15 U.S.C. 1681b — Who Can Legally Pull Your Credit Report

Most people picture their credit report as a private document, something only they can open. In practice it sits behind a legal gate rather than a locked door: the file is held by the consumer reporting agencies (CRAs) — Equifax, Experian, and TransUnion — and the law decides who gets a key. The statute that hands out those keys is the Fair Credit Reporting Act (FCRA), and the specific section that matters is 15 U.S.C. 1681b. It is short, it is precise, and it is the difference between a lender lawfully checking whether to lend you money and a stranger snooping through your financial history without any right to do so.

The short answer: 15 U.S.C. 1681b lists the only purposes for which a consumer reporting agency may furnish your report and for which a user may obtain it. This is the doctrine known as permissible purpose. If a company’s reason for pulling your report is not on that list, the pull is not allowed — and the FCRA gives you a way to push back, including the right to sue.

What “permissible purpose” actually means

Permissible purpose is the legal hinge of the entire FCRA. The Act does not say a credit report is secret; it says a report may change hands only for a defined set of reasons. A consumer reporting agency is forbidden from handing your file to anyone who cannot point to one of those reasons, and a user — a lender, an insurer, an employer, a landlord’s screening service — commits a violation if it obtains the report for a purpose Congress did not authorize. The burden runs both ways, which is why reputable companies build certification of permissible purpose into their contracts with the bureaus.

It helps to separate this concept from the mechanics of an inquiry. Whether a check shows up as a soft pull vs hard pull is about the type of inquiry and how it touches your score; permissible purpose is the prior legal question of whether the company was allowed to look at all. A pull can be a “soft” inquiry that never dents your score and still be unlawful if there was no permissible purpose behind it. The score impact and the legal authority are two different axes, and 1681b governs the second one.

The permissible purposes the statute lists

Congress did not leave the list to interpretation. Under 1681b, a consumer reporting agency may furnish a report in a handful of clearly enumerated situations. The first is in response to a court order or a federal grand jury subpoena — the legal system can compel disclosure. The second, and the one most directly in your hands, is in accordance with the written instructions of the consumer the report is about. If you authorize it in writing, the bureau may release your file; this is the basis on which you can direct a lender or a landlord to obtain your report on your behalf.

Beyond those, the statute authorizes release to a person the agency reasonably believes intends to use the report for a legitimate purpose tied to you. That covers a credit transaction involving the consumer — extending new credit, reviewing an existing account, or collecting on one. It covers employment purposes, which carry their own extra layer of protection: an employer must obtain the consumer’s written consent and follow additional rules before and after pulling the report. It covers insurance underwriting, and it covers determining eligibility for a government license or benefit when the agency or official is required by law to consider the applicant’s financial responsibility or status.

The list reaches one step further into ordinary commerce. A report may be furnished when a person has a legitimate business need for it in connection with a business transaction the consumer has initiated, or to review an existing account the consumer holds. The word “initiated” carries weight: applying for a loan, opening a wireless account, or renting an apartment initiates the transaction and supplies the purpose. A cold pull by a company you never contacted does not. Finally, the statute permits use in connection with a child-support determination, recognizing that a parent’s financial responsibility is a legitimate subject of those proceedings.

Prescreened offers and your right to opt out

There is one category that surprises people because it does not require any action on their part: prescreening. When you receive a “firm offer” of credit or insurance in the mail — a card you were “preapproved” for, a quote you never requested — a lender or insurer has used a permitted form of access to your report to decide you met its criteria. This is lawful under the FCRA’s prescreening provisions. It is also, for many people, unwelcome.

The trade-off Congress struck was to permit the practice while giving consumers a clean exit. You can opt out of prescreened offers at optoutprescreen.com or by calling 1-888-5-OPTOUT, the official industry line operated for this purpose. Opting out removes your file from the marketing lists the bureaus sell to companies running prescreening campaigns, which both cuts down the junk mail and shrinks the surface area for unwanted access to your report. For a fuller map of the protections you hold across the Act, see our overview of FCRA consumer rights.

When a pull breaks the law — and what you can do

Here is where the doctrine acquires teeth. Pulling a consumer report without a permissible purpose is a violation of the FCRA, full stop. The most common way consumers discover one is the unexpected hard inquiry: a checking of your credit by a company you never applied to, sitting on your report with no transaction behind it. That inquiry may be an impermissible pull. You can dispute it with the bureau, and if the company pulled your file without authority, you may have a claim.

The FCRA sorts those claims into two tracks, and the track matters. A willful impermissible pull falls under 15 U.S.C. 1681n, under which a consumer can recover actual damages or statutory damages of $100 to $1,000 even without proving a dollar of harm, plus the possibility of punitive damages and attorney’s fees. A negligent violation falls under 15 U.S.C. 1681o, which allows recovery of actual damages plus attorney’s fees but not statutory or punitive damages. The willful-versus-negligent line is what decides whether you can collect statutory damages without proving loss, and it is worth understanding before you act — our dedicated guide on FCRA statutory damages — 1681n vs 1681o walks through the distinction in detail so this piece does not have to.

The practical posture is straightforward. Read your reports, flag any inquiry you cannot trace to a transaction you initiated or authorized, and treat an unexplained pull not as a clerical quirk but as a potential statutory violation. 15 U.S.C. 1681b draws the line between lawful and unlawful access; the remedy provisions stand behind it to make the line enforceable. Together they mean your credit file is not quite as exposed as it feels — provided you know who holds the key, and what to do when someone uses one they were never given.

Sources

• 15 U.S.C. 1681b — Legal Information Institute: https://www.law.cornell.edu/uscode/text/15/1681b
• Federal Trade Commission — Fair Credit Reporting Act: https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act
• Consumer Financial Protection Bureau — FCRA: https://www.consumerfinance.gov/