Who Can Legally Pull Your Credit Report?.

Only a party with a permissible purpose defined by federal law may pull your credit report. That list includes a lender reviewing your application, a landlord, an insurer, certain employers with your written consent, and an agency acting on a court order. Anyone else who pulls your report breaks the law.

The law behind this is the Fair Credit Reporting Act, specifically 15 U.S.C. § 1681b, known as Section 604 in the act’s own numbering. It lists every permissible purpose in a closed set and bars a credit bureau from releasing your file to anyone who cannot point to one of them.

What does permissible purpose mean under the FCRA?

Permissible purpose is the legal test a company must pass before Equifax, Experian, or TransUnion will release your file. The FCRA treats credit data as sensitive. It presumes your file is off limits unless one specific reason listed in Section 604 fits the request being made.

Congress wrote the rule into the law in 1970 to end the loose sharing of credit files that had become common. A credit bureau that hands over a file without first confirming a permissible purpose violates federal law. It does not matter who asked or how routine it seemed.

The result is a closed list. If a requester cannot name one of the purposes Congress wrote down, the bureau is supposed to refuse. A pull that happens anyway is unauthorized from the start, and that is more than a technicality.

We cover standard credit reports prepared by the three nationwide bureaus. Specialty reports, such as tenant or check-verification databases, follow separate rules. Some states also add protections on top of the federal floor for their own residents, and we do not cover those here.

Who is allowed to pull a credit report?

The statute names every party that qualifies, and most pulls come from a deal you started. That covers a credit application, a review of an account you already hold, or a written authorization you signed. Insurers, certain employers, government licensing bodies, and courts fill out the rest of the list.

• Lenders and card issuers: evaluating a new application or reviewing an existing account.
• Landlords and property managers: screening you as a rental applicant for a lease.
• Insurers: underwriting or setting the rate on a policy you applied for.
• Utility and phone companies: checking credit when you set up new service, which is a credit transaction you started.
• Employers: only with your written consent, under Section 604(b).
• Courts and government agencies: a court order, a federal grand jury subpoena, or a child-support enforcement agency.
• Debt collectors: working a valid account, or any entity acting on your written instruction.
• You: you can always pull your own reports, free every week at the official source.

Each of these ties back to a real relationship or transaction. The common thread is simple. You started the interaction, you agreed to it, or a legal process overrides the usual privacy default.

Who has no right to see your credit report?

Friends, family, and the general public have no legal right to see your credit file. Your report is private, and nobody can search it the way they search court records. No relative, ex-partner, neighbor, or curious coworker fits any purpose on the Section 604 list.

The same goes for an employer who never got your signed authorization. A company that pulls your report for a job without your written consent has no permissible purpose. It does not matter that it would have qualified with the signature.

Errors on reports are common enough that strangers’ access matters. In the congressionally mandated national accuracy study, one in five consumers had an error on at least one of their three credit reports (Federal Trade Commission, 2013). A file that nobody should be reading is also a file that nobody is checking for you.

Does a creditor need written permission to check credit?

Not always. When you submit a credit application, that act supplies the permissible purpose, so no separate signature is needed. Written authorization becomes required in the job context and whenever a company leans on your direct instruction instead of a transaction you began.

Prescreened offers run on a separate track. Under Section 604(c), bureaus may share limited data for firm offers of credit or insurance without you starting anything. This is the biggest carve-out in the law, because a company can see a slice of your data before you ever contact it.

You can opt out of those marketing lists at any time through the official industry opt-out service. Prescreen and account-review pulls show up as soft inquiries. They appear only on your own copy of the report and never affect a credit score. A hard inquiry is different: it comes from a fresh application, and other lenders can see it.

Can an employer pull a credit report?

An employer can request your report, but only after a clear written disclosure and your signed authorization. Section 604(b) adds duties no other user carries. Before taking adverse action based on the report, the employer must give you a copy of it along with a summary of your rights under the FCRA.

That pre-adverse-action step exists so you can spot and fix an error before a hiring decision becomes final. An employer that skips the disclosure, the authorization, or the notice has broken the statute. That holds even if the report was accurate.

Several states and cities limit employer credit checks further, allowing them only for roles that handle money or need a security clearance. Local law can narrow what the federal floor allows, so the rules vary by where you live.

Can a landlord check credit?

Yes. Tenant screening is a recognized permissible purpose, because the lease is a deal you start by applying. A landlord or screening company may review your credit history, payment patterns, and public records to judge the risk of nonpayment before approving you for a unit.

