Fair Credit Reporting Act:
Rights and Responsibilities
Margaret Mikyung Lee
Legislative Attorney
February 2, 2012
Congressional Research Service
7-5700
www.crs.gov
RL31666
CRS Report for Congress
Pr
epared for Members and Committees of Congress
Fair Credit Reporting Act: Rights and Responsibilities
Summary
The purpose of the Fair Credit Reporting Act (FCRA) is “to require that consumer reporting
agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit,
personnel, insurance, and other information in a manner which is fair and equitable to the
consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such
information.” The FCRA establishes consumers’ rights in relation to their credit reports, as well
as permissible uses of credit reports. It also imposes certain responsibilities on those who collect,
furnish, and use the information contained in consumers’ credit reports.
The FCRA has been amended several times over the last decade. The Fair and Accurate Credit
Transactions Act of 2003 (FACT Act, P.L. 108-159) amended the FCRA to include a number of
provisions aimed at preventing identity theft and assisting victims. The Credit Card
Accountability Responsibility and Disclosure Act of 2009 (Credit CARD Act, P.L. 111-24)
strengthened protections for young consumers and advertising disclosures regarding free credit
reports from consumer reporting agencies. More recently, the Consumer Financial Protection Act
of 2010, part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (P.L. 111-203),
established the Consumer Financial Protection Bureau and transferred administrative functions,
including most rulemaking and reporting, as well as certain enforcement functions, from other
federal agencies, such as the Federal Trade Commission and the Federal Reserve Board, to the
Bureau. For more information on the functions of the new Bureau, see CRS Report R41338, The
Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial
Protection Bureau, by David H. Carpenter.
This report discusses consumers’ rights under the FCRA, as well as the type of information
included in credit reports, permissible uses of credit reports, disclosure requirements, and
requirements for users of consumer credit reports and furnishers of information. It also addresses
FCRA provisions aimed at preventing identity theft and assisting victims of identity theft. For
further information on laws and issues related to identity theft, see CRS Report R40599, Identity
Theft: Trends and Issues, by Kristin M. Finklea, and CRS Report RL31919, Federal Laws
Related to Identity Theft, by Gina Stevens. For information on data security and the legislative
efforts regarding such, see CRS Report RL34120, Federal Information Security and Data Breach
Notification Laws, by Gina Stevens, and CRS Report RL33273, Data Security: Federal
Legislative Approaches, by Gina Stevens.
Congressional Research Service
Fair Credit Reporting Act: Rights and Responsibilities
Contents
Introduction...................................................................................................................................... 1
Information Included in Consumer Credit Reports ......................................................................... 2
Permissible Uses of Consumer Credit Reports................................................................................ 3
Consumer Rights ............................................................................................................................. 5
Responsibilities of Consumer Reporting Agencies.......................................................................... 7
Responsibilities of Furnishers of Information ................................................................................. 8
Requirements for Users of Consumer Reports ................................................................................ 9
Identity Theft Provisions ............................................................................................................... 11
Contacts
Author Contact Information........................................................................................................... 13
Congressional Research Service
Fair Credit Reporting Act: Rights and Responsibilities
Introduction
The purpose of the Fair Credit Reporting Act (FCRA)1 is “to require that consumer reporting
agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit,
personnel, insurance, and other information in a manner which is fair and equitable to the
consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such
information.”2 The FCRA establishes consumers’ rights in relation to their credit reports, as well
as permissible uses of credit reports, disclosure requirements, and requirements for users of
consumer credit reports and furnishers of information. The Fair and Accurate Credit Transactions
Act of 2003 (FACT Act) amended the FCRA to include a number of provisions aimed at
preventing identity theft and assisting victims.3 The Credit Card Accountability Responsibility
and Disclosure Act of 2009 (Credit CARD Act)4 strengthened protections for young consumers
and advertising disclosures regarding free credit reports from consumer reporting agencies. More
recently, the Consumer Financial Protection Act of 2010,5 part of the Dodd-Frank Wall Street
Reform and Consumer Protection Act (Dodd-Frank Act),6 established the Consumer Financial
Protection Bureau (CFPB or the Bureau) and transferred administrative functions, including
rulemaking and reporting, as well as certain enforcement functions, from other federal agencies
such as the Federal Trade Commission and the Federal Reserve Board, to the Bureau.7
1 P.L. 91-508, Title VI, §601, 84 Stat. 1128 (1970), codified as amended at 15 U.S.C. §§1681–1681x.
2 15 U.S.C. §1681(b).
3 P.L. 108-159, 117 Stat. 1952. These provisions are discussed in detail infra at Identity Theft Provisions. More
information on these provisions and other issues related to identity theft can be found in CRS Report R40599, Identity
Theft: Trends and Issues, by Kristin M. Finklea; CRS Report RL31919, Federal Laws Related to Identity Theft, by
Gina Stevens. For information on data security generally and related legislative proposals, see CRS Report RL34120,
Federal Information Security and Data Breach Notification Laws, by Gina Stevens, and CRS Report RL33273, Data
Security: Federal Legislative Approaches, by Gina Stevens.
