US credit bureau rules mostly come from the Fair Credit Reporting Act, or FCRA, not from one standalone "bureau rule." It covers how consumer reports are collected, accessed, used, and corrected.
Start by identifying what happened: an inaccurate report, an unauthorized access, or a credit decision based on report data. That choice determines your evidence and next step.
Who is responsible for what?
Equifax, Experian, and TransUnion are nationwide consumer reporting agencies. They maintain consumer files and provide reports to businesses with a legally permitted reason to request them.
Businesses that send account information to a bureau are called furnishers. A lender, debt collector, landlord, insurer, or another company may be one. A bureau can investigate only what its own file contains, so correcting an error may require contacting both the bureau and the furnisher.
Federal law sets the baseline for US consumers. State laws may add protections, so the steps here stay at the federal level.
Match the problem to the rule
The problem usually points to the process.
| Your problem | Main rule or process | First practical step |
|---|---|---|
| Wrong balance, account, name, or payment history | FCRA dispute and reinvestigation rights | Get the report and identify the exact item |
| Account caused by identity theft | FCRA identity theft block | Gather an identity theft report and request a block |
| Unknown credit inquiry | Permissible-purpose rules | Ask the company why it accessed your report |
| Denied credit or worse terms | Adverse-action and notice rules | Read the notice and request the named report |
| New-account identity theft risk | Credit freeze or fraud alert | Contact the bureaus through their official channels |
A single event can trigger several processes. An identity theft victim may need a freeze, a report dispute, and a formal block request.
Get your credit reports before challenging anything
Pull the reports tied to the problem before you write to anyone. The CFPB's instructions for getting free credit reports direct consumers to AnnualCreditReport.com, the official source for federally authorized reports. Certain situations can also qualify you for additional free reports.
Pull the report from every bureau that may have the item. They may show different accounts, balances, addresses, or inquiries.
Review your personal information first. Then check account ownership, payment status, balances, dates, collections, and recent inquiries. A score is not the report itself. Start with the underlying data.
How to dispute an inaccurate credit report
A useful dispute isolates one exact problem and asks for one clear correction. One item. One requested fix. A message that only says, "This is wrong," gives the reviewer little to investigate.
- Save or download the report showing the error. Record the bureau, account name, partial account number, balance, and relevant dates.
- Gather documents supporting that correction. Payment confirmations, account statements, identity theft records, court documents, and creditor letters may help.
- Send the dispute to the bureau reporting the item. If a lender, collector, or other furnisher supplied the data, send that company a direct dispute too.
- Describe what is inaccurate and state what the correct information should be. Keep the explanation factual and focused.
- Use the bureau's online process or mail the dispute as directed. Save the submission, confirmation numbers, postal receipts, and attachments.
- Read the investigation result. Get an updated report if the item changes.
Expect about 30 days in the usual case. The period can reach 45 days if you submit additional relevant information within the first 30 days. A bureau that treats a dispute as frivolous or irrelevant generally must tell you and explain that decision.
Don't dispute accurate information just because it lowers your score. Ask for a correction when the data is incomplete, mixed with another person's file, duplicated, outdated, or otherwise inaccurate.
How long can negative information stay?
Most negative information can generally remain for seven years. Bankruptcy information can generally remain for up to 10 years.
The reporting period depends on the information involved and the legally relevant date. Paying a debt or disagreeing with the result doesn't require removal of accurate, current negative information.
An obsolete item is different. If it has passed its reporting period, mention that in your dispute and ask which date the bureau used.
When can someone access your credit report?
A credit report isn't public. A requester generally needs a permissible purpose under the FCRA.
Examples include a credit application, review of an existing account, insurance underwriting where permitted, a rental application, or employment with your written permission. Prescreened credit offers follow a different rule and generally involve a firm offer of credit.
The requesting business must certify its purpose to the reporting agency. A soft inquiry isn't automatically exempt. It may not affect your score, but the company still needs a lawful reason to access the report.
An unfamiliar inquiry deserves a closer look. Ask the company what application or account led to it. You can also dispute the inquiry with the bureau and contact the company that made it.
What an adverse-action notice should tell you
An adverse action isn't limited to a credit denial. It can also mean offering materially less favorable terms because of information in a consumer report.
The FCRA generally requires the notice to name the consumer reporting agency whose report was used, say that the agency didn't make the decision, and describe your right to dispute inaccurate information. You can usually request a free copy of the named report within 60 days after receiving the notice.
