The Fair Credit Reporting Act (FCRA) Explained: Your Rights in 2026

What Is the Fair Credit Reporting Act

The Fair Credit Reporting Act (FCRA) is a federal law codified at 15 U.S.C. Sections 1681 through 1681x. It was enacted in 1970 as Title VI of the Consumer Credit Protection Act (Pub.L. 90-321) and became effective 180 days after October 26, 1970. The statute regulates consumer reporting agencies (CRAs), the data furnishers who supply information to CRAs, and the users of consumer reports.

The FCRA exists to ensure that consumer reporting agencies handle credit data fairly, accurately, and with appropriate privacy protections. It establishes consumer rights, obligations for bureaus and data furnishers, and enforcement mechanisms through federal agencies and private lawsuits.

Key amendments:

• FACT Act 2003 (Pub.L. 108-159): Added identity theft protections, required credit score disclosure in certain transactions, established the Red Flags Rule.
• Dodd-Frank Act 2010 (Pub.L. 111-203): Transferred most rulemaking authority from the FTC to the Consumer Financial Protection Bureau (CFPB).
• Economic Growth, Regulatory Relief, and Consumer Protection Act 2018 (Pub.L. 115-174): Added veteran medical debt protections, including provisions requiring CRAs to delete fully paid veteran medical debt.

Source: Cornell LII, 15 U.S.C. Section 1681 (Full Text)

The Five Core Consumer Rights

The FCRA establishes five fundamental consumer rights. Every consumer in the United States has these rights regardless of their credit standing, immigration status, or any other characteristic. These rights cannot be waived except through specific written authorization from the consumer.

1. The right to know what is in your credit file
2. The right to dispute inaccurate or incomplete information
3. The right to have inaccurate information corrected or deleted
4. The right to know who has accessed your credit report
5. The right to free annual credit reports

Right 1: Know What Is in Your File

Under 15 U.S.C. Section 1681g(a), every consumer has the right to request and receive disclosure of all information in their credit file at the time of the request. This includes:

• All information in the file
• Sources of information (except investigative consumer report sources acquired solely for that purpose)
• The identity of every person who procured a consumer report about you, including for employment purposes (2-year lookback) and other purposes (1-year lookback)
• Dates, original payees, and amounts of any checks used as the basis for any adverse characterization in the file
• Record of all inquiries received during the prior year

Upon request, the CRA must also disclose the credit score if one exists in your file and the key factors that adversely affected your score. This disclosure must include the date the score was created, the name of the person or entity that provided the score, and a statement that the lender's score may differ from the score you received.Source: Cornell LII, 15 U.S.C. Section 1681g (Disclosures to Consumers)

Right 2: Dispute Inaccurate Information

Under 15 U.S.C. Section 1681i, every consumer has the right to dispute inaccurate or incomplete information in their credit file. The dispute process works as follows:

1. Consumer notifies the CRA of a dispute regarding specific information in the file.
2. The CRA must reinvestigate free of charge. The CRA must forward the dispute to the data furnisher (creditor) who reported the information within 5 business days of receiving the dispute.
3. 30-day investigation window. The CRA must complete its reinvestigation within 30 days. This period can be extended by up to 15 additional days if the consumer provides relevant new information during the initial 30-day window.
4. Furnisher must investigate. The creditor must investigate and report back to the CRA within the 30-day window. If the creditor fails to respond, the CRA must delete the disputed information.
5. Consumer statement. If the dispute is not resolved to the consumer's satisfaction, the consumer has the right to add a brief statement (up to 100 words, with CRA assistance required if the consumer needs help) to the file. This statement must be included in all future consumer reports containing the disputed item.

Critical protection against reinsertion: If information is deleted as a result of a consumer dispute, it cannot be reinserted into the file unless the furnisher certifies the information is complete and accurate, and the consumer must receive written notice before reinsertion.