4 P.L. 111-24, 123 Stat. 1734 (2009).
5 P.L. 111-203, Title X, §§1001–1100H, 124 Stat. 1376–2113 (2010).
6 P.L. 111-203, 124 Stat. 1376 (2010).
7 Id., §§1024-1027, 1029, and 1061 provide for the certain functions of the CFPB and the transfer of functions from the
other federal financial services agencies and the Federal Trade Commission to the CFPB. The changes to
administrative enforcement authority for the FCRA made by §1088 of the Dodd-Frank Act are codified at 15 U.S.C.
§1681s. The Dodd-Frank Act did not transfer to the Bureau the rulemaking authority for the Red Flag guidelines and
regulations pursuant to 15 U.S.C. §1681m(e) and for the disposal of records pursuant to 15 U.S.C. §1681w. Also, the
Federal Trade Commission retained rulemaking authority over auto dealers pursuant to §1029 of the Dodd-Frank Act.
Pursuant to §1024(c)(3) of the Dodd-Frank Act, the CFPB and the FTC recently concluded a Memorandum of
Understanding to establish a framework for coordinating enforcement and regulatory efforts, available at
http://www.ftc.gov/os/2012/01/120123ftc-cfpb-mou.pdf, press release available at http://www.ftc.gov/opa/2012/01/
ftccfpb.shtm. Regulation V, the Fair Credit Reporting regulations, are now at 12 C.F.R. part 1022, part of the CFPB
regulations, promulgated at 76 Fed. Reg. 79308 (2011).
For more information on the transfer of functions to the CFPB, see CFPB, Streamlining Inherited Regulations, 76 Fed.
Reg. 75825 (2011); CFPB, Identification of Enforceable Rules and Orders, 76 Fed. Reg. 43569 (2011); CFPB,
Agencies Issue Statement to Clarify Supervisory and Enforcement Responsibilities For Federal Consumer Financial
Laws, at http://www.consumerfinance.gov/pressrelease/agencies-issue-statement-to-clarify-supervisory-and-
enforcement-responsibilities-for-federal-consumer-financial-laws; and CRS Report R41338, The Dodd-Frank Wall
Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by David H.
Carpenter. The Federal Trade Commission issued a report on its experiences administering and enforcing the FCRA,
Forty Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report and Summary of Interpretations
(2011), while simultaneously rescinding its official staff interpretations in the Code of Federal Regulations, in
anticipation of the transfer of certain regulatory functions to the CFPB, report and rescission available at
http://www.ftc.gov/opa/2011/07/fcra.shtm.
Congressional Research Service
1
Fair Credit Reporting Act: Rights and Responsibilities
The FCRA applies to the files maintained by “consumer reporting agencies,” a term broadly
defined to include anyone in the business of furnishing reports on the creditworthiness of
consumers to third parties.8 Consumer reporting agencies are also commonly known as credit
bureaus or credit reporting agencies. A consumer reporting agency “is essentially a clearinghouse
for information supplied by credit grantors and collection agencies, and culled by the bureau itself
from public records.”9 In addition to several thousand small bureaus that often serve limited
geographic areas, there are three major consumer reporting agencies that operate on a nationwide
basis—Experian, Equifax, and Trans Union. Information on a particular consumer may be
maintained by any one or all of the consumer reporting agencies serving a particular geographic
area.
Information Included in Consumer Credit Reports
Consumer credit reports generally include information about consumers’ “credit worthiness [sic],
credit standing, credit capacity, character, general reputation, personal characteristics, or mode of
living.”10 The FCRA explicitly excludes certain types of financial reports from the definition of a
consumer report. For example, “any report containing information solely as to transactions or
experiences between the consumer and the person making the report” is excluded from the
definition of consumer report, as are communications of that information among persons related
by common ownership or affiliated by corporate control.11 Authorizations or approvals of specific
extensions of credit by the issuer of a credit card are also excluded from the definition of
consumer report.12
With relatively few exceptions, there appears to be a consensus among the consumer reporting
agencies as to the types of information that should be included in a report.13 Information reported
by a credit bureau commonly includes “identifying information, usually the individual’s full
name, Social Security number, address, telephone number, and spouse’s name; financial status
and employment information, including income, spouse’s income, place, position, and tenure of
employment, other sources of income, duration, and income in former employment; credit
history, including types of credit previously obtained, names of previous credit grantors, extent of
previous credit, and complete payment history; existing lines of credit, including payment habits
and all outstanding obligations; public record information, including pertinent newspaper
8 15 U.S.C. §1681a(f). The FCRA defines a consumer reporting agency as “any person which, for monetary fees, dues,
or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating
consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third
parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing
consumer reports.”
9 Frederick H. Miller, et al., Consumer Law: Cases, Problems, and Materials, p. 296.
10 15 U.S.C. §1681a(d)(1).
11 15 U.S.C. §1681a(d)(2)(A). “The first type of excluded information [among persons related by common ownership]
is information based on first hand experience of one of the affiliates. The second type [among persons affiliated by
corporate control] is any other information shared by affiliates, provided that the sharing is disclosed to the consumer
and the consumer is given the opportunity to direct that the information not be shared among related entities.” Debtor-
Creditor Law §16.02[3] (Matthew Bender & Co. 2011).
12 15 U.S.C. §1681a(d)(2)(B).
