Who Can Legally Pull Your Credit Report?.

Only a party with a permissible purpose defined by federal law may access a consumer's credit report. That list includes a lender reviewing an application, a landlord, an insurer, certain employers with written consent, and an agency acting on a court order. Anyone else who pulls a report breaks the law.

The governing statute is the Fair Credit Reporting Act, specifically 15 U.S.C. § 1681b, known as Section 604 in the act's own numbering. It lists every permissible purpose in a closed set and bars a consumer reporting agency from releasing a file to anyone who cannot point to one of them.

This article addresses access to standard consumer credit reports prepared by the three nationwide bureaus. It does not cover the separate rules that govern specialty reports such as tenant or check-verification databases, nor the additional protections that some states layer on top of the federal floor for their own residents.

Key takeaways

• Permissible purpose is the legal gate for every credit report pull, set out in FCRA Section 604.
• Common permissible purposes include a credit application, account review, insurance underwriting, employment screening, and a court order.
• An employer must obtain written authorization before requesting a report and follow extra notice steps under Section 604(b).
• A pull without permissible purpose can expose the puller to civil liability under FCRA Sections 616 and 617, with statutory damages available even absent a proven dollar loss.
• An unauthorized hard inquiry tied to fraud can be removed through the bureaus, and a free security freeze blocks most new-credit pulls before they happen.

What does permissible purpose mean under the FCRA?

Permissible purpose is the legal standard a company must satisfy before a credit bureau will release a consumer's file. The Fair Credit Reporting Act treats credit data as sensitive and presumes it is off limits unless one specific, listed reason in the statute applies to the request being made.

Congress wrote the rule into the law in 1970 to end the indiscriminate sharing of credit files that had become common. A consumer reporting agency that hands over a file without first confirming a permissible purpose violates federal law, regardless of who made the request or how routine it seemed.

The practical effect is a closed list. If a requester cannot point to one of the purposes Congress named, the bureau is supposed to refuse, and a pull that happens anyway is unauthorized from the start rather than a mere technicality.

Who is allowed to pull a credit report?

The statute names the parties that qualify. Most pulls fall under a credit transaction the consumer started, a review of an existing account, or a written authorization the consumer signed. Insurers, certain employers, government licensing bodies, and courts make up the remaining categories.

• A lender or card issuer evaluating a new application or reviewing an existing account.
• A landlord or property manager screening a rental applicant for a lease.
• An insurer underwriting or setting the rate on a policy.
• An employer that holds the applicant's written consent, under Section 604(b).
• A court order, a federal grand jury subpoena, or a child-support enforcement agency.
• A debt collector working a valid account, or an entity acting on the consumer's written instruction.

Each of these ties back to a concrete relationship or transaction. The common thread is that the consumer either initiated the interaction, consented to it, or is subject to a legal process that overrides the usual privacy default.

Does a creditor need written permission to check credit?

Not always. When a consumer submits a credit application, that act itself supplies the permissible purpose, so no separate signature is required. Written authorization becomes mandatory in the employment context and whenever a company relies on the consumer's direct instruction rather than a transaction the consumer began.

Prescreened offers run on a separate track. Under Section 604(c), bureaus may share limited data for firm offers of credit or insurance without the consumer starting anything. The consumer can opt out of those marketing lists at any time through the official industry opt-out service.

These prescreen and account-review pulls register as soft inquiries. They appear only on the consumer's own copy of the report and never affect a credit score, unlike the hard inquiry that a fresh application for credit generates and that other lenders can see.

Can an employer pull a credit report?

An employer can request a report, but only after clear written disclosure and the applicant's signed authorization. Section 604(b) adds duties no other user carries: before taking adverse action based on the report, the employer must provide the applicant a copy of it along with a summary of rights under the FCRA.

That pre-adverse-action step exists so an applicant can spot and correct an error before a hiring decision becomes final. An employer that skips the disclosure, the authorization, or the notice has violated the statute even if the underlying report was accurate.

Several states and cities restrict employer credit checks further, limiting them to roles that involve handling money or that require a security clearance. Local law can narrow what the federal floor otherwise permits, so the rules vary by jurisdiction.

Can a landlord check credit?

Yes. Tenant screening is a recognized permissible purpose because the lease is a transaction the applicant initiates. A landlord or screening company may review credit history, payment patterns, and public records to gauge the risk of nonpayment before approving a prospective tenant for a unit.

The report a landlord sees often comes from a specialty tenant-screening agency rather than directly from the three nationwide bureaus. Those reports carry their own accuracy obligations and dispute rights under the same statute, and an applicant denied housing is entitled to know which report drove the decision.

When is accessing a credit report illegal?

Access crosses into illegality when no listed purpose applies. Curiosity, a personal dispute, checking on a former partner, or pulling a file to market an unrelated product are not permissible purposes. Obtaining a report under false pretenses, or knowingly without a permissible purpose, is expressly prohibited.

The line does not depend on what the requester finds or how the information is used afterward. The violation occurs at the moment of access, which is why an unauthorized pull is actionable even when nothing further is done with the file.

How can a consumer spot an unauthorized inquiry?

Every pull leaves a record in the inquiries section of the credit report. Reviewing that section across all three bureaus reveals which companies requested the file and when. An unfamiliar company name beside a hard inquiry is often the first visible sign of a problem.

