A hard inquiry I did not authorize
Anyone who pulls your credit report needs a permissible purpose under the Fair Credit Reporting Act, such as a credit application you made or the review or collection of an account you have. An inquiry from a company you never dealt with can be a lawful account review, a clerical mistake, or a sign that someone applied for credit in your name. Your file disclosure lists who pulled your report in the past year, and that is where you start.
Your monitoring app flags a new inquiry. The name is a car dealer in another state, a bank you never called, or a company name you cannot place. You did not apply for anything.
An inquiry means someone obtained your consumer report. The law says who may do that, and it gives you the tools to find out who did.
Who may pull your report
A person may not use or obtain a consumer report except for a purpose the FCRA permits (15 U.S.C. § 1681b(f)). The permissible purposes that cover most inquiries are in § 1681b(a)(3):
- A credit transaction. Use in connection with a credit transaction involving you and the extension of credit to you, or the "review or collection of an account" of yours (§ 1681b(a)(3)(A)).
- A business transaction you started. A legitimate business need in connection with a transaction you initiated, or to review whether you still meet the terms of an account (§ 1681b(a)(3)(F)).
- A prescreened offer. A report for a credit or insurance transaction you did not start is allowed only with your authorization or for a firm offer, with an opt-out process (§ 1681b(c)(1)).
So an inquiry is not unlawful just because you did not click "apply." A company that holds your old account, or a collector actually collecting a debt you owe, may have a permissible purpose. A company with no account and no application from you is the concern.
Find out who pulled it
On request, a bureau must disclose all the information in your file and its sources (§ 1681g(a)(1), (2)). It must also identify each person that procured your report in the one year before your request, or in the two years before it if the report was for employment (§ 1681g(a)(3)).
Get your reports free at AnnualCreditReport.com and look at the inquiry section of each. Then sort each unfamiliar name:
- A name you actually know. Dealers and stores often run credit through a lender whose name you would not recognize. Check your records for applications near the inquiry date.
- A collector or debt buyer. Look for collection letters. If the debt is not yours, see someone else's debt on my credit report.
- No connection at all. Call or write the company, ask why it obtained your report, and ask whether an application was made in your name. Keep notes of the date and who you spoke with.
If a company will not explain why it pulled your report, ask again in writing and keep the letter. A company with a permissible purpose can usually name it in a sentence: an application, an account, a debt it is collecting. Silence, or an answer that names none of these, is worth noting.
If it was identity theft
An inquiry tied to an application you never made is often the first visible sign of identity theft. Act on it the same day:
- Freeze or alert. A security freeze is free and must be placed within one business day of a phone or online request; an initial fraud alert lasts at least one year (§ 1681c-1).
- Report it. File an Identity Theft Report at IdentityTheft.gov.
- Block it. Send each bureau the report, proof of identity and a statement identifying the fraudulent information. The bureau must block it within four business days (§ 1681c-2(a)).
Our identity theft post gives the full sequence.
When a pull without a purpose is a claim
A company that obtains your report without a permissible purpose violates § 1681b(f). For a willful violation, the FCRA allows actual damages or statutory damages of $100 to $1,000, plus punitive damages; for a negligent one, actual damages (§§ 1681n, 1681o). A natural person who obtains a report under false pretenses or knowingly without a permissible purpose is liable for actual damages or $1,000, whichever is greater (§ 1681n(a)(1)(B)). The FCRA requires a company found liable to pay the consumer's reasonable attorney's fees and costs.
Be realistic about the facts. A single inquiry by a company that turns out to hold your account is usually lawful. A pull by a company with no relationship to you, especially one tied to a fraudulent application, is worth a closer look. The deadline is the earlier of two years after discovery or five years after the violation (§ 1681p). The credit report errors page covers related claims.
These are federal rules and apply the same way in New York, New Jersey and Florida. See New York, New Jersey and Florida.
What to do this week
- Pull all three reports and list every inquiry you do not recognize, with its date.
- Match each one against your own applications, accounts and collection letters.
- Ask each unknown company in writing why it obtained your report.
- Freeze your credit if any inquiry ties to an application you never made.
- Keep every answer, including a non-answer, in one folder.
Sources: 15 U.S.C. §§ 1681b(a)(3), (c)(1), (f), 1681c-1, 1681c-2, 1681g(a), 1681n, 1681o, 1681p.
Common questions
Can a debt collector pull my credit report?
Often yes. The FCRA's permissible purposes include using a report in connection with a credit transaction involving the review or collection of an account of the consumer. A collector that is actually collecting a debt you owe may have that purpose. A company with no account and no application from you does not.
What is the difference between a hard and a soft inquiry?
Those are industry terms, not terms in the statute. The FCRA's rules turn on purpose, not labels: every pull needs a permissible purpose, and a report for a credit or insurance offer you did not ask for is allowed only with your authorization or for a firm offer, with an opt-out.
What if the inquiry is from identity theft?
Treat it as identity theft. File a report at IdentityTheft.gov, place a fraud alert or freeze, and ask the bureau to block the information. The bureau must block identity-theft information within four business days of receiving the required documents.
Tell us what they did.
One conversation with an attorney, in your language. We tell you which laws the collector or the credit bureau broke, which deadline runs first, and what to save this week. If it is not a case we can take, we say so and tell you where to go.
(718) 484-7510The FDCPA and the FCRA require a company found liable to pay the consumer’s reasonable attorney’s fees and costs. Our fee arrangement is confirmed in a written retainer before we begin. English, Russian and Spanish in-house; an interpreter for any other language.