13 Miller, supra note 9.
Congressional Research Service
2
Fair Credit Reporting Act: Rights and Responsibilities
clippings, arrest and conviction records,14 bankruptcies, tax liens, and lawsuits; and finally a
listing of bureau subscribers that have previously asked for a credit report on the individual.”15
The Fair Credit Reporting Act limits the amount of time that adverse or negative information can
be included in a consumer’s credit report. Generally, a credit reporting agency is prohibited from
reporting adverse information that is more than seven years old, or in the case of bankruptcies,
more than ten years old.16 If a bankruptcy filed under title 11 of the United States Code is
included on a consumer’s report, the report shall also identify the chapter under which the case
arose, if such information is provided by the source of the information.17 If a bankruptcy case or
filing under title 11 of the United States Code is withdrawn by the consumer before a final
judgment, the report must include the fact that the case or filing was withdrawn.18
In addition to adverse credit information, consumer reporting agencies are also allowed to include
information on a consumer’s failure to pay overdue child support, if such information has been
provided to the agency by a state or local child support enforcement agency or verified by any
state or federal government agency. This information remains on the consumer report for up to
seven years.19
Medical information may be included in consumer reports under certain circumstances and if
consumer reporting agencies and creditors follow statutory and regulatory procedures and
conditions to protect the confidentiality of such information.20
Permissible Uses of Consumer Credit Reports
The Fair Credit Reporting Act outlines the purposes for which a consumer credit report may be
furnished to a requester.21 In general, a consumer reporting agency may furnish a copy of a
consumer’s report to a person the agency has reason to believe intends to use the information for
the purpose of extending credit to the consumer or for reviewing or collecting of the consumer’s
credit account.22 Consumer credit reports may also be issued where there is another “legitimate
business need” for the information contained in the report in connection with a business
transaction initiated by the consumer, or for purposes of reviewing an existing account to
determine whether the consumer continues to meet the terms of the account.23 Reports may be
14 Experian does not maintain information concerning criminal records; see http://www.experian.com/credit-education/
credit-report-faqs.html.
15 Miller, supra note 9.
16 15 U.S.C. §1681c(a). The seven- and ten-year reporting limitations do not apply to transactions involving, or which
may be expected to involve, an amount greater than $150,000; the underwriting of life insurance involving, or which
may involve, an amount of $150,000 or more; or to the employment of any individual at an annual salary which equals,
or may be expected to equal, more than $75,000. 15 U.S.C. 1681c(b). Information regarding certain types of student
loans may be reported until the loan is paid in full. 20 U.S.C. §1087cc(c)(3).
17 15 U.S.C. §1681c(d).
18 Id.
19 15 U.S.C. §1681s-1.
20 FACT Act of 2003, P.L. 108-159, §§411 and 412, 117 Stat. 1999-2003, amending 15 U.S.C. §§1681a(d)(3) and (i),
1681b(g), 1681c(a)(6), and 1681s-2(a)(9).
21 15 U.S.C. §1681b.
22 15 U.S.C. §1681b(a)(3)(A).
23 15 U.S.C. §1681b(a)(3)(F).
Congressional Research Service
3
Fair Credit Reporting Act: Rights and Responsibilities
furnished to executive branch departments and agencies in connection with the issuance of
government-sponsored travel charge cards that are billed to employees.24 An insurer may receive
a report in connection with the underwriting of an insurance policy involving the consumer for
which the consumer has applied.25 Various other uses are permitted, including, among others, a
response to a court order, a decision regarding a consumer’s employment, and determination by a
government agency of a consumer’s ability to make child support payments.26
Reports may be issued in connection with transactions not initiated by the consumer only if
authorized by the consumer, or if the transaction is a firm offer for credit or insurance and the
consumer has not elected to have his name removed from lists provided by the agency for this
purpose.27 A consumer may elect to have his name removed from such lists by notifying the
reporting agency that he does not consent to the release of reports for this purpose.28 If the
consumer has not authorized the release of such reports and has not elected to have his name
removed from the lists, the agency may release only certain information about the consumer.
Information released in connection with transactions not initiated by the consumer is limited to
the name and address of the consumer, an identifier that is not unique to the consumer and that is
used solely for the purpose of verifying the consumer’s identity, and other information pertaining
to the consumer that does not identify his/her relationship or experience with respect to a
particular creditor or other entity.29 The Credit CARD Act of 2009 added protections from
prescreened offers for persons under 21 years of age. Credit reports for such consumers cannot be
issued in connection with such offers unless the consumer has consented.30
In addition to reports issued for the commercial purposes discussed above, a consumer reporting
agency may also issue a report to a person it has reason to believe “intends to use the information
in connection with a determination of the consumer’s eligibility for a license or other benefit
granted by a governmental entity required by law to consider an applicant’s financial
responsibility or status.”31
The FCRA also authorizes consumer credit reports to be released for certain legal purposes.
Specifically, the act authorizes consumer credit reports to be released “in response to the order of
a court having jurisdiction to issue such an order,” or in response to “a subpoena issued in
24 15 U.S.C. §1681b(a)(3)(G).
25 15 U.S.C. §1681b(a)(3)(C). For more information on the use of consumer credit information by the insurance
industry, see CRS Report RS21341, Credit Scores: Credit-Based Insurance Scores, by Baird Webel.
26 15 U.S.C. §1681b(a).