Source: Cornell LII, 15 U.S.C. Section 1681i (Procedure in Case of Disputed Accuracy)

Right 3: Have Inaccurate Information Corrected or Deleted

The right to correction and deletion is established in Section 1681i(a)(5). If after reinvestigation the CRA determines that the information is inaccurate, incomplete, or cannot be verified, the CRA must promptly delete the item or modify it based on the results of the reinvestigation.

This is a mandatory obligation on CRAs, not a discretionary one. If the data cannot be verified, it must be removed. The burden of proof is on the data furnisher to demonstrate that information is accurate, not on the consumer to prove it is inaccurate.

Special rule for veterans: Under Section 1681i(g), if a veteran submits notice and documentation that the Department of Veterans Affairs is liable for a medical debt or is in the process of paying it, the CRA must delete the information. This provision was added by the 2018 Economic Growth Act.

Right 4: Know Who Has Accessed Your Report

Under 15 U.S.C. Section 1681g(a)(3), every consumer has the right to know the identity of every person or entity that has accessed their credit report. The CRA must identify:

• Every person who procured a consumer report for employment purposes during the 2-year period preceding the consumer's request
• Every person who procured a consumer report for any other purpose during the 1-year period preceding the request

Each identification must include the name of the person or company. Upon the consumer's request, the CRA must also provide the address and telephone number of the person or company.

National security exception: Federal agencies determining eligibility for classified information may be exempted from disclosure if the agency head makes a written finding that disclosure would endanger life or safety, result in flight from prosecution, destroy evidence, intimidate witnesses, compromise classified information, or seriously jeopardize an investigation.

Right 5: Free Annual Credit Reports

Under 15 U.S.C. Section 1681j, consumers are entitled to free annual credit reports from each nationwide CRA. The statute establishes one free report per 12 months from each CRA. The three bureaus and FTC subsequently made weekly free reports permanently available through AnnualCreditReport.com.

How to order: The only authorized website for free annual credit reports is AnnualCreditReport.com. You can also call 1-877-322-8228 or mail to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. The FTC warns against other websites claiming to offer free credit reports, many are marketing companies that charge for services available free through AnnualCreditReport.com.

Source: FTC, Free Credit Reports

Permissible Purposes: Who Can Get Your Report

Under 15 U.S.C. Section 1681b(a), a consumer reporting agency may furnish a consumer report only for the enumerated purposes and no other. This is one of the most important consumer protections in the FCRA, it limits the secondary use of credit data to specific, legitimate contexts.

The Main Permissible Purposes

• Credit transactions involving the consumer [Section 1681b(a)(3)(A)]: In connection with a credit transaction, including extension of credit, review, or collection of an account.
• Employment purposes [Section 1681b(a)(3)(B)]: For evaluating a consumer for employment, promotion, reassignment, or retention. Requires written disclosure to and written authorization from the consumer before procurement.
• Insurance underwriting [Section 1681b(a)(3)(C)]: In connection with the underwriting of insurance involving the consumer.
• Licenses or government benefits [Section 1681b(a)(3)(D)]: For determining eligibility for any license or other benefit granted by a governmental instrumentality required by law to consider the applicant's financial responsibility.
• Business transactions initiated by the consumer [Section 1681b(a)(3)(F)(i)]: In connection with a business transaction initiated by the consumer.
• Account review [Section 1681b(a)(3)(F)(ii)]: To review an account to determine whether the consumer continues to meet account terms.
• Court orders and subpoenas [Section 1681b(a)(1)]: In connection with a court order or subpoena from a Federal grand jury proceeding.
• Child support enforcement [Sections 1681b(a)(4) and 1681b(a)(5)]: For state or local child support enforcement agencies, with required certifications.

