Last reviewed: 6 October 2026

Home › Credit help › Your FCRA rights

Your main rights under the Fair Credit Reporting Act, in plain language

The federal Fair Credit Reporting Act (FCRA) is the law behind your rights over what credit reporting companies keep and share about you. This page lists eight of them, each tied to the section of the statute that creates it, with a link to the guide that goes deeper. It reports what the statute says; it does not apply it to your situation.

The eight rights at a glance

1. See what is in your file (§ 1681g)

A credit reporting company must, on request, clearly and accurately disclose all information in your file, the sources of the information, and the people who procured a report on you in the last year (two years for employment purposes). It must also give you a record of inquiries in the last year that identified you in connection with a credit or insurance transaction you did not start.^[1] See what is a credit report.

2. A free copy (§ 1681j)

The statute says each nationwide company must make disclosures once during any 12-month period on request and without charge, and that the request must come through the centralized source.^[2] It adds free disclosures after an adverse action notice, for people who are unemployed and about to apply for work, receive public welfare assistance, or have reason to believe their file is inaccurate due to fraud, and in connection with fraud alerts.^[2] See how to get your free credit reports.

3. Dispute and get a reinvestigation (§ 1681i)

If you dispute the completeness or accuracy of an item and notify the company, it must, free of charge, conduct a reasonable reinvestigation before the end of 30 days from receiving your notice.^[3] The details in the statute:

• The 30 days can be extended by up to 15 days if you send relevant information during the period. The extension does not apply if the item is found inaccurate or incomplete, or cannot be verified.^[3]
• Within 5 business days of getting your dispute, the company must notify whoever provided the disputed information, with all the relevant information you sent.^[3]
• It must review and consider all relevant information you submit.^[3]
• If an item is found inaccurate or incomplete or cannot be verified, the company must promptly delete or modify it and notify the furnisher.^[3]
• A deleted item may not be put back unless the furnisher certifies it is complete and accurate. If it is put back, the company must tell you in writing within 5 business days.^[3] See when a deleted item comes back.
• The company may stop a reinvestigation if it reasonably decides the dispute is frivolous or irrelevant, and must tell you within 5 business days, with its reasons.^[3] See why mass disputing does not work.

For disputing directly with the company that reported the item, see furnishers and your dispute rights. If a dispute comes back verified, see what you can do next.

4. Time limits on old information (§ 1681c)

Section 1681c(a) says a report may not contain:^[4]

• bankruptcy cases more than 10 years old, from the date of the order for relief;^[4]
• civil suits, civil judgments and records of arrest more than 7 years old from the date of entry, or until the governing statute of limitations has expired, whichever is longer;^[4]
• paid tax liens more than 7 years old from the date of payment;^[4]
• accounts placed for collection or charged to profit and loss more than 7 years old, with the 7 years starting 180 days after the delinquency that immediately preceded the collection activity or charge-off (§ 1681c(c));^[4]
• any other adverse item of information, other than records of criminal convictions, more than 7 years old.^[4]

Those five limits do not apply to a report used for a credit transaction of $150,000 or more, life insurance underwriting of $150,000 or more, or employment at an annual salary of $75,000 or more.^[4] See how long negative items stay on your credit report and civil judgments and tax liens.

5. Limits on who can get your report (§ 1681b)

A company may furnish a report “under the following circumstances and no other,” such as a court order, your written instructions, a credit transaction involving you, employment purposes, insurance underwriting, or a legitimate business need in a transaction you started.^[5] For employment, with limited exceptions, the employer must first give you a stand-alone written disclosure and get your written authorization.^[5] See who is actually allowed to pull your credit report.

6. A notice when a report is used against you (§ 1681m)

Anyone who takes adverse action against you based in whole or in part on information in a consumer report must give you notice. It must include the name, address and phone number of the credit reporting company that supplied the report, a statement that the company did not make the decision and cannot give the specific reasons, and notice of your right to a free copy within 60 days and to dispute accuracy. If a credit score was used, the user must disclose it.^[6] See adverse action notices.

7. Fraud alerts and security freezes (§ 1681c-1)

• Initial fraud alert: if you assert in good faith a suspicion that you have been or are about to become a victim of fraud, including identity theft, the company must place an alert in your file for at least 1 year.^[7]
• Extended alert: with an identity theft report, the alert lasts 7 years, and you are excluded from prescreened credit and insurance offer lists for 5 years.^[7]
• Security freeze: a restriction that prohibits the company from disclosing your report to anyone requesting it. It must be placed free of charge within 1 business day of a phone or secure electronic request, or 3 business days of a mailed request.^[7]
• Lifting a freeze: it stays until you ask to remove it. Removal must be free and done within 1 hour of a phone or secure electronic request, or 3 business days of a mailed request.^[7]

See credit freezes, locks and fraud alerts and blocking fraudulent information.

8. Going to court (§§ 1681n, 1681o, 1681p)

• Willful violations: a person who willfully fails to comply is liable for your actual damages or damages of not less than $100 and not more than $1,000, any punitive damages the court allows, and costs and reasonable attorney’s fees in a successful action.^[8]
• Negligent violations: a person who is negligent in failing to comply is liable for actual damages, plus costs and reasonable attorney’s fees in a successful action.^[9]
• Deadline: an action must be brought no later than the earlier of 2 years after you discover the violation or 5 years after the violation occurs.^[10]

Whether a particular failure is willful or negligent, and what damages apply, is for a court to decide. A lawyer can tell you how the deadline applies to you; see free legal help for debt problems.

What the law does not do

The statute says each company must give you a summary of your rights with every written disclosure, along with a statement that a credit reporting company is not required to remove accurate derogatory information from your file, unless the information is outdated under section 1681c or cannot be verified.^[1] The package must also say you may have additional rights under state law, and list the federal agencies that enforce the FCRA.^[1] The CFPB’s model summary is published as Appendix K to Regulation V (12 C.F.R. Part 1022).^[11]

What this page does not cover

It does not cover state credit reporting laws, the separate debt collection laws, or whether any company has broken the FCRA in your case. It is general information, not legal advice. Our Standard checks companies against published points; it does not decide FCRA claims.

Your next step

Pick the right that matches your situation and read the guide linked above it. To report a problem, see where to file a credit, debt or scam complaint. To check a company that offers credit help, use the Register and our guide to checking a company yourself.

When we will update this page

We revisit it when the cited FCRA sections change. Sources last read 6 October 2026.