27 15 U.S.C. 1681b(c)(1). This provision allows “prescreening” by a consumer reporting agency. “Prescreening” is the
process “whereby a consumer reporting agency compiles or edits a list of consumers who meet specific criteria and
provides this list to the client or third party on behalf of the client for use in soliciting these consumers for the client’s
products or services.” Prescreening is permissible under the Fair Credit Reporting Act if the client agrees in advance
that each consumer on the list will receive an offer of credit. See CCH Consumer Credit Guide, ¶ 25,050.
28 15 U.S.C. §1681b(e). Pursuant to the 2003 amendment to the FCRA, persons who use consumer reports for
prescreening purposes must provide the consumer with a statement including the address and telephone number where
the consumer may request to be excluded from prescreened lists. The consumer’s election to be excluded from such
lists is effective for five years. FACT Act of 2003, P.L. 108-159, §213, 117 Stat. 1978, codified as amended at 15
U.S.C. §1681m(d)(2).
29 15 U.S.C. §1681b(c)(2).
30 15 U.S.C. §1681b(c)(1)(B)(iv); subparagraph (iv) was added by the Credit CARD Act of 2009, P.L. 111-24, §302,
123 Stat. 1748.
31 15 U.S.C. §1681b(a)(3)(D).
Congressional Research Service
4
Fair Credit Reporting Act: Rights and Responsibilities
connection with proceedings before a Federal grand jury.”32 Reports may also be issued to state or
local child support enforcement agencies if needed to establish the consumer’s capacity to pay
child support or to determine the amount of such payments.33
If certain requirements are met, reports may also be issued for employment purposes.34 In order to
obtain a report for employment purposes, the requester must certify that the report will not be
used in violation of any state or federal law.35 The consumer must be told by the prospective
employer that a report may be obtained and must consent to the procurement of a report by the
employer.36 If the employer intends to take adverse action based in whole or in part on the report,
the consumer must be provided with a copy of the report and a description of the rights afforded
to consumers under the FCRA.37
A consumer report may also be issued to the Federal Deposit Insurance Corporation or the
National Credit Union Administration as part of its powers, as conservator, receiver, or
liquidating agent for an insured depository institution or insured credit union or in connection
with the resolution or liquidation of a failed or failing insured depository institution or insured
credit union.38
Consumer Rights
The Fair Credit Reporting Act outlines consumers’ rights in relation to their credit reports. Under
the FCRA, consumers have the right to access all information in their credit reports, including the
sources of the information, and the right to disclosure of their credit scores.39 A consumer may
request one free credit report, not including a free credit score, each year from each of the
nationwide consumer reporting agencies.40 Pursuant to an amendment by the Credit CARD Act of
2009,41 advertisements for a free credit report in any medium, including television, radio, and the
32 15 U.S.C. §1681b(a)(1).
33 15 U.S.C. §1681b(a)(4). In order for reports to be released for this purpose, the paternity of the consumer must have
been established or acknowledged by the consumer; the consumer must be given notice of the request; and the report
must be kept confidential and used only for this purpose. Id.
34 15 U.S.C. §1681b(a)(3)(B). Under the FCRA, “employment purposes” mean “a report used for the purpose of
evaluating a consumer for employment, promotion, reassignment or retention as an employee.” 15 U.S.C. §1681a(h).
35 15 U.S.C. §1681b(b)(1).
36 15 U.S.C. §1681b(b)(2).
37 15 U.S.C. §1681b(b)(3).
38 15 U.S.C. §1681b(a)(6).
39 15 U.S.C. §1681g(a). Credit scores must be made available to consumers pursuant to an amendment in the FACT
Act of 2003, P.L. 108-159, §212(a), (b), 117 Stat. 1973, codified as amended at 15 U.S.C. §1681g(a), (f). Prior to this
amendment, consumer reporting agencies were under no obligation to release credit scores. For a discussion of how
credit scores are used, see CRS Report RS21298, Credit Scores: Development, Use, and Policy Issues, by Pauline
Smale.
40 15 U.S.C. §1681j(a), as amended by the FACT Act of 2003, P.L. 108-159, §211(a), 117 Stat. 1968. For more
information on free credit reports, see CRS Report RL32008, A Consumer’s Access to a Free Credit Report: A Legal
and Economic Analysis, by Loretta Nott and Angie A. Welborn. The free credit report is not required to include the
consumer’s credit score. The credit score must be disclosed upon request, but a reasonable fee may be imposed for the
disclosure. P.L. 108-159, §212(b), 117 Stat. 1973-1975, codified as amended at 15 U.S.C. §1681g(f)(8).
41 Section 205 of the Credit CARD Act of 2009, supra note 4, codified as amended at 15 U.S.C. §1681j(g); this
requirement responded to consumer confusion about whether certain free credit reports, offered by consumer reporting
agencies in conjunction with the sale of other credit information or monitoring services, were the statutorily required
(continued...)