1. Request reports from all three nationwide bureaus, which remain free every week through the official source.
2. Open the inquiries section and separate the hard inquiries from the soft inquiries.
3. Match each hard inquiry to an application or account the consumer actually opened.
4. Flag any hard inquiry that has no matching application for closer follow-up.

Reviewing all three reports matters because a company may have pulled only one bureau. An inquiry that appears on Experian but not the others is still worth investigating if the consumer does not recognize the requester behind it.

What can a consumer do about an unauthorized hard inquiry?

An inquiry that reflects a real application generally stays on the report for two years and cannot be removed by dispute. An inquiry with no permissible purpose, often a sign of identity theft, is a different matter: it can be challenged with both the bureau and the company that pulled the file.

The first step is contacting the company directly to ask which permissible purpose it claimed for the pull. When the company cannot show one, a separate guide explains how to remove a hard inquiry that was unauthorized or fraudulent.

When the inquiry accompanies accounts the consumer never opened, the situation points to identity theft. An identity-theft report paired with a credit freeze or fraud alert stops further damage while the dispute and any blocking request proceed through the bureaus.

What are the penalties for pulling a report without permission?

The FCRA attaches real consequences. A willful violation under Section 616 exposes the violator to actual or statutory damages between 100 and 1,000 dollars, plus possible punitive damages and attorney fees. A negligent violation under Section 617 carries liability for actual damages a consumer can prove.

Obtaining a report under false pretenses can also bring criminal penalties under the statute. A consumer who suspects an illegal pull may have grounds to sue and can also file a complaint with the Consumer Financial Protection Bureau, which forwards the matter to the company for a response.

The statutory-damages structure is significant because it does not require proof of a dollar loss. A consumer harmed by a willful unauthorized pull can recover even when the practical injury is hard to quantify in money.

Does checking one's own credit count against the consumer?

No. A consumer who requests a personal report or score creates a soft inquiry, which carries a built-in permissible purpose and never lowers a score. Monitoring one's own file is encouraged and can be done as often as desired without any penalty to the score.

This distinction confuses many people who avoid checking their credit out of fear. The hard inquiry that can nudge a score down comes from applying for new credit, not from a consumer reviewing personal reports or using a monitoring service.

How does a security freeze limit who can pull a report?

A security freeze restricts access to a credit file so that most new creditors cannot pull it, which blocks the inquiries that fuel new-account fraud. Since 2018, federal law makes placing and lifting a freeze free at all three nationwide bureaus for every consumer.

A freeze does not remove permissible purpose for existing creditors or for the consumer. It simply adds a lock the consumer controls and can lift temporarily when applying for new credit, then reinstate once the application is complete.

Can a debt collector pull a credit report?

Yes, within limits. A debt collector working a valid account has a permissible purpose to pull a report in connection with collecting that specific debt. The collector may use the file to confirm a current address or to weigh the consumer's ability to pay, but the access has to serve that legitimate collection effort.

What a collector cannot do is pull a report for a debt it neither owns nor services, or to pressure a consumer who has already disputed the balance. A consumer who doubts the debt can demand proof, and a separate guide explains how a debt validation letter forces the collector to substantiate the account before collecting.

An inquiry from an unfamiliar collection agency therefore deserves scrutiny. If the agency cannot tie the pull to a debt the consumer actually owes, both the inquiry and the account behind it can be challenged with the bureaus as lacking any permissible purpose.

This matters because debt buyers routinely acquire old accounts with incomplete records. A pull tied to a debt the buyer cannot document is exactly the kind of access the permissible-purpose rule was written to prevent in the first place.

Frequently asked questions about credit report access

Can a company pull a credit report without consent?

Sometimes. A submitted application or an existing account supplies permissible purpose without a separate signature. Written consent is required for employment screening and whenever a company relies on the consumer's direct instruction rather than a transaction the consumer initiated on their own.

How long does a hard inquiry stay on a report?

A hard inquiry remains for two years from the date of the pull, though its effect on a credit score typically fades within several months. An inquiry tied to a genuine application the consumer made cannot be disputed away simply because the application was declined.

Is pulling another person's credit report a crime?

It can be. Obtaining a report under false pretenses or knowingly without a permissible purpose violates the FCRA and may carry both civil and criminal liability, including statutory damages, attorney fees, and in some cases prosecution by federal authorities.

Do soft inquiries reveal who viewed a credit report?

The consumer copy of a report lists soft inquiries, including prescreened offers and account reviews. Those entries appear only to the consumer and are not visible to a lender evaluating an application, so they carry no weight in a future credit decision.

Can a consumer block prescreened credit offers?

Yes. The official opt-out service stops the bureaus from sharing data for firm offers of credit and insurance. The choice lasts five years when made online and can be made permanent by returning a signed form through the mail. Opting out reduces prescreened mail without affecting a consumer's ability to apply for credit directly at any time.

Last reviewed: July 2026

This article is for educational purposes only and does not constitute legal or financial advice. The Fair Credit Reporting Act and related regulations are complex, and outcomes depend on individual circumstances. Consumers with specific questions about their credit reports or rights under federal law should consult a licensed attorney or contact the Consumer Financial Protection Bureau directly.