Fair Credit Reporting Act for mortgage borrowers: reports, scores, disputes, trigger leads

The FCRA controls what a credit report may say about you, how fast errors must be fixed, and what a lender must show you when your score decides the price of your mortgage.

The Fair Credit Reporting Act of 1970 was the first federal privacy law, and it still governs the file that decides whether you get a mortgage and at what rate. Its most important amendment, the Fair and Accurate Credit Transactions Act of 2003, added free annual reports, identity theft tools and the score disclosures mortgage applicants now receive. The CFPB’s Regulation V (12 CFR Part 1022) implements it, shared with the FTC. The statute regulates three groups: the consumer reporting agencies (Equifax, Experian, TransUnion and the smaller specialty bureaus), the furnishers who send them data (your lenders, card issuers and servicers), and the users of reports, which for our purposes means mortgage lenders.

What a lender may pull, and what it must tell you

A lender may obtain your report only with a permissible purpose: in mortgage lending, your application. Prequalification tools that run a soft inquiry do not affect your score; a full application produces a hard inquiry, and the scoring models treat several mortgage inquiries within a shopping window — 14 to 45 days depending on the model — as one, so rate shopping is not penalized if it is done quickly. Mortgage lenders typically pull a tri-merge report from all three bureaus and use the middle score, or the lower middle score with two borrowers; Fannie Mae and Freddie Mac have been moving toward newer scoring models, so ask which model your lender used.

Two disclosures follow automatically. Every applicant for a dwelling-secured loan must receive the Notice to the Home Loan Applicant with the score(s) the lender used, the range of possible scores, the date, the bureau, and up to four key factors that lowered the score — free, whether or not the loan is approved. And if the lender takes adverse action — denial, a counteroffer, or worse terms than you asked for — because of the report, you must receive a notice naming the bureau, stating that the bureau did not make the decision, and explaining your right to a free copy of the report within 60 days and to dispute it. The ECOA adverse action notice and the FCRA notice are usually combined in one letter.

What the file may contain

Most negative information drops off after seven years: a late payment seven years from the date it occurred, a collection or charge-off seven years from the first delinquency that led to it, a foreclosure or short sale seven years from the completion. Chapter 7 bankruptcy stays for ten years from filing; Chapter 13 is reported for seven years by bureau practice. Hard inquiries show for two years. Since 2017 the bureaus have removed most civil judgments and tax liens for lack of identifying data, and since 2023 they have voluntarily stopped reporting paid medical collections and medical collections under $500; regulatory attempts to go further were reversed in court, so verify the current treatment of medical debt. The seven-year limits do not apply to some large loans (generally $150,000 or more), though the bureaus apply them anyway.

Your rights over the content

Free reports. One from each bureau every 12 months through annualcreditreport.com by statute, and weekly free access that the bureaus made permanent in 2023; also free after an adverse action, a fraud alert, or if you are unemployed and job-hunting or on public assistance.
Disputes. A bureau must investigate a dispute within 30 days (45 if you add information during the investigation), forward it to the furnisher, delete or correct what cannot be verified, and send you the result within five business days of finishing. Furnishers have a parallel duty to investigate disputes sent to them directly. Inaccurate information reinserted later must be reported to you.
Security freezes and fraud alerts. Freezes are free and must be lifted within one hour of an online request; an initial fraud alert lasts one year, an extended alert seven years, and an active-duty alert one year.
Prescreen opt-out. You may remove yourself from prescreened offer lists for five years online or by calling 1-888-5-OPTOUT (888-567-8688), or permanently by mail.

Trigger leads

When a mortgage lender pulls your report, the bureaus have long sold that fact, as a prescreened list, to other lenders who then call, text and email within hours. The FCRA permitted this as a “firm offer of credit.” Federal legislation enacted in 2025 — the Homebuyers Privacy Protection Act — restricts the practice for mortgage inquiries: generally, a bureau may furnish such a trigger lead only to a lender that you authorized, that originated your current mortgage, that services it, or that holds a deposit account for you, with an effective date in early 2026. Because implementation is recent, confirm the current status with the CFPB; the prescreen opt-out above remains the surest way to stop the calls, and it should be done a few days before the first credit pull.