Congressional Research Service
5
Fair Credit Reporting Act: Rights and Responsibilities
internet, must include a disclosure to the effect that free annual reports are available under federal
law at “AnnualCreditReport.com” or other sources authorized by federal law and that the
privately advertised service is not the free report required by law. Free reports may also be
obtained under certain circumstances, such as notice of an adverse action based on information in
a credit report or a consumer’s request for a credit report in conjunction with a fraud alert.42
Absent one of these circumstances, a consumer may be charged up to $11.00 for additional copies
of his or her credit report.43 Except in certain circumstances, a consumer reporting agency may
charge a fair and reasonable fee, as determined by the Bureau ($11.00 maximum), for providing a
consumer’s current credit score or the one most recently calculated for an extension of credit.44
This paid disclosure must include a notice that the credit score purchased by the consumer may
differ from a score purchased and used by a lender or other user of credit reports and scores.45 As
required by the Dodd-Frank Act, the Bureau issued a report in 2011 on the nature, range, and size
of variations between credit scores sold to creditors and those sold to consumers by consumer
reporting agencies and whether such variations disadvantage consumers.46
In addition to the disclosure of information contained in the consumer’s credit report, a consumer
is also entitled to receive information identifying each person who obtained a consumer credit
report for employment purposes during the previous two years, or for any other purpose during
the previous year.47 Additional information that must be disclosed to the consumer upon request
includes “the dates, original payees, and amounts of any checks upon which is based any adverse
characterization of the consumer, included in the file at the time of the disclosure;” and “a record
of all inquiries received by the agency during the one-year period preceding the request that
identified the consumer in connection with a credit or insurance transaction that was not initiated
by the consumer.”48
Consumers have the right to dispute the completeness or accuracy of information contained in
their files.49 Once a consumer notifies the consumer reporting agency of the dispute, the agency
must reinvestigate and record the current status of the disputed information, or delete it from the
(...continued)
free annual reports. See also the related rule at 12 C.F.R. §1022.138.
42 See 15 U.S.C. §1681j(b), (c), and (d).
43 15 U.S.C. §1681j(f) and Federal Trade Commission, Charges for Certain Disclosures, 75 Fed. Reg. 80817 (2010)
(notice of the annual adjustment, based on the Consumer Price Index, of the maximum reasonable fee that can be
charged for disclosures under 15 U.S.C. §1681g, other than the free annual credit report and notices and disclosures
required by the FCRA). Section 1088 of the Dodd-Frank Act, supra note 6, transferred the responsibility for the annual
fee adjustment to the CFPB (see 15 U.S.C. §1681j(f)(2)), but it has not yet adjusted the fee for 2012.
44 Id. and 15 U.S.C. §1681g(f)(8). Certain mortgage lenders must disclose to a consumer the credit score used for the
purpose of the loan; 15 U.S.C. §1681g(g). Also, as discussed infra notes 83 and 85, when users of credit reports take an
adverse action or offer credit on terms less favorable than usual, they must disclose the credit score on which such
actions were based.
45 15 U.S.C. §1681g(f)(1).
46 Section 1078 of the Dodd-Frank Act, supra note 6, required the study and report by the Bureau, Report to Congress:
The impact of differences between consumer- and creditor-purchased credit scores, available at
http://www.consumerfinance.gov/report/the-impact-of-differences-between-consumer-and-creditor-purchased-credit-
scores.
47 15 U.S.C. §1681g(a)(3).
48 15 U.S.C. §1681g(a)(4), (5).
49 15 U.S.C. §1681i.
Congressional Research Service
6
Fair Credit Reporting Act: Rights and Responsibilities
consumer’s file within 30 days.50 The consumer reporting agency must also notify the furnisher of
the disputed information of the consumer’s dispute and provide the furnisher with all relevant
information the agency has received from the consumer regarding the dispute.51
In conducting the reinvestigation, the consumer reporting agency must review and consider all
relevant information submitted by the consumer.52 The agency may terminate the reinvestigation
if it reasonably determines that the dispute is frivolous or irrelevant, or if the consumer fails to
provide sufficient information to investigate the disputed information.53 Should the agency
determine that the dispute is frivolous or irrelevant, it must notify the consumer of the
determination not later than five business days after making such determination.54 If the
reinvestigation leads to a determination that the disputed information is in fact inaccurate,
incomplete, or unverifiable, the consumer reporting agency must delete that item of information
from the consumer’s credit file.55
The consumer reporting agency must provide written notice of the results of the reinvestigation to
the consumer within five days of completing the reinvestigation.56 The notice must include a
statement that the reinvestigation is completed; a copy of the consumer report reflecting the
information in the consumer’s file revised during the reinvestigation; a notice that, if requested by
the consumer, a description of the procedure used to determine the accuracy and completeness of
the information can be provided; a notice that the consumer has the right to add a statement to
his/her file disputing the accuracy or completeness of the information contained therein; and a
notice that the consumer has the right to request that the consumer reporting agency send notices
regarding deleted information to specified parties.57
Responsibilities of Consumer Reporting Agencies
Certain provisions of the Fair Credit Reporting Act are aimed at ensuring that the information in
consumers’ credit files is accurate and complete. As discussed above, under the FCRA, consumer
reporting agencies must conduct a reasonable reinvestigation if a consumer disputes the accuracy
of any information in his/her file.58 The agencies also must notify requesters of consumer reports
of any substantial discrepancies between the address the agency has on file for a consumer and
the consumer’s address included in the request.59
In addition to their responsibilities related to the accuracy of information in consumers’ files,
credit reporting agencies must also ensure that consumer credit reports are released only for the
50 15 U.S.C. §1681i(a)(1)(A).
51 15 U.S.C. §1681i(a)(2)(A).
52 15 U.S.C. §1681i(a)(4).
53 15 U.S.C. §1681i(a)(3)(A).