The report a landlord sees often comes from a specialty tenant-screening company. In its 2022 market review of 17 of those companies, the CFPB found many reports that appeared to include legally barred obsolete information, such as old non-conviction criminal records and duplicate entries (Consumer Financial Protection Bureau, 2022).

Those reports carry their own accuracy duties and dispute rights under the same statute. If you are denied housing, you are entitled to know which report drove the decision.

When is accessing a credit report illegal?

Access becomes illegal the moment no listed purpose applies. Curiosity, a personal feud, checking on a former partner, or pulling a file to sell an unrelated product are all outside the law. Getting a report under false pretenses, or knowingly without a permissible purpose, is expressly banned.

The line does not depend on what the requester finds or what they do with it afterward. The violation happens at the moment of access. That is why an unauthorized pull is actionable even when nothing more is done with the file.

How can a consumer spot an unauthorized inquiry?

Every pull leaves a record in the inquiries section of your report. Reading that section on all three bureau reports shows which companies requested your file and when. An unfamiliar company name next to a hard inquiry is often the first sign of trouble.

1. Request reports from Equifax, Experian, and TransUnion, which stay free every week through the official source.
2. Open the inquiries section and sort the hard inquiries from the soft ones.
3. Match each hard inquiry to an application or account you actually opened.
4. Flag any hard inquiry with no matching application for follow-up.

Check all three, because a company may have pulled only one bureau. An inquiry that shows up on Experian and nowhere else is still worth chasing if you do not know the requester.

People who find strangers on their reports are not alone. By our own count, 66.9% of the 3,482,718 complaints recorded in the CFPB’s public Consumer Complaint Database under “Incorrect information on your report” from July 2025 through June 2026 said the information belonged to someone else. These complaints are unverified consumer allegations. The CFPB itself says part of the surge comes from credit repair firms and automated filers.

What can a consumer do about an unauthorized hard inquiry?

You can challenge a pull with no permissible purpose with both the bureau and the company that made it. An inquiry from a real application generally stays on your report for two years and cannot be disputed away. An inquiry with no permissible purpose, often a sign of identity theft, is a different matter.

Start by contacting the company and asking which permissible purpose it claimed for the pull. When it cannot show one, a separate guide explains how to remove a hard inquiry that was unauthorized or fraudulent.

Once a bureau gets your dispute, Section 611 of the FCRA requires a reasonable reinvestigation, generally within 30 days, and it must delete or correct information it cannot verify (Fair Credit Reporting Act, 1970). When the inquiry comes with accounts you never opened, that points to identity theft. An identity-theft report paired with a credit freeze or fraud alert stops more damage while the dispute and any blocking request move through the bureaus.

What are the penalties for pulling a report without permission?

The FCRA attaches real consequences. A willful violation under Section 616 exposes the violator to actual damages or statutory damages between $100 and $1,000, plus possible punitive damages and attorney fees. A negligent violation under Section 617 carries liability for the actual damages you can prove.

Getting a report under false pretenses can also bring criminal penalties under the statute. If you suspect an illegal pull, you may have grounds to sue. You can also file a complaint with the Consumer Financial Protection Bureau, which forwards it to the company for a response.

The complaint route is well worn. Credit or consumer reporting made up 88% of the roughly 6.6 million complaints the CFPB received in 2025 (Consumer Financial Protection Bureau, 2026). The statutory-damages setup matters because it does not require proof of a dollar loss. If a willful pull harmed you, you can recover even when the injury is hard to price.

Does checking one’s own credit count against the consumer?

No. When you request your own report or score, that creates a soft inquiry, which carries a built-in permissible purpose and never lowers a score. You can check your own file as often as you like with no penalty.

This trips up a lot of people who avoid checking out of fear. The hard inquiry that can nudge a score down comes from applying for new credit. Reviewing your own reports or using a monitoring service does not do it.

Where you check matters, though. Honore, in a 1-star Trustpilot review of Credit Karma on June 25, 2026, wrote: “Ads to free credit report take you to a 3rd party chat that sells your private info. NO credit reports or live help available. If you do, you start getting spammed incessantly from 3rd parties.” The official free source hands your reports to you and nobody else.

How does a security freeze limit who can pull a report?

A security freeze locks your file so most new creditors cannot pull it, which blocks the inquiries that fuel new-account fraud. Since 2018, federal law makes placing and lifting a freeze free at all three nationwide bureaus for every consumer.

A freeze does not cancel the permissible purpose of your existing creditors, or your own. It adds a lock you control. You can lift it for a while when you apply for new credit, then put it back once the application is done.