Employment, Additional Conditions

Under Section 1681b(b), before a consumer report can be procured for employment purposes:

• Written disclosure must be provided to the consumer
• Written authorization from the consumer must be obtained
• Before taking adverse action, the employer must provide the consumer with a copy of the report and a written description of consumer rights under the FCRA

Time Limits on Negative Information

Under 15 U.S.C. Section 1681c(a), CRAs may not report most negative information beyond specific time limits:

Note on the 7-year period start date: The 7-year period for most items begins on the expiration of the 180-day delinquency period before the account was placed for collection or charged off. This is a critical nuance. A charge-off that occurred in January 2020 might not fall off until July 2027 (180 days after January 2020 + 7 years).

Exemptions for high-value transactions: These time limits do not apply to credit transactions involving $150,000 or more, life insurance underwriting with a face amount of $150,000 or more, or employment at an annual salary of $75,000 or more.

Veterans medical debt (2018 amendment): Under Sections 1681c(a)(7) and 1681c(a)(8), medical debt related to hospital care less than one year old is excluded, and fully paid/settled veteran medical debt previously in collections is completely excluded from credit reports.

Source: Cornell LII, 15 U.S.C. Section 1681c (Requirements for Certain Disclosures)

Identity Theft and Fraud Alerts

Under 15 U.S.C. Section 1681c-1, consumers who have been or believe they may be victims of identity theft have additional rights and protections.

Three Types of Fraud Alerts

• Initial Fraud Alert [Section 1681c-1(a)]: Available to any consumer who has reason to believe they may become a victim of identity theft. Lasts a minimum of 1 year. No police report required. Consumer is entitled to 1 free disclosure of their file. The CRA must refer the alert to the other two nationwide CRAs within 1 business day.
• Extended Fraud Alert [Section 1681c-1(b)]: Requires an identity theft report (police report plus standardized FTC identity theft affidavit). Lasts 7 years. Consumer is entitled to 2 free file disclosures within 12 months. Consumer is excluded from credit offers not initiated by the consumer for 5 years.
• Active Duty Military Alert [Section 1681c-1(c)]: For active duty military consumers. Lasts a minimum of 12 months. Consumer is excluded from credit offers for 2 years. Consumer is entitled to 2 free disclosures within 12 months.

Security Freeze

Under Section 1681c-1(i), any consumer may place a security freeze on their credit file. A freeze prevents any new credit from being opened in the consumer's name without explicit PIN-based approval from the consumer.

• Available to any consumer free of charge
• Must be implemented within 1 business day (toll-free or electronic request)
• Must be implemented within 3 business days (mail request)
• CRA must confirm within 5 business days
• No charge to place, temporarily lift, or remove a freeze

Enforcement: Who Polices the Bureaus

The FCRA is enforced by a combination of federal agencies and state authorities. 15 U.S.C. Section 1681s establishes the enforcement framework.

Private Right of Action

Consumers have a private right of action under the FCRA. If a CRA, furnisher, or user of your credit report violates your rights, you may sue in federal or state court. Available remedies include:

• Actual damages (lost wages, emotional distress, out-of-pocket costs)
• Statutory damages up to $1,000 for negligent FCRA violations
• Punitive damages if the violation is willful
• Attorney's fees and court costs

Statute of limitations: 2 years from discovery of the violation or 5 years from the date of the violation.

How to File a Complaint

• CFPB: consumerfinance.gov/complaint/
• FTC: ReportFraud.ftc.gov
• Identity Theft: IdentityTheft.gov

Frequently Asked Questions

Sources Referenced

• Cornell LII, 15 U.S.C. Section 1681 (FCRA Full Text)
• Cornell LII, 15 U.S.C. Section 1681a (Definitions)
• Cornell LII, 15 U.S.C. Section 1681b (Permissible Purposes)
• Cornell LII, 15 U.S.C. Section 1681c (Time Limits on Negative Information)
• Cornell LII, 15 U.S.C. Section 1681i (Dispute Procedure)
• Cornell LII, 15 U.S.C. Section 1681c-1 (Identity Theft / Fraud Alerts)
• Cornell LII, 15 U.S.C. Section 1681s (Enforcement)
• FTC, Free Credit Reports
• FTC, FCRA Statute (March 2026 PDF)