54 15 U.S.C. §1681i(a)(3)(B).
55 15 U.S.C. §1681i(a)(5).
56 15 U.S.C. §1681i(a)(6)(A).
57 15 U.S.C. §1681i(a)(6)(B).
58 15 U.S.C. §1681i(a)(1)(A).
59 15 U.S.C. §1681c(h).
Congressional Research Service
7
Fair Credit Reporting Act: Rights and Responsibilities
purposes discussed above.60 In order to ensure that the reports are used for permissible purposes,
the credit reporting agencies must require that the prospective users of the information identify
themselves, certify the purposes for which the information is sought, and certify that the
information will be used for no other purpose.61
Consumer reporting agencies also have a duty to notify furnishers of information in the files and
users of consumer reports of their responsibilities under the FCRA.62
In addition to the general responsibilities discussed above, a consumer reporting agency has
responsibilities with regard to investigative consumer reports and reports provided for
employment purposes. Prior to collecting information for or preparing an investigative consumer
report, the agency must disclose to the consumer the nature and scope of the requested
investigation and the fact that such a report may be made.63 A consumer reporting agency may not
prepare or furnish an investigative consumer report unless it has received certification from the
requesting party that the required disclosures have been made to the consumer.64 With regard to
reports prepared for employment purposes, a consumer reporting agency must take precautions to
insure the accuracy of public record information that may be included in the report.65 The
consumer must be notified that such information is being reported and be given the name and
address of the person to whom the information is being reported; or the agency must “maintain
strict procedures designed to insure that whenever public information which is likely to have an
adverse effect on the consumer’s ability to obtain employment is reported it is complete and up to
date.”66
Responsibilities of Furnishers of Information
Many types of businesses and organizations contribute information to consumers’ credit files. The
major credit reporting agencies classify contributors of information into the following categories:
“automobile dealers; banks, clothing, department, and variety stores; finance agencies; grocery
and home furnishing dealers; insurers; jewelry and camera stores; contractors; lumber, building
materials, and hardware suppliers; medical-care providers; national credit card companies and
airlines; oil companies (credit card divisions); personal services other than medical; mail-order
houses; real estate agents; hotel keepers; sporting goods and farm and garden supply dealers;
utilities; fuel distributors; government agencies (e.g. the Federal Housing Administration and the
Veterans Administration); wholesalers; advertisers; and collection agencies.”67
Generally, any person who has information related to a consumer’s financial activities can report
information about that person’s transactions and experiences with the consumer to a consumer
reporting agency. However, a person or business with information about a consumer is not
60 15 U.S.C. §1681e(a)
61 Id.
62 15 U.S.C. §1681e(d). For discussions of the responsibilities of furnishers of information and users of credit reports,
see relevant sections following in this report.
63 15 U.S.C. §1681d(a), (b).
64 15 U.S.C. §1681d(d).
65 15 U.S.C. §1681k.
66 15 U.S.C. §1681k(a)(1), (2).
67 Miller, supra note 9, p. 298.
Congressional Research Service
8
Fair Credit Reporting Act: Rights and Responsibilities
required to report that information to a consumer reporting agency. If negative information is
reported, the furnisher must notify the consumer in writing.68
Persons who furnish information to consumer reporting agencies have a duty to provide accurate
information. Under the FCRA, a furnisher may not provide any information relating to a
consumer to a consumer reporting agency if the person knows or has reasonable cause to believe
that the information is inaccurate.69 Furnishers of information are also prohibited from furnishing
information if they have been notified by the consumer that the information they are reporting is
inaccurate.70 Furnishers are also prohibited from furnishing information identified by the
consumer as resulting from identity theft, unless the furnisher subsequently knows or is informed
by the consumer that the information is correct.71 The FCRA requires furnishers of information to
have in place reasonable procedures to prevent information resulting from identity theft from
being refurnished after notification from a consumer reporting agency that such information is
being blocked because it resulted from identity theft.72
In addition to the reinvestigation requirements imposed on consumer reporting agencies,
furnishers of information are also required to investigate disputed information. After a furnisher
of information receives notice from a consumer reporting agency regarding disputed information
in a consumer report, the person furnishing the information must investigate and report the results
to the consumer reporting agency.73 If the furnisher finds that the information is incomplete or
inaccurate, the furnisher must report those results to all other consumer reporting agencies to
which the incomplete or inaccurate information was furnished.74 Furnishers of information must
also notify consumer reporting agencies when an account is closed by the consumer, and when
delinquent accounts are being placed for collection, charged to profit or loss, or subjected to any
other similar action.75
The FCRA also allows consumers to dispute the accuracy of information directly with the
furnisher. Furnishers must investigate the disputed information and report the results to the
consumer within a specified period of time.76 If the information is found to be inaccurate, the
furnisher must notify each consumer reporting agency to which the information was originally
furnished and provide the correct information.77
Requirements for Users of Consumer Reports
As noted above, consumer credit reports can be used only for the purposes specified in the Fair
Credit Reporting Act. Despite these limitations, users of consumer credit reports vary widely. The
68 15 U.S.C. §1681s–2(a)(7).
69 15 U.S.C. §1681s–2(a)(1).
70 Id.
71 15 U.S.C. §1681s–2(a)(6).
72 Id.
73 15 U.S.C. §1681s-2(b)(1).