Limits and enforcement

It does not set a minimum score for any loan, does not tell a lender how to weigh a report, and does not require a bureau to remove accurate negative information before the limit runs. It does not regulate “credit repair” companies (the Credit Repair Organizations Act does, and it bans advance fees). And it provides no right to see the underwriting notes, only the report and score the lender used.

Enforcement. The CFPB and the FTC enforce the Act against bureaus, furnishers and users, and state attorneys general may sue. The private right of action is unusually strong: for a willful violation, actual damages or statutory damages of $100 to $1,000 per violation plus punitive damages and attorney’s fees; for negligence, actual damages and fees. Suits must be filed within two years of discovery or five years of the violation, whichever is earlier. Bureaus and furnishers are the usual defendants in cases about unresolved disputes and mixed files — the fact pattern that most often derails a mortgage application.

Before you apply

Pull all three reports several months before a purchase, dispute any error in writing with documents, and keep the dispute results; a bureau that verifies a false item after a proper dispute is liable. Opt out of prescreened offers a week before the first pull. Keep the score notice from each lender and compare the key factors listed. If you are denied or priced up, use the 60-day free report right and check whether the lender relied on a factor that was wrong. Our credit score guide and bad-credit refinance guide explain where the lender’s thresholds actually sit.

Key points

Enacted 1970, amended by FACTA in 2003; Regulation V (12 CFR 1022), enforced by the CFPB and FTC.
Mortgage applicants must receive a free Notice to the Home Loan Applicant with the scores used, the range and key factors.
Adverse action notices name the bureau and give 60 days to request a free report; usually combined with the ECOA notice.
Negative items fall off after 7 years (Chapter 7 bankruptcy 10 years); hard inquiries after 2 years.
Disputes must be investigated within 30 days (45 with added information); unverifiable items deleted.
Free reports at annualcreditreport.com, free security freezes, prescreen opt-out at 1-888-5-OPTOUT.
Mortgage inquiries within a 14–45 day window count as one for scoring; trigger leads restricted by 2025 federal legislation (confirm status).
Willful violations: $100–$1,000 statutory damages plus punitive damages; two-year/five-year limitations period.

How FCRA applies to you

Frequently asked questions

Why am I getting calls from other lenders right after applying for a mortgage?

Those are trigger leads: the bureaus sold the fact of your mortgage inquiry as a prescreened list. Federal legislation enacted in 2025 restricts such sales to lenders you authorized or already have a relationship with, with an effective date in early 2026; confirm the current rule. Independently, you can opt out of prescreened offers at 1-888-5-OPTOUT or optoutprescreen.com, ideally a few days before your first application.

Will shopping several lenders hurt my credit score?

Not materially if done within a short window. FICO and VantageScore treat multiple mortgage inquiries within 14 to 45 days, depending on the model version, as a single inquiry, and inquiries are a small scoring factor in any case. Apply to the lenders you are comparing within the same two weeks, and use prequalification with a soft pull when a lender offers it.

How do I fix an error on my credit report before closing?

Dispute it in writing with each bureau reporting it, attaching proof; the bureau has 30 days to investigate and must delete anything the furnisher cannot verify. Dispute with the furnisher as well. For a closing that cannot wait, lenders often use a paid rapid rescore through the bureaus once you have documentation the item is wrong. Keep the results; a bureau that verifies an inaccurate item after a proper dispute can be liable.

Is the lender required to show me my credit score?

Yes, for any loan secured by a dwelling. The FCRA requires a free Notice to the Home Loan Applicant with the score or scores the lender used, the range, the date, the bureau and the key factors affecting the score. This is separate from the adverse action notice you receive if denied, which also discloses the score, and from your right to a free report from each bureau.