Who Can Check Your Credit? Permissible Purpose Under the FCRA

Last updated October 7, 2026 · 1,251 words · Credit Checks

Only parties with a permissible purpose under the Fair Credit Reporting Act can lawfully obtain your credit report. That usually means a lender, insurer, landlord, or employer acting on an application you submitted, plus a few other categories the statute names. You also have the right to request your own report.

This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.

Key takeaways

A business may obtain your credit report only when it has a permissible purpose under the FCRA, such as reviewing an application you submitted or collecting an account you owe.
Employment screening is one of the few categories that requires written authorization from the consumer rather than an application alone.
Hard inquiries follow applications and typically remain on a credit report for 2 years, while soft inquiries are visible to you but are not shared with lenders evaluating a new application.
Under the FCRA, consumers can obtain a free credit report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com.
An initial fraud alert lasts 1 year, an extended fraud alert lasts 7 years, and a security freeze is free to place, temporarily lift, or remove under federal law.
The FCRA was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003.

In the United States, a credit reporting agency may release your file to another party only when that party has a permissible purpose under the Fair Credit Reporting Act. A permissible purpose is a specific reason the law recognizes, usually tied to an application you submitted for credit, insurance, a rental, or a job. Without one, a business cannot lawfully pull your credit report.

What "permissible purpose" means under the FCRA

The Fair Credit Reporting Act, 15 U.S.C. section 1681, governs who may obtain a consumer report and for what reasons. The statute lists the situations in which the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — may furnish a file to a third party, and a requester generally certifies its purpose when it orders the report.

Two details shape how this works in practice. First, the permissible purpose belongs to the requester, not to the consumer: a lender does not need a separate permission slip when you submit an application, because the application itself creates the purpose. Second, a few categories require more than a purpose — employment screening, for instance, requires written authorization. The Consumer Financial Protection Bureau maintains consumer-facing material on credit reports and scores that covers these rules.

Who is allowed to run a credit check

The categories below are the ones most consumers encounter. State law can be stricter than federal law in areas such as insurance and employment, so a party that qualifies under the FCRA may still face additional limits in a particular state.

Who requests the report	Permissible purpose	What the consumer provides
Bank, credit union, or card issuer	Evaluating an application for credit, or reviewing an existing account	An application
Landlord or property manager	Screening a rental application	An application
Insurer	Underwriting a policy, where state law allows the use of credit information	An application
Employer or prospective employer	Hiring, promotion, or retention screening	Written authorization
Utility, wireless, or other service provider	Deciding whether to extend service or require a deposit	An application
Debt collector	Collecting an account the consumer owes	Nothing new; the existing account is the purpose
Government agency	Child support enforcement, licensing, and certain benefit determinations authorized by law	Varies by program
The consumer	Reviewing one's own file	Proof of identity

Two rows deserve extra attention. Existing creditors may review a file to monitor an account or decide whether to change its terms; that is an account review rather than a new application, and it appears as a soft inquiry. Debt collectors may obtain a file when collecting a debt, which is why an old account can generate an inquiry even when no new application has been submitted.

Hard inquiries versus soft inquiries

Not every permitted look at your file is treated the same way. Inquiries fall into two groups.

Hard inquiries follow an application the consumer initiates — a credit card, auto loan, mortgage, or rental. They are visible to other lenders and are the type addressed in credit-scoring models.
Soft inquiries cover everything else: your own requests for your file, a creditor's periodic account review, prescreened offers, and most employment checks. They are shown to you but are not shared with lenders who later evaluate an application.

Hard inquiries typically remain on a credit report for 2 years. Their influence on a credit score is small compared with other factors: new credit accounts for roughly 10% of a FICO score, while payment history is about 35% and amounts owed about 30%. VantageScore uses its own factor weighting and does not publish fixed percentages. The guides on how credit scores are calculated and FICO versus VantageScore explain how the pieces fit together.

What is not a permissible purpose

The list in the statute is specific, and several common assumptions do not qualify.

A business cannot pull a file out of curiosity, or to look into a competitor's customer.
A marketer cannot obtain a file merely because it wants to send an offer. Prescreened offers of credit are a separate statutory arrangement that runs on soft inquiries, and consumers may opt out of receiving them, as the CFPB explains.
An employer cannot obtain a file without written authorization, and cannot use one for a purpose unrelated to employment.
An individual cannot order a report on another person without a permissible purpose of their own.