74 Id.
75 15 U.S.C. §1681s-2(a)(4), (5).
76 15 U.S.C. §1681s-2(a)(8(E).
77 Id.
Congressional Research Service
9
Fair Credit Reporting Act: Rights and Responsibilities
most common users of consumer reports are credit grantors, such as credit card companies. Other
common users include insurers, employers, collection agencies, and government agencies.78 The
FCRA imposes specific requirements on persons who use the information contained in consumer
reports.
Users of consumer reports must follow the requirements set forth in the Fair Credit Reporting Act
if they take any adverse action with respect to any consumer that is based in whole or in part on
any information contained in the consumer’s report.79 If such action is taken, the user must
provide the consumer with oral, written, or electronic notice of the adverse action.80 The notice
must include the name, address, and telephone number of the consumer reporting agency that
furnished the report to the user; and a statement that the consumer reporting agency did not take
the adverse action and is unable to provide the consumer with specific reasons why the adverse
action was taken.81 The consumer must also be notified of his or her right to obtain a free copy of
the consumer report from the consumer reporting agency that furnished the report and of the
consumer’s right to dispute the accuracy or completeness of that report.82 The consumer must also
be given written or electronic disclosure of a credit score used in any adverse action based in
whole or in part on any information in the consumer report, including the range of credit scores,
the factors adversely affecting the score, the date the score was created, and the provider of the
credit score.83
A notice must also be provided by users who grant, extend, or otherwise provide credit on
material terms that are materially less favorable than the most favorable terms available to a
substantial proportion of consumers from or through that user.84 The notice must inform the
consumer that the terms offered to the consumer were set based on information from a consumer
report; identify the consumer reporting agency that furnished the report; inform the consumer that
he or she may obtain a free copy of the consumer report from that agency; provide the contact
information specified by the agency for obtaining such reports; and provide the credit score used
in deciding the credit terms, the range of credit scores, the factors adversely affecting the score,
the date the score was created, and the provider of the credit score.85
The FCRA also imposes duties on users of consumer reports when reports are used in connection
with a credit or insurance transaction not initiated by the consumer. Written solicitations made to
consumers regarding credit or insurance transactions not initiated by the consumer must include a
“clear and conspicuous statement” that information from the consumer’s credit report was used in
78 For descriptions of how each uses the information contained in consumer reports, see Miller, supra note 9, pp. 300–
301.
79 In general, an adverse action is any negative action, such as a denial or termination, taken with respect to the
consumer’s application or continued coverage for credit, insurance, or employment. The FCRA provides a detailed
definition of adverse action at 15 U.S.C. §1681a(k).
80 15 U.S.C. §1681m(a)(1).
81 15 U.S.C. §1681m(a)(3). Particular requirements relate to adverse actions based on information received from third
parties other than consumer reporting agencies. These requirements generally impose a duty on the user to disclose the
reasons for the adverse action and the nature of the information received from the third party. See 15 U.S.C. 1681m(b).
82 15 U.S.C. §1681m(a)(4).
83 15 U.S.C. §1681m(a)(2); the requirement for credit score disclosure was added by §1100F of the Dodd-Frank Act,
supra notes 5 and 6.
84 15 U.S.C. §1681m(h)(1).
85 15 U.S.C. §1681m(h)(5). The subparagraph requiring credit score disclosure (15 U.S.C. §1681m(h)(5)(E)) was added
by §1100F of the Dodd-Frank Act, supra notes 5 and 6.
Congressional Research Service
10
Fair Credit Reporting Act: Rights and Responsibilities
connection with the transaction; the consumer received the offer for credit or insurance because
he or she satisfied specified criteria; and the credit or insurance may not be extended if, after the
consumer responds to the offer, the consumer does not meet additional criteria used to determine
creditworthiness or insurability.86 The statement must also inform the consumer of his/her right to
prohibit information contained in his/her file from being used in connection with any transaction
he/she did not initiate and how he/she may exercise this right.87
Identity Theft Provisions
The FCRA includes a number of provisions aimed at preventing identity theft and assisting
victims of identity theft.88 These provisions mirror laws passed by state legislatures and create a
national standard for addressing consumer concerns with regard to identity theft and other types
of fraud.89 They impose responsibilities on consumer reporting agencies, furnishers of
information, and users of consumer credit reports, and provide consumers with rights for
protecting the information in their files and insuring that the information contained in them is
accurate.
Credit card issuers are required to follow certain procedures when they receive a request for an
additional or replacement card within a short period of time following notification of a change of
address for the same account.90 In a further effort to prevent identity theft, credit card account
numbers must be truncated on electronically printed receipts,91 and, upon request, social security
numbers must be truncated on credit reports provided to a consumer.92 Because hundreds of
apparently frivolous lawsuits were being brought for willful noncompliance where the expiration
date of a credit card was on a receipt although the number was truncated and there was no
allegation of injury to consumers, a 2008 amendment to the FCRA clarified that the mere printing
of the expiration date did not constitute willful noncompliance if the receipt otherwise complied
with the FCRA.93
86 15 U.S.C. §1681m(d)(1).
87 Id. See also 15 U.S.C. §1681b(e).
88 For more information on identity theft issues and the Red Flags Rule, discussed infra, see CRS Report R40599,
Identity Theft: Trends and Issues, by Kristin M. Finklea.
