A Guide to the Fair Credit Reporting Act (FCRA)

The Fair Credit Reporting Act (FCRA) is a law that regulates consumer reports and consumer reporting agencies.

The FCRA:

• gives consumers more access to the information that is being reported about them
• prohibits others from viewing our consumer reports without permissible purpose
• entitles consumers to get copies of their consumer reports and credit scores at any time
• gives consumers the right to dispute inaccurate information being reported about them in their consumer report
• and much more

The Fair and Accurate Credit Transactions Act (FACTA) is an amendment to the FCRA, and entitles consumers to a free consumer report from each consumer reporting agency (CRA) once a year.

Here is a consumer-friendly summary of the most relevant portions of the FCRA, so you'll gain an understanding of your rights and the obligations placed upon the credit reporting agencies. This summary begins with an explanation of terms:

Explanation of terms

Consumer reports - Section 603 (d)

• A consumer report typically includes:
  • a consumer’s debt, credit limits, and monthly payment history
  • public record information, like bankruptcies, tax liens, and court judgments
  • collection accounts indicating current or past unpaid debts
  • inquiries from creditors and other businesses who have pulled the consumer report in the recent past
• It must be a written, oral, or electronic communication issued by a credit reporting agency (CRA) that bears on a consumer’s credit worthiness, character, or reputation which is used when deciding to extend credit or insurance for personal, family, or employment purposes
• Banks, lenders and retailers are not legally required to report account information about a consumer to the CRAs to be included on a consumer report, but if they do provide this information it must be in compliance with the FCRA
• Consumer reports cannot contain information on the mental or physical medical history or status of the consumer

Consumer reporting agency (CRA) – Section 603 (f)

A person or agency that regularly assembles and evaluates consumer credit information and provides that information to others who use it to judge a consumer’s credit worthiness.

Reseller

A CRA that assembles consumer information from other CRA(s), and provides consumer information to a third party. A reseller does not maintain its own database but rather uses the data from another CRA.

Identity theft

A fraud committed by using the personal identifying information of another person.

Identity theft report

A report that alleges an identity theft. Should be a copy of an official, valid report filed with a federal, state, or local law enforcement agency. An ID Theft Report is most typically a police report, but can also come from the Federal Trade Commission, the State Attorney General, the US Secret Service, US Postal Service, or the Federal Bureau of Investigation. If you file an Identity Theft Report with false information, you will be subject to criminal penalties.

With an ID Theft Report, you can place an extended fraud alert, which will block the reporting of the fraudulent data.

When a consumer report is NOT a credit report – Section 603 (d)(2)

Not all information communicated by the CRA is a consumer report, and is therefore not subject to the regulations of the FCRA. Information is not a consumer report when it is:

• gathered for marketing purposes by a CRA
• warehoused in the CRA’s non-consumer reporting databases
• communicated by a CRA but used for other purposes, like marketing, not related to consumer reporting
• compiled and furnished on a business, not a consumer

Information issued by a bank, lender, or other financial institution that bears on a consumer’s credit worthiness is not considered a consumer report, because it was not compiled by a CRA.

When CRAs can share your consumer report - Section 604

The FCRA does not require CRAs to distribute consumer reports, but rather limits the circumstances in which CRAs can distribute consumer reports. Those circumstances are as follows:

• Under court-order signed by a judge, or in response to a federal grand jury subpoena.
• With the written permission of the consumer.
• When the information will be used:
  • by a lender, bank, or other institution to determine whether to extend credit to the consumer
    • (a spouse’s consumer report may also be pulled if the spouse will be a joint user of the account, or if the applicant will be relying on a spouse’s income to pay on the account)
  • by an employer to help with the hiring decision, under the following conditions:
    • the employer must disclose (in a standalone document) to the consumer that a consumer report will be pulled
    • the consumer must authorize in writing that the consumer report can be pulled
    • if the employer denies employment to the consumer due to adverse information found in the consumer report, the employer must provide a copy of the consumer report and a summary of consumer rights under the FCRA to the consumer
    • if public record information exists on the report, the CRA must notify the consumer that the employer has pulled the report (including the name and address of the employer) OR the CRA must verify the public record information is complete and up to date (Section 613)
• in connection with the underwriting of insurance to the consumer
• by a government agency to determine the consumer’s eligibility for governmental benefits (for example, a state welfare office to determine if a welfare recipient is eligible for assistance)
• by the consumer’s current creditors and insurers to re-assess his or her existing credit worthiness and to determine whether the consumer still meets the agreed-upon terms of the account
• by anyone else with a legitimate business transaction in which the consumer has initiated, which includes:
  • landlords to determine a potential renter’s credit worthiness
  • car dealers to determine a potential car leaser’s credit worthiness
  • financial institutions to determine new savings and checking account customers’ credit worthiness
  • individuals that plan to enter a partnership
• state or local child support enforcement authority to establish a consumer’s capacity to make child support payments, under the following conditions:
  • paternity of the consumer has been established
  • consumer has been notified 10 days ahead of time
  • the consumer report will be kept confidential and solely used to establish the capacity to make child support payments

