The Credit Repair Organizations Act gives every credit repair customer a short list of hard rights: no payment before services are fully performed, a written contract describing exactly what will be done, a three business day cancellation window, and a ban on false promises. A company that violates the Act has an unenforceable contract.
The statute sits at 15 U.S.C. § 1679 and following, enacted in 1996 after a wave of credit repair fraud. Its advance fee ban in § 1679b(b) is the provision with teeth: a credit repair organization may not charge for any service until that service is fully performed.
This article covers what CROA requires, the violations that mark a bad operator, and the remedies available when a company breaks the rules. Whether any specific business falls under CROA's definitions involves legal judgments beyond a general guide; the consumer-side rights are the focus here.
Key takeaways
- Credit repair organizations may not collect payment before services are fully performed.
- A written contract with services, costs, and timeline is mandatory, plus a rights disclosure before signing.
- Every customer gets three business days to cancel without charge.
- Promising to remove accurate information, or advising a new credit identity, is illegal.
- Contracts that violate CROA are void, and consumers can sue for damages and fees.
- Everything a repair company can lawfully do, the consumer can do free under the FCRA.
Why does CROA exist?
Because the credit repair industry's founding business model was collecting large fees upfront for results it could not deliver, then disappearing. Congress responded by regulating the payment structure itself: if a company can only charge after performing, the pay-first-vanish-later model dies by statute.
The Act also targets the industry's two signature lies, that accurate information can be removed on demand and that a new credit identity can be manufactured, the second of which survives today as the CPN schemes dissected in the CPN scams guide.
What does CROA actually require?
The obligations map to the abuses they were written against, as the table shows.
| Requirement | Statutory home | Abuse it blocks |
|---|---|---|
| No payment until services fully performed | § 1679b(b) | Collect upfront, deliver nothing |
| No untrue or misleading representations | § 1679b(a) | Guaranteed deletions and score promises |
| No advising consumers to lie or alter identity | § 1679b(a) | CPNs and falsified disputes |
| Written rights disclosure before any contract | § 1679c | Customers unaware disputes are free |
| Written contract: services, cost, timeline | § 1679d | Vague open-ended monthly billing |
| Three business day cancellation right | § 1679e | High-pressure same-day signups |
The disclosure requirement deserves emphasis: before any contract, the company must hand over a statement of file rights that says, among other things, that the consumer may dispute inaccurate information directly with the bureaus at no charge. The industry is required by law to disclose that its core service is free elsewhere.
What do CROA violations look like in practice?
The monthly-fee subscription charged from day one is the most common gray-to-black zone, since fees collected before the promised services are fully performed sit in tension with the advance fee ban. Guaranteed deletion marketing, score promises, and pay-per-deletion pricing collected upfront are the cleaner violations.
The economics behind the subscription model, and what the fees actually buy, are dissected in why credit repair companies charge 2,400 dollars a year and the template-letter reality in the 2,400 dollar template letter scam.
Skip the paperwork. Lock in your spot.
CreditRefresh files the dispute, tracks the 30-day clock, and escalates to the CFPB automatically if the bureau misses the deadline.
What remedies does a wronged customer have?
Strong ones. A contract that fails CROA's requirements is void and unenforceable by the company, and § 1679g gives consumers a private right of action for actual damages or everything paid, whichever is greater, plus punitive damages, class actions, and attorney fees, with a five year limitations period.
Rights under the Act cannot be waived; a contract clause purporting to do so is itself a violation. The practical sequence for a burned customer: stop payments, demand a refund in writing citing the violation, complain to the FTC and state attorney general, and consult a consumer attorney with the contract in hand.
How can a consumer screen a credit repair offer?
Five questions sort the field quickly, and any wrong answer is the exit.
- Does any money move before services are performed? Advance fees violate the Act.
- Is anything guaranteed: deletions, score gains, timelines? Guarantees are the forbidden promise.
- Is there a written contract listing services, total cost, and duration before signing?
- Was the rights disclosure provided, including that disputes are free directly with the bureaus?
- Does the pitch involve a CPN, a new credit identity, or disputing accurate items as false? Walk away.
The FTC's plain-language guidance on spotting credit repair fraud is maintained at consumer.ftc.gov, and its enforcement record against the industry is the reason the screening questions are statutory rather than stylistic.
What can credit repair lawfully accomplish?
Exactly what the consumer can: dispute inaccurate, unverifiable, or obsolete information through the FCRA's channels, negotiate with creditors, and organize the paperwork. Done honestly, that is real work with real value for people without the time, and the dispute rights it runs on are free by statute.
What no one can lawfully do is remove accurate, verifiable, timely information, which is why the honest version of the industry sells labor and organization rather than outcomes. The realistic picture of what works is laid out in does credit repair actually work.
How does software-based dispute help fit the picture?
The self-help model keeps the consumer as the actor: tools like CreditRefresh analyze the reports, flag items with accuracy problems, and draft custom dispute letters that the consumer reviews, approves, and sends under their own FCRA rights. The rights exercised are the consumer's own, not a service performed on their behalf.
The structural difference matters for incentives too: a flat tool has no reason to stretch disputes across billable months, the conflict examined in why paying 2,400 dollars a year buys back federal rights.
Do state laws add anything on top of CROA?
Frequently. Many states layer their own credit services statutes over the federal floor: registration and bonding requirements, longer cancellation windows, fee caps, and state enforcement with its own penalties. A company barred in one state often resurfaces in another, which makes the state registry a worthwhile check.
The state attorney general's consumer division handles both the lookup and the complaint, and a company's reaction to being asked about its bond and registration is itself a useful screening result.
Frequently asked questions about CROA
Can a credit repair company charge a monthly fee?
Only for services already fully performed in that period, which is where many subscription models strain against the advance fee ban. Fees collected before the contracted services are delivered are the classic violation, and courts have voided contracts over exactly this structure.
Does CROA apply to lawyers and nonprofits?
The Act carves out genuine nonprofits and certain regulated entities, and courts have split on various business structures. The carve-outs are also where bad actors hide, so a nonprofit label deserves verification rather than deference.
What makes a credit repair contract void?
Any failure to comply with the Act's protections: advance fees, missing disclosures, no written contract, or a denied cancellation right. A void contract cannot be enforced against the consumer, and payments made under one are recoverable in a CROA action.
Is it illegal for a company to dispute accurate items?
Advising or assisting a consumer to make untrue statements to bureaus or creditors violates § 1679b(a). Disputing an item believed inaccurate is the lawful core of the work; manufacturing disputes against information known to be accurate is the violation.
How does someone report a CROA violation?
File with the FTC, the CFPB, and the state attorney general, attaching the contract and payment records. For recovery of money paid, the private right of action under § 1679g runs five years and includes attorney fees, which makes consumer attorneys receptive to documented cases.
Last reviewed: June 2026
This article is for educational purposes only and does not constitute legal or financial advice. The Fair Credit Reporting Act and related regulations are complex, and outcomes depend on individual circumstances. Consumers with specific questions about their credit reports or rights under federal law should consult a licensed attorney or contact the Consumer Financial Protection Bureau directly.
