Independent. No paid placements.Reviewed as findings changeEditorial policyNewsletter
The Credit RecordAn independent record of credit repair and debt settlement companies

Last reviewed: 14 September 2026

Home › The Library › Permissible purpose

Who's actually allowed to pull your credit report

"Running your credit" sounds like something anyone with the right software can do. It isn't. The Fair Credit Reporting Act restricts a credit bureau to handing your file over only for specific, listed reasons, and pulling it outside those reasons is a real legal violation — not a technicality, and not something only a lawyer would care about.

The permissible-purpose list

Under 15 U.S.C. § 1681b, a consumer reporting agency may furnish your report only for reasons the statute actually lists. The ones that come up most often: your own written instructions; a court order or federal grand jury subpoena; a person the bureau has reason to believe intends to use it in connection with a credit transaction involving you, underwriting insurance, or a legitimate business need tied to a transaction you initiated (opening an account, or a creditor reviewing or collecting on one you already have); employment purposes, under the additional rules below; determining your eligibility for a license or government benefit where a statute requires evaluating your financial responsibility; and, for state and local child-support agencies, use in setting or enforcing a support obligation. A bureau handing your file to someone outside this list — a curious acquaintance, a company you've never done business with and never applied to, a landlord you haven't actually applied to rent from — has no lawful basis for doing it, regardless of what that person told the bureau to get it.

Employment pulls carry their own extra layer

Getting a report "for employment purposes" isn't just one more item on the list above — § 1681b(b) adds real procedural requirements on top of it. The employer has to give you a clear, standalone disclosure that a consumer report may be obtained for employment purposes — a document that generally can't be buried inside a job application form — and you have to authorize it in writing (or orally or electronically, depending on context) before the report is pulled. If the employer later wants to take an adverse action based on what's in it — not hiring you, or letting you go — a separate FCRA provision, 15 U.S.C. § 1681m, requires a "pre-adverse action" notice first, including a copy of the actual report and a summary of your rights, giving you a real chance to review and dispute anything in it before the decision is finalized, followed by a second, final adverse-action notice once the decision is made. A background-check report that contains medical information triggers an even narrower rule: it can only be obtained with your specific written consent describing exactly what it will be used for.

Hard inquiries vs. soft inquiries — and why the difference matters for your score

Not every permissible pull affects your credit score the same way. A "hard" inquiry happens when you've actually applied for new credit — a card, a loan, a lease requiring a credit check — and it can cause a small, generally short-lived dip in a FICO or VantageScore score. A "soft" inquiry — you checking your own report, an existing creditor reviewing your account, a lender pre-screening you for a firm offer you didn't apply for — is also a permissible purpose under the statute, but it doesn't affect your score at all and isn't visible to other lenders. If you're rate-shopping for a mortgage, auto loan, or student loan specifically, FICO's scoring models deliberately treat multiple inquiries of that same loan type within a set window — 45 days under newer FICO versions, 14 days under some older ones — as a single inquiry rather than several, on the reasoning that you're shopping for one loan, not applying for several separate ones. That deduplication doesn't extend to credit cards or to mixing loan types, so five auto-loan applications and two mortgage applications in the same week would still generally count as two inquiries, not one.

See what's actually been pulled. Every free annual credit report from each bureau (available weekly at annualcreditreport.com, the only site required by federal law to provide them) lists recent inquiries on your file. It's the most direct way to see whether something was pulled that you don't recognize.

What an unauthorized pull actually is — and the real remedy for it

A pull outside the permissible-purpose list isn't just bad practice, it's independently unlawful — and it's a pattern that shows up in exactly the kind of pressured sales situation this site covers: a company running your credit before you've signed anything or given consent, or reusing an old authorization for a new purpose you never agreed to. The FCRA gives you a real remedy for it. Under 15 U.S.C. § 1681n, a willful violation — including obtaining a report under false pretenses or knowingly without a permissible purpose — carries statutory damages of at least $100 and up to $1,000 per violation, without your having to prove any specific dollar loss, plus potential punitive damages and attorney's fees; a natural person — an individual, not a company — who obtains a report under false pretenses or knowingly without a permissible purpose faces an even higher statutory floor: actual damages or $1,000, whichever is greater. A merely negligent violation, under 15 U.S.C. § 1681o, still allows recovery of actual damages and fees, just without the no-proof-required statutory floor. None of this requires you to have lost money for a claim to exist — the unauthorized pull itself is the violation.

Before you sign anything with a lender, dealer, or landlord: ask specifically what your authorization is being used for and whether it's a hard or soft pull. A company that resists a plain answer to that question, or that already pulled your file before you agreed to anything, is a genuine warning sign — see our warning-signs checklist for others like it.
Related: see FICO vs. VantageScore, explained for how the two scoring models weigh inquiries differently, and credit freezes, locks, and fraud alerts for the separate tool that blocks a new pull from succeeding at all.

References

  1. Fair Credit Reporting Act, 15 U.S.C. § 1681b (permissible purposes of consumer reports) — subsection (a) (the enumerated list, including consumer-authorized, court-ordered, credit/insurance/business-transaction, and child-support-agency uses) and subsection (b) (additional disclosure and authorization requirements for employment purposes, including the medical-information consent rule).
  2. 15 U.S.C. § 1681m (requirements on users of consumer reports taking adverse action, including the pre-adverse-action notice and report copy, and the final adverse-action notice).
  3. 15 U.S.C. §§ 1681n and 1681o (civil liability for willful and negligent noncompliance, respectively, including the $100-$1,000 statutory-damages floor for willful violations and the heightened $1,000-or-actual-damages floor specific to obtaining a report under false pretenses or knowingly without a permissible purpose).
  4. myFICO, "The Facts About Credit Inquiries" and "How to Rate Shop and Minimize the Impact to Your FICO Scores" (hard vs. soft inquiry scoring treatment; 45-day and 14-day rate-shopping deduplication windows depending on FICO model version); Experian, "Do Multiple Loan Inquiries Affect Your Credit Score?" (independent corroboration of the deduplication mechanism and its limits by loan type).
  5. Federal Trade Commission and Consumer Financial Protection Bureau consumer guidance on annualcreditreport.com as the sole federally mandated source for free annual (and, currently, weekly) credit reports from each of the three nationwide bureaus.

Related