender for errors?
Yes. Under 15 U.S.C. 1681n you can recover actual damages or statutory damages of $100 to $1,000 for willful violations, plus punitive damages and attorney's fees, and under 1681o actual damages and fees for negligent violations. Suits generally must be filed within 2 years of discovering the violation and 5 years of it happening. Consult an attorney for your situation.
What rights do I have when a debt collector contacts me?
You can ask for validation of the debt in writing within 30 days of the collector's notice, and it must pause collection until it responds. You can tell it in writing to stop contacting you. It cannot call before 8 a.m. or after 9 p.m. your time, harass you, lie about the debt or report information it knows is false.
How often can I get a free credit report?
The FCRA guarantees one free report from each nationwide bureau every 12 months through AnnualCreditReport.com, and the three bureaus now offer free reports there every week. You also get a free report within 60 days of an adverse action notice and in certain other situations.
What protections do I have when I hire a credit repair company?
Under CROA the company must give you a written disclosure of your rights and a written contract with the total cost and services, may not charge before the work is fully performed, must let you cancel within 3 business days and may not make false claims. Any waiver of these rights is void.
What is the difference between disputing with a bureau and a furnisher?
A bureau dispute triggers the bureau's investigation under 15 U.S.C. 1681i, and the bureau then forwards it to the furnisher, which must investigate under 1681s-2(b). A dispute sent straight to the furnisher triggers its separate duty to investigate under 1681s-2(a)(8). Filing both can help when the error started with the lender.
This article is for educational purposes and isn't legal advice. Credit Saint is a credit repair organization. Results vary, and no credit repair company can promise a specific outcome or score change.
Start your credit repair today
Plans from $79.99 a month. Every plan includes the 90-day money-back guarantee.