Title 15 › Chapter CHAPTER 41— - CONSUMER CREDIT PROTECTION › Subchapter SUBCHAPTER III— - CREDIT REPORTING AGENCIES › § 1681m
Businesses and other users must tell you when they take a negative action about you that is based on a consumer report. They must give you a notice by phone, in writing, or electronically. The notice must say which consumer reporting company gave the report and that the company did not make the decision. It must give you a numeric credit score used in the decision and the specific explanations the law requires. The notice must tell you that you can get a free copy of your consumer report from that reporting company if you ask within 60 days, and that you can dispute wrong or incomplete information with the reporting company. If your credit was denied or made more expensive because of information from someone other than a consumer reporting company, the user of that information must tell you, if you send a written request within 60 days of learning about the denial, what the information was. If the decision was based on information from a related or affiliated company, you must be told you can ask for the information and, if you do in writing within 60 days, the user must give the details within 30 days. The law also says companies have a defense if they can show they had reasonable procedures to try to follow these rules. If a company uses consumer reports to send you preapproved credit or insurance offers you did not ask for, the offer must include a clear statement that your report was used, why you were chosen, that the offer could be withdrawn if you don’t meet the final requirements, and how to stop such offers (including the contact info for the national opt-out system). Companies must keep the selection and underwriting criteria on file for 3 years. Federal agencies must create identity-theft guidelines and require financial institutions and creditors to follow reasonable policies, including special checks when a cardholder’s address changes and a new card is requested within about 30 days. Debts known to result from identity theft may not be sold or collected. Debt collectors must tell the creditor if a debt may be fraudulent and must give victims, on request, the information they would get if they were disputing the debt. If a consumer is offered credit on much worse terms than the best terms the lender gives most people because of a report, the lender must give a notice with similar information. Federal agencies will write rules and model notices, and only federal agencies may enforce these rules; private damage claims under the usual private enforcement sections do not apply.
Full Legal Text
Commerce and Trade — Source: USLM XML via OLRC
Legislative History
Reference
Citation
15 U.S.C. § 1681m
Title 15 — Commerce and Trade
Last Updated
Apr 6, 2026
Release point: 119-73