Credit Repair Organizations Act

The Credit Repair Organizations Act (CROA), enacted in 1996 as part of the Consumer Credit Protection Act, makes it illegal for anyone charging you money to promise they can improve your credit score by hiding accurate information or falsifying your identity — and it gives you specific rights before you pay a single dollar. If you have been approached by a company promising to "remove bad items," "create a new credit identity," or "fix your credit fast" for an upfront fee, CROA is the law that determines what that company can and cannot legally do. The core rule is blunt: no credit repair company can take money from you until it has actually delivered the services you agreed to pay for, and it cannot legally promise to erase accurate, verifiable, current negative information from your credit file. The Federal Trade Commission and state attorneys general enforce CROA, and you have the right to sue any company that violates it.

Current Law (2026)

Legal Authority

• 15 U.S.C. § 1679 — Findings and purposes: Congress found that access to credit is vital, that consumers frequently seek repair help, and that some firms have seriously harmed consumers, particularly those with low income or limited financial experience.
• 15 U.S.C. § 1679a — Definitions: defines "credit repair organization" (any entity using mail or interstate commerce to sell credit-improvement services for money), excluding nonprofits, creditors helping their own customers restructure debt, and federally insured depository institutions.
• 15 U.S.C. § 1679b — Prohibited practices: forbids false statements to credit bureaus, advising identity falsification, misrepresenting services offered, and collecting any payment before fully completing the contracted service.
• 15 U.S.C. § 1679c — Disclosures: requires a specific written notice, separate from the contract, before signing; specifies content including consumer's right to dispute errors, how long negative items stay on reports, and how to get a free credit report.
• 15 U.S.C. § 1679d — Contract requirements: mandates a written, dated contract specifying payment terms, all services to be provided, completion timeline, company name and address, and a bold cancellation notice near the signature line.
• 15 U.S.C. § 1679e — Right to cancel: gives consumers three business days to cancel any credit repair contract without penalty; requires a two-copy "Notice of Cancellation" form with instructions for exercising the right.
• 15 U.S.C. § 1679f — Non-waiver: any consumer waiver of CROA rights is void; attempting to obtain a waiver is itself a violation of the Act.
• 15 U.S.C. § 1679g — Civil liability: sets damages at the greater of actual harm or total fees paid, plus court-awarded additional damages, plus attorney fees; courts must weigh frequency, nature, and intent of violations.
• 15 U.S.C. § 1679h — Administrative enforcement: FTC enforces under the FTC Act; state attorneys general can sue in federal court on behalf of residents, with notice to the FTC required; the FTC may intervene in any state case.
• 15 U.S.C. § 1679i — Statute of limitations: five years from violation, or from the date a consumer discovers that the company deliberately concealed material information.
• 15 U.S.C. § 1679j — State law: state consumer protection laws remain in effect except where they directly conflict with CROA; in those conflicts, CROA controls.

What Credit Repair Companies Are — and Are Not — Allowed to Do

What's Prohibited (15 U.S.C. § 1679b)

The most common credit repair scams involve practices that CROA makes explicitly illegal:

Removing accurate information: A credit repair company cannot make a truthful, current, verifiable negative item disappear from your credit file. A missed payment that actually happened, a judgment that was actually entered, or a bankruptcy that was actually filed cannot be erased by any legal means. Any company that promises otherwise is either lying or planning to file fraudulent disputes.

Identity manipulation: Some operations coach clients to use a different Social Security number, apply for credit using an Employer Identification Number instead of an SSN, or otherwise create a "new credit identity" to distance themselves from their actual history. This is illegal — both under CROA and potentially under federal identity fraud statutes — and the consumer can face criminal liability, not just the company.

False representations: A company cannot misrepresent what it will do, what it has done, or what you can legally accomplish with a credit file.

Advance fees: Perhaps the most widely violated provision: no credit repair company can charge you anything — no upfront fee, no retainer, no "administrative charge" — until it has fully performed the specific service it agreed to provide. A company that charges you a fee when you sign up, and then begins its work, has already violated CROA.

What You Must Receive Before Signing Anything (15 U.S.C. § 1679c)

Before you sign any contract with a credit repair company, it must give you a separate written disclosure — not buried in the contract, not in fine print, but a standalone document — that tells you:

• You can dispute inaccurate information in your credit report yourself, directly with the credit bureau, at no cost
• Neither you nor any company can legally remove accurate, current, verifiable negative information
• Negative items (other than bankruptcy) stay on reports for up to 7 years; bankruptcy for up to 10 years
• You are entitled to a free credit report if you were denied credit, employment, insurance, or housing in the past 60 days, or if you receive public welfare assistance, or if you believe you are a victim of fraud
• You have the right to sue any company that violates this law

The company must keep a signed copy of this disclosure for two years.