Can a debt collector pull a credit report?

Yes, within limits. A debt collector working a valid account has a permissible purpose to pull your report in connection with that specific debt. The collector may use it to confirm your address or weigh your ability to pay, but the access has to serve that collection.

This touches a lot of people. About 77 million Americans, or 35% of adults with a credit file, have debt in collections on their report (Urban Institute, 2025). What a collector cannot do is pull a report for a debt it neither owns nor services, or to pressure you after you have disputed the balance.

If you doubt the debt, you can demand proof under the FDCPA. A separate guide explains how a debt validation letter forces the collector to back up the account before collecting. An inquiry from an unfamiliar collection agency deserves a hard look. If the agency cannot tie the pull to a debt you owe, both the inquiry and the account can be challenged with the bureaus as lacking a permissible purpose.

This matters because debt buyers routinely buy old accounts with patchy records. A pull tied to a debt the buyer cannot document is exactly the kind of access the permissible-purpose rule was written to stop.

Which Tool Helps You Challenge a Pull You Never Authorized?

Once you find an inquiry nobody had the right to make, the choice turns on who writes the dispute and whether you get to see it before it goes out. Here is how the main options compare on price, what they do about a pull you did not allow, and which bureaus they reach.

Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.

How CreditRefresh Scans All Three Bureau Reports and Drafts FCRA Letters

An unauthorized pull only gets challenged once someone finds it on Equifax, Experian, or TransUnion and puts the dispute in writing. In CreditRefresh’s September 18, 2026 member-data extract, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag.

Here is how it works. You subscribe to Refresh Monitoring for $49.99 a month, with no setup fee and no contract, and CreditRefresh is included. It pulls all three bureau reports and flags items that look inaccurate, incomplete, unverifiable, or too old to report under the seven-year and ten-year rules. For each item you choose, it drafts a print-ready letter that cites your rights under the FCRA.

Nothing goes out until you read it and sign it. You mail the round yourself, or hand it to RushMail for a small per-letter fee, and we track each letter against the roughly 30-day investigation window. The bureaus decide every dispute, and an accurate inquiry from an application you really made stays on your report.

Frequently Asked Questions

Can a company pull my credit without my consent?

Sometimes. A submitted application or an existing account supplies permissible purpose without a separate signature. Written consent is required for job screening and whenever a company relies on your direct instruction instead of a transaction you started.

How long does a hard inquiry stay on my credit report?

A hard inquiry stays for two years from the date of the pull. An inquiry tied to a real application you made cannot be disputed away just because the application was declined.

Is it a crime to pull someone else’s credit report?

It can be. Getting a report under false pretenses or knowingly without a permissible purpose violates the FCRA and can carry civil and criminal liability, including statutory damages, attorney fees, and in some cases federal prosecution.

Can I see who viewed my credit report?

Yes, on your own copy. It lists soft inquiries, including prescreened offers and account reviews, and those entries show only to you. A lender reviewing your application cannot see them, so they carry no weight in a future credit decision.

How do I stop prescreened credit offers?

Use the official opt-out service, which stops the bureaus from sharing your data for firm offers of credit and insurance. The choice lasts five years when made online and becomes permanent if you mail back a signed form. Opting out cuts prescreened mail and leaves your ability to apply for credit directly untouched.

Can a lender use my medical information to decide on credit?

Section 604(g) of the FCRA restricts creditors from getting and using medical information in credit decisions, outside narrow exceptions set by regulation. Medical debt itself is a separate question: a 2025 CFPB rule to remove it from reports was vacated by a federal court in July 2025, so medical debt generally remains reportable (Consumer Financial Protection Bureau, 2025).

What is a risk-based pricing notice?

It is a notice Section 615(h) requires when a lender uses your report to give you worse terms than it gives other borrowers. It tells you a credit report shaped your price, which is your cue to pull that report and check it for errors.

What is an investigative consumer report?

It is a report built partly from interviews with people who know you, such as neighbors or coworkers, and Section 606 of the FCRA governs it separately. The company ordering one owes you a written disclosure, and you have the right to ask what the investigation covered.

Last reviewed: September 2026

This article is for educational purposes only and does not constitute legal or financial advice. The Fair Credit Reporting Act and related regulations are complex, and outcomes depend on individual circumstances. Consumers with specific questions about their credit reports or rights under federal law should consult a licensed attorney or contact the Consumer Financial Protection Bureau directly.

CreditRefresh reads all three of your credit reports and drafts a signed FCRA dispute for any pull nobody had the right to make. Check who has pulled your credit report →