You open your credit report and see a card company you do not remember. Maybe you applied. Maybe you did not. Before you worry, it helps to know the rule that decides who gets to look. This explainer walks through it one step at a time, and it is educational only, not advice for your situation.
The rule behind every credit report request
The Fair Credit Reporting Act, or FCRA, was enacted in 1970. It controls who can receive a consumer report, which is the formal name for your credit report. A credit reporting company may send your report only for a permissible purpose. That is a reason the law lists. Examples include a credit transaction, insurance, employment, a government license or benefit, or a legitimate business need tied to a transaction you started. The statute itself lays out the list.
A plausible reason is not enough. The request has to match one of the listed categories. The CFPB's 2022 advisory opinion says that getting or using a credit report without a permissible purpose is strictly prohibited. The 1996 amendments to the FCRA added limits aimed at the people who request reports, not only the bureaus that hand them over. You can read the CFPB's plain-language overview in its answer on who can see your report.
Anyone who gets or uses a report under false pretenses may face civil and criminal penalties. The sources I used do not spell out those penalties, so check the statute and the CFPB for details.
When a credit card issuer can check your report
A card issuer or other lender may check your report in connection with a credit transaction. That covers four common situations:
- Reviewing your application for a card.
- Deciding whether to offer you credit.
- Reviewing an account you already hold.
- Collecting on an account that is past due.
The most familiar case is the one you start. You fill out an application. You are asking the issuer to evaluate your credit. The issuer pulls your report to decide. That is a hard inquiry, and it is typically tied to an application you authorized.
Issuers can also look at accounts they already manage. That kind of review is a soft inquiry. Prescreening is another soft inquiry. In prescreening, a creditor uses certain file information to make a firm offer of credit. You have the right to opt out of it. The sources do not explain how to opt out in practice.
The purpose has to be tied to a transaction. So a company with no current or possible credit relationship with you generally has no basis to pull your file. If you did not apply, hold no account, and got no prescreened offer, that pull is worth a closer look.
Hard inquiries, soft inquiries and what they mean for you
Think of the two types as a simple pair. A hard inquiry usually follows an application you made, such as for a card, mortgage or loan. It can temporarily lower your credit scores. The amount varies by person, and the sources do not explain how each scoring model weighs it.
A soft inquiry covers account reviews by lenders or insurers, prescreening, employment screening, and your own requests for your report. It does not affect your scores. Lenders typically cannot see soft inquiries when they review your file.
Both kinds can stay on your report for up to two years. So not every entry means a new application. Two habits can limit extra hard inquiries. First, check whether you are pre-approved before you formally apply. Second, for loans, keep rate shopping inside a short window so similar inquiries group together.
Employers, court orders and other lawful requests
Card issuers are not the only ones who ask. An employer can get your report for employment purposes, but only with your written consent. A request from a current or prospective employer without that consent is a red flag.
Reports can also be released under court orders, grand jury subpoenas, certain child support purposes, or your written instructions. Each has its own requirements. None gives a card issuer a general right to look. The sources do not cover state laws that may add protections, so readers should look up their own state separately.
Questions to ask and signs of an improper request
Start with three questions when you see an inquiry you do not know.
- Does this company have a permissible purpose, and is the request tied to something I started?
- Is it a hard or soft inquiry, and would it have needed my authorization?
- If it came from an employer, did I give written consent?
An unexplained hard inquiry deserves more attention than a soft one, since a hard inquiry normally follows an application you signed. Also watch for requests that identify you by name alone. CFPB guidance says a credit reporting company must properly identify the consumer. A name-only match that pulls in other people with the same name is prohibited.
The sources give no step-by-step dispute process beyond noting that you can submit a complaint to the CFPB. You can review your reports once a year without any effect on your scores. Since the COVID-19 pandemic, the nationwide credit reporting companies have also offered weekly access on request. That makes it easier to spot an unfamiliar name early, and to ask the right question about it.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
