Who Is Allowed to Pull Your Credit Report? Fewer People Than You Think.

Your credit report contains an unusually detailed picture of your financial life: every loan, every card, every late payment, every address, every employer. The Fair Credit Reporting Act treats that information as sensitive, and it limits who can see it and why. A business that accesses your report without a legally recognized reason has committed a violation, whether or not anything bad happened as a result.

The Permissible Purpose Requirement

Under 15 U.S.C. § 1681b, a consumer reporting agency may furnish a report only for one of the purposes the statute lists, and a person may obtain a report only for one of those purposes. The main ones are:

• In connection with a credit transaction you initiated, or the review or collection of an account you have
• For employment purposes, with your written authorization
• In connection with underwriting insurance involving you
• To determine your eligibility for a government license or benefit
• For a legitimate business need in connection with a business transaction you initiated, or to review an account to determine whether you continue to meet its terms
• In response to a court order or a subpoena from a federal grand jury
• With your written instructions

Notice what is not on the list: curiosity, a dispute with a neighbor, an ex-spouse checking up on you, a landlord who is not actually processing your application, or a company you have never dealt with. Those are not permissible purposes.

How to Tell Who Has Pulled Your Report

Your credit report includes a section listing inquiries — every party that has accessed your file, usually over the prior two years. "Hard" inquiries are those made in connection with a credit application and can affect your score. "Soft" inquiries, such as account reviews by existing creditors and prescreening, do not affect your score but still appear on the version of the report you receive. If you see an inquiry from a company you don't recognize and never applied to, that is a red flag.

Employment: The Special Rules

Employers are allowed to use consumer reports in hiring and personnel decisions, but the FCRA imposes strict procedural requirements at 15 U.S.C. § 1681b(b) that employers routinely violate:

• Standalone disclosure. Before obtaining a report, the employer must give you a clear and conspicuous written disclosure, in a document that consists solely of that disclosure, that a consumer report may be obtained for employment purposes. Burying this in a job application or a broader release form does not satisfy the requirement.
• Written authorization. You must authorize the report in writing.
• Pre-adverse action notice. Before taking any adverse action based on the report — not hiring you, not promoting you, terminating you — the employer must give you a copy of the report and a copy of the CFPB's summary of your rights, and give you a reasonable time to respond. This is your chance to dispute errors before the decision is final.
• Adverse action notice. After taking adverse action, the employer must notify you, identify the reporting agency, and inform you of your right to dispute the report and to obtain a free copy.

California adds its own restrictions. Under Cal. Labor Code § 1024.5, most California employers are prohibited from using credit reports for employment purposes at all, except for a limited set of positions such as managerial roles, positions with access to certain financial information, and law enforcement. If a California employer pulled your credit for a job that does not fit one of the exceptions, that is a problem for the employer.

Tenant Screening

Landlords may obtain tenant screening reports in connection with a rental application, and California requires a landlord who charges an application screening fee to provide you a copy of the report on request. See Cal. Civ. Code § 1950.6. If a landlord rejects you based on a report, the FCRA's adverse action notice requirements under 15 U.S.C. § 1681m apply, and you are entitled to a free copy of the report from the agency.

What You Can Recover

Obtaining a consumer report under false pretenses or without a permissible purpose is one of the FCRA's more serious violations. Under 15 U.S.C. § 1681n(a)(1)(B), a person who obtains a report under false pretenses or knowingly without a permissible purpose is liable for actual damages or $1,000, whichever is greater — a higher floor than the general statutory damages range. Punitive damages and attorney's fees are also available for willful violations. Negligent violations are actionable under § 1681o for actual damages and fees.

Employers who skip the required disclosures and notices face the same willful and negligent damages provisions. Because the disclosure requirement is so specific and so frequently botched, these claims are often brought on a class basis on behalf of every applicant who signed the same defective form.

What to Do

• Review the inquiries section of all three of your credit reports.
• For any inquiry you don't recognize, note the company name and date, and write to the bureau asking for the stated purpose of the inquiry.
• If an employer ran your credit, keep the disclosure and authorization forms you signed. If they were part of a larger document, that matters.
• If you were rejected for a job or an apartment, keep every notice you received, and note whether you received a copy of the report before the decision.

The Bottom Line

Access to your credit report is a privilege the law grants for specific reasons. An unexplained inquiry, an employer who never gave you a standalone disclosure, or a rejection with no notice can each be the basis of a claim. Check your reports and keep the paperwork.