How to see who has checked your credit

A consumer report contains an inquiries section that lists the parties that obtained the file and the dates involved. Because hard inquiries are tied to applications, that section often functions as a record of where credit has been sought. It sits alongside the other sections of a file: identifying information, account history, collections, and public records.

If an entry does not match anything the consumer recognizes, the FCRA provides the right to dispute the information with the credit reporting agency. The agency generally must investigate a dispute within 30 days; that period can extend to 45 days if the consumer provides additional information during the initial 30-day window. The credit reports hub walks through each section of a file, and the credit check overview covers how inquiries fit into the wider picture.

Fraud alerts, security freezes, and files pulled after identity theft

Federal law also addresses situations in which someone else's application, rather than your own, leads to a file being pulled. FCRA section 605A (15 U.S.C. section 1681c-1) covers fraud alerts, and section 605B (15 U.S.C. section 1681c-2) covers blocking information that resulted from identity theft when a consumer submits an identity theft report.

An initial fraud alert lasts 1 year, while an extended fraud alert lasts 7 years.
A security freeze is free to place, temporarily lift, or remove under federal law.
If your identity is stolen, it can be reported at IdentityTheft.gov and to the IRS using Form 14039.

The identity theft guide, the credit freeze overview, and the credit monitoring guide cover how each tool limits or documents access to a file.

How long different items stay on a report

Timelines vary by item and by the source of the information. The table below summarizes periods set by federal law and standard reporting practice.

Item	How long it stays on a report
Hard inquiry from a credit application	Typically 2 years
Late payment and most other negative information	7 years
Chapter 13 bankruptcy	7 years
Chapter 7 bankruptcy	10 years
Initial fraud alert	1 year
Extended fraud alert	7 years

Why the rules exist

The permissible purpose requirement keeps a credit file from functioning as an open public record. The same file that a lender reviews for a mortgage application cannot be obtained by a neighbor, a list broker, or an employer without authorization. That structure also explains the consumer side of the law: the FCRA was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003, and today it gives consumers a free report from each nationwide agency every 12 months, with the three agencies currently providing free reports weekly through AnnualCreditReport.com.

Because most credit scores, including FICO and VantageScore, use a range of 300 to 850, consumers often assume that every inquiry carries the same weight. In practice, the type of inquiry, who requested it, and why matter as much as the request itself — and only a subset of permitted requests is visible to other lenders at all.

This page is published for educational purposes only. It explains how federal credit reporting rules work and is not financial advice.

Compare three-bureau credit scores and reports from a single place. Educational links, disclosed below.

Three Bureau Credit Scores and Reports

CreditMonitored.com may earn a commission from partner links at no additional cost to you.

Frequently asked questions

Can anyone check my credit without my permission?

Under the FCRA, a party needs a permissible purpose rather than permission in most cases. A lender reviewing an application you submitted has that purpose from the application itself. A few situations, such as employment screening, require written authorization. Parties with no permissible purpose cannot lawfully obtain the file.

Does checking my own credit affect my scores?

No. A request you make for your own report is a soft inquiry. Soft inquiries are shown to you but are not shared with lenders who later evaluate an application, so they are not part of the credit-scoring factors that hard inquiries feed into.

How long do hard inquiries stay on my credit report?

Hard inquiries typically remain on a credit report for 2 years. Their share of a score is smaller than other factors; new credit is about 10% of a FICO score, compared with payment history at roughly 35% and amounts owed at about 30%.

Can a landlord or property manager run a credit check?

Yes. Screening a rental application is a recognized permissible purpose under the FCRA. Some states place additional limits on how rental screening information may be used or what fees may be charged, so the rules can differ by location.

Can an employer pull my credit report?

An employer or prospective employer may obtain a consumer report for hiring, promotion, or retention screening only with the consumer's written authorization. State law may be stricter than federal law, and some roles are subject to additional restrictions.

What happens if I see an inquiry I do not recognize?

An unrecognized inquiry can be disputed with the credit reporting agency, which generally must investigate within 30 days; that period can extend to 45 days if additional information is provided during the initial 30-day window. If the inquiry points to identity theft, it can also be reported at IdentityTheft.gov and to the IRS using Form 14039.