Consumers can “opt out” – Section 604 (e)

Consumers can “opt-out” of having their names included on lists provided by CRAs to marketers for prescreened offers of credit or insurance.

• Each CRA must maintain an address and toll-free number that consumers can write to or call to opt-out.
• CRAs that compile and maintain information on consumers on a nationwide basis must maintain a joint opt-out system. Consumers can visit OptOutPrescreen.com to have their names removed from the national CRA prescreened lists.
• CRAs must remove consumer names from prescreened lists within 5 days of receiving a consumer opt-out notification.

What CAN’T be included on a consumer report – Section 605 (a)(b)

• Bankruptcies older than 10 years (though most CRAs don’t report Chapter 13 bankruptcies more than 7 years)
• Civil suits, judgments, and records of arrest older than 7 years or older than the statute of limitations allows (whichever is longer)
• Tax liens that have been paid for more than 7 years (unpaid tax liens can be reported indefinitely)
• Collection accounts and charge-offs older than 7 years
• Any other negative information (other than criminal convictions) older than 7 years
• The name, address, and phone number of any medical information furnisher
• Exception: The above information CAN be included on a consumer report provided to the following persons:
  
  • an employer, if the applicant will be earning more than $75,000 a year
  • a life insurer who will be underwriting a policy worth $150,000 or more
  • a lender who will be lending $150,000 or more
• Note: the above restrictions specify maximum time periods that adverse information can be included on a consumer report. CRAs can legally drop adverse information from a consumer report earlier than the time periods specified above. Positive information can stay on a consumer report indefinitely.

What MUST be included on a consumer report – Section 605 (d)(e)(f)

• If the consumer report includes a credit score, and that credit score is adversely affected by the number of inquiries listed, the report must state that the number of inquiries is adversely affecting the score
• If an account was voluntarily closed by a consumer and the CRA was notified of this voluntary account closure, the CRA must report that fact in the consumer report
• Consumer-disputed information must be listed as such in the consumer report

If a consumer report causes adverse action – Section 615

A creditor or other person who takes adverse action (such as denies a loan) partly or entirely based on information found in a consumer report must provide to the consumer:

• notice that adverse action was taken
• the name and contact information of the CRA that furnished the consumer report containing the adverse information (making it clear that it was not the CRA who made the adverse decision but rather the creditor)
• a summary of the consumer’s right to obtain a free copy of the consumer report within 60 days from the CRA that furnished it
• a summary of the consumer’s right to dispute with a CRA any inaccurate information listed on the consumer report

CRAs must share credit file information with consumers – Section 609 (a)

• The information CRAs share with consumers is referred to as a “consumer disclosure,” not a “consumer report”
• CRAs must share all of the information on file for a consumer (minus the first 5-digits of the Social Security number if requested by the consumer)
• CRAs must include the name of the information furnishers (except the sources of investigative report information used primarily in insurance reporting)
• CRAs must provide the consumer with a list of each entity (except government agencies investigating national security matters) that has pulled the consumer report for employment purposes during the last two years or for any other purpose during the last year
• CRAs must tell consumers they have the right to request and obtain a credit score if they only requested a consumer report

Consumers must be given a summary of their rights – Section 609 (c)

With each disclosure, a CRA must provide the consumer with a summary of consumer rights, which should include:

• a description of the FCRA and consumer rights listed therein, including the right to:
  • obtain a copy of a consumer report from each CRA
  • obtain a free consumer report once a year from each CRA
  • dispute information on a consumer report
  • obtain a credit score from a CRA
  • contact a CRA via a toll-free phone call during normal business hours
• an explanation of how a consumer can exercise the above-mentioned rights
• a list of federal agencies responsible for enforcing the FCRA

CRAs have the right to keep negative information on a consumer report unless it is outdated (see Section 605) or cannot be verified.