89 Generally, many of these federal provisions preempt similar state laws. For more information on the preemptive
effects of the Fair Credit Reporting Act, see CRS Report RS21449, Fair Credit Reporting Act: Preemption of State
Law, by Margaret Mikyung Lee.
90 15 U.S.C. §1681m(e)(1)(C). These are part of the Red Flag guidelines and rules designed to prevent identity theft.
91 15 U.S.C. §1681c(g).
92 15 U.S.C. §1681g(a)(1)(A).
93 Credit and Debit Card Receipt Clarification Act, P.L. 110-241, §3(a), 122 Stat. 1565 (2008) (codified at 15 U.S.C.
1681n(d)). The U.S. Supreme Court recently granted certiorari to United States v. Bornes, No. 11-192 (January 13,
2012), http://www.supremecourt.gov/orders/courtorders%5C011312zr.pdf, to decide whether the Little Tucker Act, 28
U.S.C. 1346(a)(2), waives the sovereign immunity of the United States with respect to damages actions for violations
of the FCRA. The federal government allegedly violated the FCRA prohibition against printing the expiration date of a
consumer’s credit card on a receipt provided at the point of sale or transaction. The plaintiff/respondent had received
electronic internet and email receipts displaying the expiration date of the personal credit card he used to pay
government filing fees for a client’s lawsuit.
Congressional Research Service
11
Fair Credit Reporting Act: Rights and Responsibilities
Consumers who have been victims of identity theft, or expect that they may become victims, can
have fraud alerts placed in their files.94 A consumer may request a fraud alert from one consumer
reporting agency and that agency is required to notify the other nationwide consumer reporting
agencies of the alert.95 In general, fraud alerts are to be maintained in the file for 90 days, but a
consumer may request an extended alert which is maintained for up to seven years. The fraud
alert becomes a part of the consumer’s credit file and is thus passed along to all users of the
report. The alert must also be included with any credit score generated using the consumer’s
file.96
In addition to the fraud alert, victims of identity theft may have information resulting from the
crime blocked from their credit reports.97 After receiving proof of the consumer’s identity, a copy
of an identity theft report, the identification of the alleged fraudulent information, and a statement
by the consumer that this particular information does not relate to any transaction he/she
conducted, a consumer reporting agency must block this particular information from being
reported and must notify the furnisher of the information in question that it may be the result of
identity theft. Requests to block information must also be referred to other consumer reporting
agencies.98
Victims of identity theft may request information about the alleged crime. A business entity is
required, upon request and subject to verification of the victim’s identity, to provide copies of
application and business transaction records evidencing any transaction alleged to be a result of
identity theft to the victim without charge or to any law enforcement agency investigating the
theft and authorized by the victim to receive the records in question.99
Pursuant to FACT Act amendments in 2003,100 the federal agencies regulating the financial
services industry promulgated guidelines and regulations, known as the Red Flags Rule, requiring
financial institutions and creditors to establish reasonable policies and procedures to prevent
identity theft.101 The Red Flags Rule had an effective date of January 1, 2008, and a mandatory
compliance date of November 1, 2008, but the mandatory compliance date was delayed several
times due in part to controversy over the scope of entities covered by the rule as creditors.102 The
final mandatory compliance date was December 31, 2010, permitting time for Congress to enact
the Red Flag Program Clarification Act of 2010,103 clarifying that creditors covered by the rule do
not include businesses that advance funds for expenses incidental to the services they offer, such
94 15 U.S.C. §1681c-1.
95 15 U.S.C. §§1681c-1(a)(1)(B) and 1681s(f)(1).
96 15 U.S.C. §1681c-1(a)(1)(A).
97 15 U.S.C. §1681c-2.
98 15 U.S.C. §1681s(f)(1).
99 15 U.S.C. §1681g(e).
100 Section 114 of the FACT Act, supra note 3, made amendments codified at 15 U.S.C. §1681m(e).
101 72 Fed. Reg. 63718 (2007). The Dodd-Frank Act did not transfer authority to prescribe regulations with regard to
the Red Flags requirements to the CFPB; such authority is retained by the federal banking agencies as well as the
National Credit Union Administration, the Federal Trade Commission, the Commodity Futures Trading Commission,
and the Securities and Exchange Commission.
102 See 156 Cong. Rec. H8059-60 (daily ed. December 7, 2010); 156 Cong. Rec. S8288-89 (daily ed. November 30,
2010); Federal Trade Commission, FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule (2010), at
http://www.ftc.gov/opa/2010/05/redflags.shtm; Federal Trade Commission, FTC Extends Enforcement Deadline for
Identity Theft Red Flags Rule (2009), at http://www.ftc.gov/opa/2009/10/redflags.shtm.
103 P.L. 111-319, 124 Stat. 3457 (2010), codified at 15 U.S.C. §1681m(e)(4).
Congressional Research Service
12
Fair Credit Reporting Act: Rights and Responsibilities
as lawyers, doctors, dentists, etc. Creditors subject to the rule are entities that “regularly and in
the ordinary course of business” obtain credit reports in connection with credit transactions,
furnish information to consumer reporting agencies in connection with credit transactions, and
extend credit based on an obligation to repay.
Author Contact Information
Margaret Mikyung Lee
Legislative Attorney
mmlee@crs.loc.gov, 7-2579
Congressional Research Service
13