The CFPB's Regulation B notice rule covers written adverse-action notifications under the Equal Credit Opportunity Act. The FTC's guidance on consumer reports and risk-based pricing explains how different notices can apply.
A higher interest rate isn't automatically an adverse-action decision. Risk-based pricing rules may call for a different notice, so read the document before choosing what to dispute.
Employers follow a separate sequence. They generally need written permission before obtaining a report and must provide required notices before taking adverse action based on it. Landlords and insurers can have role-specific duties too.
Credit freezes and fraud alerts
Freezes and fraud alerts address future access, not existing report errors. A credit freeze limits access to your file for most new-credit requests. It is free, and it stays in place until you ask the bureaus to remove it.
| Tool | How it works | What to remember |
|---|---|---|
| Credit freeze | Limits access to your file for most new-credit requests | It doesn't erase fraudulent accounts or correct inaccurate information |
| Fraud alert | Asks businesses to take extra steps to verify your identity before extending new credit | It doesn't block access in the same way |
Place a freeze separately with Equifax, Experian, and TransUnion. Keep each confirmation and its login details.
Apply for credit soon? Temporarily lift the freeze before the business checks your file. Reinstate it afterward if you choose.
Turns out, a freeze's main use is reducing the risk of new-account fraud. It won't remove an account that already exists.
The FTC's guidance on credit freezes and fraud alerts describes the available alert options and the documents that may support an extended alert after identity theft.
How the identity theft block works
An account opened through identity theft may require more than an ordinary dispute. Section 605B of the FCRA lets an eligible consumer ask that identity-theft information be blocked from the file.
Your request generally must identify the information, say that it does not relate to a transaction you made, and include proof of identity plus an identity theft report. The statutory identity theft block requirements also describe notice procedures if a block is declined or later rescinded.
Send the request to every bureau displaying the fraudulent information. Notify the company connected to the account, and keep the submission and delivery records.
Thing is, the block is limited to identity theft information. It isn't a shortcut for removing an accurate account or resolving an ordinary billing disagreement.
What Metro 2, credit scores, and privacy rules do not change
Credit reporting uses several terms that sound interchangeable. They aren't.
| Term | What it means for a consumer |
|---|---|
| FCRA | Sets rules for report accuracy, permissible access, disputes, and certain notices |
| GLBA | Focuses mainly on financial privacy and safeguards; it is not a substitute for an FCRA dispute |
| Metro 2 | An industry reporting format used by furnishers; it is not a federal law or a guarantee that reported data is accurate |
| Credit score | A numerical output from a scoring model; disputing the underlying report is different from challenging the scoring formula |
Furnishers still have to address wrong information. Saying that data was sent in Metro 2 fields doesn't make inaccurate data correct. A low score alone doesn't prove that the report contains an error.
Federal oversight is shared. The CFPB and FTC are important agencies here, although their authority depends on the company and the specific rule involved.
What to do if the error is not fixed
Keep one file for the dispute. Save the original report, dispute, supporting documents, confirmation, investigation result, and updated report. It's boring paperwork, yes, but it gives you a usable timeline.
If the bureau or furnisher leaves a well-supported error unresolved, submit a complaint to the CFPB with the relevant records. Explain what you disputed, when you sent it, what response arrived, and what remains wrong.
To be honest, a complaint is an escalation route, not a guaranteed deletion order. A clear record often helps more than sending the same dispute over and over.
Consider speaking with a qualified consumer attorney or legal aid organization if the error caused a major financial loss, identity theft continued, or a company ignored repeated statutory duties.
Common questions
Can a credit bureau delete accurate negative information?
Usually not before the lawful reporting period ends. A dispute is for inaccurate, incomplete, duplicated, or obsolete information.
Does a credit freeze lower my credit score?
No. A freeze doesn't change your file or calculate a new score. It can delay a credit application until you lift it.
Is a fraud alert the same as a credit freeze?
No. A freeze restricts most new-credit access. A fraud alert asks businesses to take extra identity-verification steps.
Does a CFPB complaint replace a credit bureau dispute?
No. Start with the bureau and, when appropriate, the furnisher. Use a CFPB complaint when the response is missing, incomplete, or unsupported.
Your next move
Open the available reports and mark the bureau and account tied to the problem. Send one focused dispute with supporting documents, save the confirmation, and calendar the 30-day response window.