CRAs have the right to only share with a consumer the information from his or her own credit file. This means a consumer cannot obtain the credit file information for his or her spouse, child, family member or friend without power of attorney.

How and when a consumer can request a report – Section 610

• CRAs must require consumer’s proper identification (which the FCRA does not define) before releasing a consumer report.
• CRAs should generally provide a consumer report in writing, but can also provide a consumer report in person, over the telephone, or by electronic means, if authorized by the consumer.

Disputing errors – Section 611

When a CRA receives a dispute from a consumer, it must take steps to investigate the error. This investigation must be done in a timely manner and at no cost to the consumer.

• CRAs have 30 days to investigate a dispute (or 45 days if investigating a dispute included on a free annual disclosure). Within that time period, they must either verify the information as accurate, or drop it from the report.
• CRAs have 5 business days from the time they receive a dispute to notify the furnisher of the disputed information.
• CRAs can rule disputes to be frivolous if the consumer provides insufficient information to investigate the dispute.
• If a CRA finds the disputed information to be inaccurate or cannot verify its accuracy, it must delete it from the consumer report.
• Once the CRA removes information from a report, it can only be reinserted if the furnisher provides it again to the CRA. If the information is reinserted, the CRA must notify the consumer within 5 business days of reinsertion, including the name and address of the furnisher.
• CRAs that report on a national level must implement an automated system for reporting the results of an investigation. All nationwide CRAs must share their findings with each other, so that inaccurate information will be dropped from all credit reports.
• CRAs must notify the consumer of the results of the investigation and include a copy of the consumer’s latest credit report, as well as a statement of the consumer’s right to add a statement to the consumer report.

Protection against identity theft – Section 615 (f), 605 (b), 623

These sections of the FCRA are designed to protect the consumer who has fallen victim to identity theft. They state that:

• a CRA must block information in a consumer report once the consumer has both:
  • proven his or her identity by providing proper documentation
  • and proven the information is fraudulent by providing an identity theft report
  • (Note that the above two steps are also required to place an extended fraud alert)
• A CRA must notify the furnisher of the information that the consumer has reported to be fraudulent
• The furnisher of the fraudulent information cannot place the account for collection or transfer or sell the debt
• The furnisher of the fraudulent information must take reasonable steps to make sure the information is not refurnished to the CRAs

Placing fraud alerts – Section 603

Nationwide CRAs must notify each other when they receive fraud alerts from consumers. This way, consumers don’t have to report fraud to all the nationwide CRAs, but only to one. To place any of the below alerts, the consumer must prove his or her identity to the CRA.

Alerts do not block information from being reported; they simply are statements included on the report indicating the possibility of identity theft. An alert on your credit report will ask creditors to contact you directly before extending credit in your name (which the creditor may or may not do).

If a CRA that does not report nationwide receives a fraud alert from a consumer, it must inform that consumer of the contact information of the nationwide CRAs, and information on how to report fraud to the FTC.

1. Initial alerts: Consumer can place a 90-day fraud alert on his or her consumer credit report. This initial alert can be removed before the 90-day time period at the consumer’s request. After a consumer places an initial fraud alert, the CRA must notify him or her of the right to request a free copy of his or her consumer report.
2. Extended alerts: Consumer can place a 7-year fraud alert (which can be removed before the end of the 7-year period at the consumer’s request). After receiving an extended fraud alert on a consumer’s report, the CRA must also remove the consumer from lists that it sells to third parties to offer credit or insurance to the consumer for a period of 5 years. The CRA must also notify the consumer of his or her right to receive 2 free credit reports within the first 12 months of filing an extended fraud alert
3. Active duty alerts: Relates to the consumer report of active duty military consumers. This type of alert remains for 12 months (unless the consumer requests it be removed earlier). After placing an active duty alert on a consumer’s report, the CRA must also remove the consumer from lists that it sells to third parties to offer credit or insurance to the consumer for a period of 2 years.

Information blocks – Section 605 (b)

A CRA must block any information identified by the consumer as fraudulent within 4 business days of being notified by the consumer. A CRA that reports nationwide must notify other national CRAs of the block. A CRA must also notify the furnisher of fraudulent information about the fraud. To block information, a consumer must:

• prove his or her identity
• provide a copy of an Identity Theft Report (as defined above in “Terms”)
• a consumer statement saying the information to be blocked was in no way initiated by the consumer
• (Note that some states also allow consumers to “freeze” their consumer reports to more fully protect against ID theft)