What Must Be in the Contract (15 U.S.C. § 1679d)

If you decide to proceed, the contract must be in writing and include:

• Total payment amount and payment terms
• A complete description of every service to be performed, including any guarantees
• An estimated timeframe for completion, or how long the service will take
• The company's full legal name and principal business address
• A bold, conspicuous cancellation statement right next to your signature line

No work may begin until three business days after you sign — the waiting period is mandatory.

Your Right to Cancel

Under 15 U.S.C. § 1679e, you can cancel any credit repair contract within three business days of signing, for any reason, with no penalty and no obligation to pay. The company must provide a two-copy "Notice of Cancellation" form with your contract. To cancel, you sign and date one copy and deliver or mail it back to the company before midnight of the third business day.

If you paid anything during those three days — which would itself be a violation of the advance-fee prohibition — the company must refund it. Any waiver of your cancellation right is void under 15 U.S.C. § 1679f.

What Legitimate Help Looks Like

CROA does not prohibit all assistance with credit issues. A few categories are explicitly excluded from the definition of "credit repair organization":

• Nonprofit organizations with 501(c)(3) status (including nonprofit credit counseling agencies) are not covered by CROA
• Creditors helping their own customers restructure debt — for example, a bank working with a delinquent borrower on a payment plan
• Banks and credit unions federally insured under the Federal Deposit Insurance Act or the Federal Credit Union Act

Nonprofit credit counseling agencies — which may negotiate with creditors on your behalf, help you set up a debt management plan, and assist with budgeting — operate outside CROA's constraints. But any for-profit company offering "credit repair" services is covered, regardless of whether it uses terms like "credit restoration," "credit optimization," or "credit consulting."

Enforcement and Damages

FTC Enforcement

The FTC treats CROA violations as unfair or deceptive practices under Section 5 of the FTC Act. See also Equal Credit Opportunity Act and Truth in Lending Act for related consumer credit protections. The FTC has brought numerous enforcement actions against credit repair companies, including cases resulting in permanent injunctions, disgorgement of consumer fees, and civil penalties. The FTC does not need to prove that any individual consumer was actually harmed — a pattern of prohibited practices is sufficient.

State Enforcement

State attorneys general can file civil actions in federal court on behalf of state residents under 15 U.S.C. § 1679h. Before suing, they must give the FTC written notice (or immediately if that's not practical). The FTC can then intervene in the state case, be heard on all issues, and appeal any ruling. States can also use their own consumer protection investigative powers in parallel with an FTC investigation.

Private Lawsuits

You do not need the government to act. Under 15 U.S.C. § 1679g, if a credit repair company violates CROA and you are harmed, you can sue directly. Your damages are at least the greater of:

• Your actual harm (money you lost, opportunities you missed because of bad credit advice), or
• The total amount you paid the company

Courts can also award additional damages, and if you win, the company must pay your attorney fees. The five-year statute of limitations means you have substantial time to pursue a claim.

How It Affects You

If you're struggling with bad credit and wondering whether to pay for help: The most important thing to understand is that there is nothing a for-profit credit repair company can legally do that you cannot do yourself for free. Under the Fair Credit Reporting Act (15 U.S.C. § 1681i), you have the right to dispute any inaccurate or incomplete information directly with the credit bureaus — they must investigate within 30 days and correct or delete unverifiable items. You can get your free annual credit report from all three bureaus at annualcreditreport.com (the only federally authorized free source, per FTC). To dispute inaccurate items: write to each bureau individually (Equifax at equifax.com/personal/credit-report-services, Experian at experian.com/disputes, TransUnion at transunion.com/credit-disputes), identify the specific item and why it's wrong, and include documentation. By law, the bureau must notify the furnisher (the creditor who reported the item), investigate, and correct or delete items that can't be verified. Paid credit repair services can do the same thing — but they charge $50–$150/month while you wait, and they can't legally do anything beyond what the law already gives you for free.

If someone is soliciting you to pay upfront for credit repair: This is the clearest CROA violation to watch for. 15 U.S.C. § 1679b(b) explicitly prohibits credit repair organizations from charging any money before the contracted services are fully performed. Any company asking for payment before they've completed the work — even a "processing fee," "setup fee," or "first month" retainer — is violating federal law. Stop the engagement immediately. Do not give them your credit card. Report the company to the FTC at reportfraud.ftc.gov and your state attorney general (most states have parallel credit repair laws with their own enforcement). You are entitled to a 3-day right to cancel any credit repair contract without penalty (§ 1679c) — this window doesn't require any reason, just written notice within three business days of signing.

