Is It Legal to Look Up Someone's Credit Score?

Yes, it’s legal to look up someone’s credit score when you have a “permissible purpose” under the Fair Credit Reporting Act. The easiest one to have is their written permission. Others include the person applying to rent from you, borrow from you, or do business with you. Without one of those reasons, pulling someone’s credit is illegal, even if it’s only a soft pull and even if you never use what you see.

That’s really the whole rule. The rest of this post is about what it looks like in practice, because the gray areas are where people get into trouble.

(A quick note before we start: we’re a credit lookup company, not a law firm. This is a plain-English explanation, not legal advice for your situation.)

Can you look up someone’s credit score? The one-sentence law

The FCRA lists the reasons a credit bureau may hand over a consumer report in 15 U.S.C. § 1681b(a), and then, in subsection (f), flips it around: nobody may use or obtain a consumer report except for one of those reasons, certified to the company providing it.

So the question is never “is credit data public?” (it isn’t) or “will they find out?” (maybe). It’s “which listed reason do I have?”

The ones ordinary people and small businesses actually rely on:

• The person’s written instructions. They told you, in writing, that you can check. This covers almost anything legitimate, which is why it’s our favorite.
• A credit transaction involving them. They’re applying for a loan, financing, or credit terms from you, or you’re reviewing or collecting an existing account.
• A legitimate business need tied to a transaction they started. A rental application is the classic case.
• Insurance underwriting for a policy they applied for.
• Employment, but only with a separate written disclosure and authorization. (We don’t support hiring decisions, so we’ll leave that one there.)

Notice what’s missing. Curiosity. Protecting yourself from someone who hasn’t asked you for anything. Checking up on a family member. None of those appear anywhere in the statute.

Real situations, sorted

These are the cases we hear about most. Same caveat as above: details matter, and state law can add rules.

A rental applicant fills out your application. Legal. They initiated a transaction with you. Most landlords still get a signed consent on the application, and you should too.

A friend asks you to co-sign their car loan. Legal if they say yes to you checking. You’re about to take on their debt, and asking “can I see your credit first?” is completely reasonable. If they refuse, that tells you something too.

Your cousin wants to borrow $4,000. Same deal. Ask, get the OK in writing, then check. Family loans go sideways often enough that a quick look protects the relationship as much as the money.

You’re about to open a business with someone. Legal with their written consent. It’s a big financial commitment and a normal thing to ask. Read the whole file, not just the number: a credit report and a credit score tell you different things.

A customer wants 60-day payment terms on a $15,000 job. Legal: they’re asking you for credit. Get their signature on the credit application anyway.

Your new boyfriend seems vague about money. Not legal without his permission. You can ask him. You can’t pull it.

Your ex owes you money and stopped answering. Don’t. A personal IOU is a long way from the account reviews and collections the statute has in mind, and “I wanted to see if they could pay” isn’t something you want to explain to a judge. Small claims court is the better route.

A neighbor seems like he’s living beyond his means. Not legal, and frankly a little creepy.

Your adult child is applying for an apartment and you want to help. Legal if they say yes. Parents don’t get an automatic pass.

What consent should actually look like

Consent is the cleanest path, so it’s worth doing well. The statute talks about the consumer’s “written instructions,” so a nod across the table isn’t enough. Get something you can show later.

A good consent record has four things:

1. Who’s checking, by name or business name
2. What you’re checking (their credit report and score)
3. Why (the rental application at 41 Elm St., the co-signed loan, the payment terms)
4. A date

A text works fine. Something like:

“Hi Marcus, it’s Priya from Elm Street Rentals. To move forward with your application for Unit 2B, I’ll run a soft credit check using your phone number. It won’t affect your score. Reply YES if that’s OK.”

When Marcus replies YES, screenshot it or save it to the file. That’s your record. The longer legal breakdown of each purpose is in permissible purpose under the FCRA.

“It’s only a soft pull” doesn’t change anything

People sometimes assume a soft pull is a loophole. It isn’t. A soft inquiry doesn’t affect the person’s score, and the CFPB notes that soft inquiries aren’t shown to lenders who pull the report later. But it’s still you obtaining their consumer report, so the permissible purpose rule applies in full. (If the difference between the two kinds of pulls is fuzzy, here’s soft pull vs. hard pull.)

And “they’ll never know” isn’t quite true either. Under 15 U.S.C. § 1681g, when someone requests their own file, the bureau has to identify everyone who procured their report in the past year (two years for employment). Soft inquiries show up on the person’s own copy. Anyone who checks their free report can see your name there. (If you want to know exactly what a lookup touches, here’s how a phone number credit lookup works.)

What about sites that promise anyone’s score for free?

You’ve probably seen them: type in a name, get a “credit rating.” Be skeptical. A real credit score comes from a credit bureau’s file, and any company that sells you one is acting as (or reselling for) a consumer reporting agency, which means it has to make you certify a permissible purpose before it hands anything over. A site that asks no questions is either showing you an estimate built from public records, or it’s not following the law. Neither is something you want to base a lease or a loan on.

The legitimate version looks a little more boring. You state your reason, you confirm you have it, the lookup is logged, and you get the real score from the bureau’s data. That friction is the point. It’s also what protects you if anyone ever asks why you checked.

What happens if you pull credit without a reason

This is where the FCRA has teeth.

Civil liability for willful violations (15 U.S.C. § 1681n). If a person obtains a consumer report under false pretenses or knowingly without a permissible purpose, they’re liable to the consumer for actual damages or $1,000, whichever is greater, plus punitive damages if the court allows them, plus the consumer’s attorney’s fees. That last part matters: it makes these cases attractive to lawyers.

Negligent violations carry actual damages and attorney’s fees under § 1681o. “I didn’t realize” isn’t a full defense.

Criminal penalties (15 U.S.C. § 1681q). Knowingly and willfully getting someone’s information from a credit bureau under false pretenses can mean fines and up to two years in prison.

Liability to the bureau, too. Under § 1681n(b), someone who obtains a report under false pretenses or knowingly without a permissible purpose also owes the credit bureau its actual damages or $1,000, whichever is greater.

And on a practical level, any legitimate service will cut you off. We keep a record of every lookup and the reason given, and we can ask you to back it up.

If you checked and decided “no”

Having a valid reason to look is half of it. If you’re a landlord, lender or business and you turn someone down (or charge a bigger deposit, or offer worse terms) because of what you saw, the FCRA requires an adverse action notice. It tells the person the decision was based on their credit, names the bureau that supplied it (TransUnion, for our lookups), and explains their right to a free copy and to dispute errors. Landlords trip on this more than anyone, and our tenant screening guide covers what the notice needs to say.

A private person deciding not to co-sign for a friend isn’t in the same position, but being upfront about why is still the decent move.

The two-question test

Before you look up someone’s credit score, ask yourself:

1. Did they ask me for something financial (a lease, a loan, credit, a co-signature, a partnership)?
2. Did they say yes to the check, in writing?

If the answer to the second one is yes, you’re almost always fine. If both are no, don’t run it. The rest of the details are on our compliance page, and quick answers to the usual follow-ups are in the FAQ.

Last thing. If you’re on the other side of this and think someone pulled your credit without a reason, get your reports from AnnualCreditReport.com, look at the inquiry section, and contact the company listed. You have real rights here, and they’re enforced.