Title 15 › Chapter CHAPTER 41— - CONSUMER CREDIT PROTECTION › Subchapter SUBCHAPTER III— - CREDIT REPORTING AGENCIES › § 1681g
Consumer credit reporting companies must give you a clear copy of everything in your file when you ask. They must leave out the first 5 digits of your Social Security number if you ask and prove your identity. They do not have to include credit or risk scores in that file copy unless you ask for a score. The report must show where each item came from (with a narrow exception for some investigative files), who asked for a report about you (for jobs in the past 2 years and for other purposes in the past 1 year; names and, if you ask, addresses and phone numbers), the dates, payees, and amounts of any checks that led to negative entries, and a record of unsolicited credit or insurance inquiries in the past year. If you asked for the file but not a score, they must tell you that you can request your credit score. The federal consumer bureau will make a short "summary of rights" that the agency must give you with every written file disclosure, plus contact info, a list of federal enforcement agencies, a note that you may have extra state rights, and a statement that accurate negative information will not be removed unless it is outdated or cannot be verified. If you say you are an identity-theft victim, the bureau will make a model summary of identity-theft rights, and 60 days after that model is final, credit agencies must give that summary and how to contact the bureau. A business that handled credit, payments, goods, or services used by someone who stole your identity must give you copies of applications and records showing the fraudulent transactions within 30 days after you make a written request and prove your identity and the theft (for example with ID and a police report or a signed affidavit). The request must be written and may ask for transaction details; the records must be free. A business can refuse in limited, good-faith situations. Disclosures made in good faith under these rules are protected from liability, and businesses are not forced to keep records they do not already keep. The identity-theft rules took effect 180 days after December 4, 2003, and the Comptroller General had to report on how well they work 18 months after that date. If you ask for a credit score, the agency must also give you a notice with your current or most recent score, the score range, the date, the name of who provided the score, and up to 4 key reasons that hurt your score (inquiries can be listed without that 4-item limit). Agencies do not have to create or keep scores they do not already have, and mortgage lenders using scores for 1- to 4-unit home loans must give the same score info and a special notice. Any contract term that tries to stop disclosure of a credit score is void.
Full Legal Text
Commerce and Trade — Source: USLM XML via OLRC
Legislative History
Reference
Citation
15 U.S.C. § 1681g
Title 15 — Commerce and Trade
Last Updated
Apr 6, 2026
Release point: 119-73