Someone Pulled My Credit Without Permission. Now What?

You check your credit report in March and find a hard inquiry from a bank you have never heard of, dated February 3. No application. No phone call. Your score dropped nine points. You call the bank and get a recording.

Two more show up over the summer. One is from the lender that financed a truck you paid off in 2023. The other is from a property management company in Palm Beach County, dated a week after you toured an apartment and told the leasing agent you were still deciding. You never filled out an application there either.

If someone pulled your credit without permission, that is a violation of the Fair Credit Reporting Act, and you can sue the company that did it. The FCRA lets a business obtain your report only for a listed purpose, like an application you submitted or an account you still have. A pull without one is worth actual damages, or statutory damages of $100 to $1,000 per willful violation, plus attorney’s fees. 15 U.S.C. § 1681n.

Who is allowed to pull my credit report?

Only someone with a permissible purpose under the FCRA, 15 U.S.C. § 1681b. The list is short. A lender you applied to. A creditor reviewing or collecting an account you have with it. An insurer underwriting your policy. An employer, but only after you sign a written authorization on a standalone disclosure form. A landlord or business with a legitimate need tied to a transaction you started. A government agency deciding on a license or benefit.

The statute also lets lenders buy prescreened lists for firm offers of credit, which is why you get card offers in the mail. Those are soft pulls. They do not hurt your score and nobody sees them but you. The problem is hard inquiries, the ones that show up to every other lender for two years and say you went looking for credit.

Everything else is off the list. A former lender whose account you closed. A company you talked to but never applied with. A debt buyer fishing for assets on a debt it cannot verify. An ex-spouse’s lawyer. A curious coworker in a car dealership’s finance office. None of them has a permissible purpose, and the FCRA bars obtaining a report without one. § 1681b(f).

Can a lender I paid off still check my credit?

Not after the account is gone. The “account review” purpose covers a creditor checking whether you still meet the terms of an open account. Once the loan is paid, there is no account to review and no credit to collect. A pull after that date is a pull without a purpose.

The truck lender in the example above is the most common version I see in South Florida. The account closes, the servicing file stays active in some vendor’s system, and the automated review keeps running every six months. The lender will tell you it was a soft inquiry. Sometimes it was. Check your report from all three bureaus, because the same pull can code as hard at one and soft at another.

Can an employer or landlord check my credit without asking?

No. For employment, the FCRA requires a clear written disclosure on a document that contains nothing else, and your written authorization, before the report is pulled. § 1681b(b)(2)(A). A consent line buried in a 12-page application does not count. A verbal “we’ll run a background check” does not count.

For a landlord, the question is whether you started a transaction. If you submitted a rental application, the landlord can pull. If you toured the unit and left, the leasing office has no purpose yet. The pull dated a week after your visit, before any application, is the kind of fact a jury understands without a lawyer explaining it.

What can I recover for an unauthorized credit pull?

It depends on whether the pull was negligent or willful. For negligence, you recover your actual damages and attorney’s fees. 15 U.S.C. § 1681o. For a willful violation, you choose between actual damages and statutory damages of $100 to $1,000 per violation, and the court can add punitive damages and fees. § 1681n(a). A natural person who obtains your report under false pretenses or knowingly without a permissible purpose owes the greater of actual damages or $1,000. § 1681n(a)(1)(B).

Actual damages in these cases are the score drop and what it cost you, the loan you got at a worse rate, the apartment you lost, and the time and worry of chasing a stranger who was reading your file. Willfulness is where most of the value is. A company that pulls credit for a living knows the rules, and a pull with no application on file is hard to explain as an honest mistake.

You have two years from the day you discovered the pull, or five years from the pull itself, whichever comes first. § 1681p. Hard inquiries fall off your report after two years, so the window closes quietly if you are not checking.

What should I do first?

Pull all three reports now, not the free score app, and save them as PDFs with the date. List every inquiry you do not recognize, with the date, the company name, and the bureau. Send a short letter to each company asking for the permissible purpose for the pull on that date and a copy of any application or authorization they have in your name. Most will not answer. That silence is evidence.

Do not sign a dispute form the bureau offers that asks the company to “remove” the inquiry. Removing it does not undo the violation, and it erases the record you need.

I am Darren Newhart, a consumer protection attorney in Loxahatchee, Florida. Newhart Legal, P.A. brings FCRA cases in the Southern and Middle Districts of Florida, and these are among the cleanest ones to prove because the pull is already in writing. If there is an inquiry on your report you cannot explain, email a copy of the report or call and we will look at it together.

Questions people ask

Is it illegal to pull someone’s credit report without permission?
Yes. The Fair Credit Reporting Act, 15 U.S.C. § 1681b(f), bars anyone from obtaining a consumer report without a permissible purpose listed in the statute. A person who does so is liable to the consumer, and obtaining a report under false pretenses can also carry criminal penalties.

How much can I get for an unauthorized credit inquiry?
For a willful violation, statutory damages of $100 to $1,000 per violation or your actual damages, plus punitive damages and attorney’s fees, under 15 U.S.C. § 1681n. For a negligent violation, actual damages and fees under § 1681o. An individual who pulled your report under false pretenses owes at least $1,000.

How long do I have to sue for an unauthorized credit pull?
Two years from the date you discovered the violation or five years from the date it happened, whichever is earlier, under 15 U.S.C. § 1681p. Hard inquiries drop off your report after two years, so review your reports regularly and save copies.