If you've already paid a credit repair company and believe you were deceived: Review the contract you received (CROA requires a written contract) against these required elements: a complete description of the services, the total amount you'll pay, the company's legal name and business address, and a cancellation clause. If the company: (1) failed to provide the required disclosure statement before you signed, (2) charged you before completing services, (3) made false representations about their ability to remove accurate negative information, or (4) failed to provide the required contract — you have a private right of action under 15 U.S.C. § 1679g for: actual damages, punitive damages, and attorney's fees. The statute of limitations is 5 years from the date of the violation or 3 years from discovery, whichever is later. Many consumer attorneys take these cases on contingency since CROA mandates fee-shifting to the prevailing plaintiff. Find consumer law attorneys at nclc.org/resources/find-an-attorney or the National Association of Consumer Advocates at naca.net/find-attorney.

If you run or are starting a credit counseling or financial coaching service: CROA's coverage is broad: it applies to any "credit repair organization" — defined as any person who provides, or represents that they can provide, services to improve a consumer's credit record in exchange for payment through interstate commerce. The law does not care what you call yourself: "credit coach," "financial advisor," "credit specialist," or "debt consultant" — if you're charging to help people improve their credit reports, CROA applies. The key exemption: nonprofit organizations exempt under 26 U.S.C. § 501(c)(3) are excluded from CROA's coverage entirely. The National Foundation for Credit Counseling (NFCC) at nfcc.org is the trade association for legitimate nonprofit credit counselors; member agencies offer debt management plans (DMPs) and credit counseling at low or no cost. If you're operating a for-profit service, consult CROA compliance guidance — the FTC publishes "How the Credit Repair Organizations Act Protects Consumers" at consumer.ftc.gov — and ensure your client contracts, disclosures, and payment timing meet every statutory requirement before accepting any funds.

State Variations

Many states have their own credit services organization laws that mirror or exceed CROA's protections. California, Texas, Florida, and other states with large populations have active enforcement programs. In some states, the bond requirement for credit repair companies is more stringent than federal law requires, and some states have lower fee caps. In all cases, CROA sets a floor — state law can be more protective but not less.

Common Scams to Watch For

Despite CROA's clear prohibitions, credit repair scams remain among the most common forms of consumer fraud. The FTC regularly warns consumers about:

• "Pay for delete" schemes: Companies that charge to get negative items removed through bulk dispute filings, hoping bureaus fail to verify items in time. Any removals are temporary — verified items return.
• Credit profile number (CPN) scams: Companies selling a nine-digit number to use in place of your SSN. Using a CPN to apply for credit is federal fraud.
• Guaranteed removal claims: No company can guarantee removal of accurate, verifiable negative information. Full stop.
• Monthly subscription fees: Charging recurring fees without completing specific contracted services violates the advance-fee prohibition.

Recent Developments

• CFPB credit repair enforcement paused (2025): The Trump administration's CFPB under Acting Director Vought paused enforcement actions against credit repair organizations as part of a broader pullback of CFPB supervisory activity. The CFPB had previously been active in bringing CROA enforcement actions and issuing consumer warnings about credit repair scams. With federal enforcement reduced, state AGs in California, New York, Illinois, and other states have increased their CROA enforcement activity as a partial offset.
• AI credit repair services: AI-powered credit repair services have proliferated, generating consumer harm and regulatory questions. These services use AI to generate mass dispute letters — targeting all negative items on a consumer's report regardless of accuracy — and charge subscription fees for ongoing "monitoring" and dispute filing. AI-generated mass disputes have overwhelmed credit bureau dispute processing. The FTC and CFPB issued joint guidance in 2024 warning that AI credit repair services marketing "guaranteed" results or charging advance fees without completing services violate CROA.
• Credit score impact of CFPB medical debt rule: The CFPB's 2024 rule removing medical debt from credit reports — finalized under Biden and challenged by the Trump administration — would directly affect credit repair business models that focused on disputing medical collection accounts. If medical debt is removed from reports as a matter of policy, the credit repair value proposition for medical debt cases disappears. The rule's implementation has been litigated; credit repair companies have uncertain business planning as a result.
• Credit repair and Buy Now Pay Later: BNPL accounts are now being reported to major credit bureaus (Experian, Equifax, TransUnion) following CFPB guidance. BNPL trade lines can affect credit scores positively (on-time payments) or negatively (missed payments, high utilization). Credit repair companies are now marketing BNPL-specific services — helping clients dispute inaccurate BNPL reporting — creating a new business line under CROA's framework.