# Permissible Purpose Under the FCRA, in Plain English

> The FCRA lists a handful of reasons you're allowed to pull someone's credit. What each one means in real life, which one fits your situation, and the simple record that protects you if anyone asks.

Source: https://phonenumbercreditscore.com/blog/permissible-purpose-fcra  
Author: Jordan Avery, Head of Content  
Published: 2023-07-03  
Topic: Compliance & Privacy  
Publisher: Phone Number Credit Score (https://phonenumbercreditscore.com/)

Under the Fair Credit Reporting Act, you can only look at someone's credit report when you have a reason the law recognizes. That reason is called a **permissible purpose** (FCRA section 604 spells them out), and the list is short. The one that covers most people is simple: the person said yes, in writing. The others boil down to "they applied to do business with you" or "they already owe you, and you're checking on the account."

The rest of this post walks through the actual list, what each item means when you're a landlord, a lender, a contractor or a parent about to co-sign, and the small habit (saving the OK) that keeps you on the right side of it. This isn't legal advice, just the plain-English version we wish someone had handed us years ago.

## Why the FCRA cares about your reason

A credit file is about as personal as data gets. It shows who someone owes, how much, whether they pay on time, where they live. Congress decided in 1970 that this information can move around, but only for specific jobs. So the law doesn't care if you're a nice person, or if the person probably wouldn't mind. It asks one question: is your reason on the list?

That framing helps. You don't have to guess at a vague "is this OK" standard. You check your situation against a list of categories, and if it fits one, you're fine. If it doesn't fit, no amount of good intentions fixes it.

It also explains why every credit data provider makes you confirm your purpose before a lookup. Section 607 of the FCRA ([15 U.S.C. § 1681e](https://www.law.cornell.edu/uscode/text/15/1681e)) requires consumer reporting agencies to have users identify themselves, certify the purpose, and promise not to use the report for anything else. When you tick that box, you're making a legal statement. Treat it like one.

## Permissible purpose: FCRA section 604, line by line

The list lives in section 604 of the Act, codified at [15 U.S.C. § 1681b](https://www.law.cornell.edu/uscode/text/15/1681b). With the legalese stripped out, it reads like this.

| Section | What it says | What it looks like in real life |
|---|---|---|
| 604(a)(1) | A court order or certain subpoenas | Litigation. Not something you'll be doing from a phone number. |
| 604(a)(2) | The person's written instructions | They signed a form, replied to a text, checked a box. The most flexible one. |
| 604(a)(3)(A) | A credit transaction involving the person | They applied for a loan, financing, or terms. Or they owe you and you're reviewing or collecting the account. |
| 604(a)(3)(B) | Employment purposes | Hiring and promotion. Comes with its own disclosure rules (more below). |
| 604(a)(3)(C) | Insurance underwriting | A policy they applied for. |
| 604(a)(3)(D) | Government licenses or benefits | Agencies that must weigh financial responsibility. |
| 604(a)(3)(E) | Valuing an existing credit obligation | Investors and servicers buying or servicing a loan. |
| 604(a)(3)(F)(i) | A business transaction the person started | A rental application, a lease, an equipment rental. |
| 604(a)(3)(F)(ii) | Reviewing an account they have with you | Checking that an existing customer still meets the terms. |
| 604(a)(4)–(6) | Child support agencies, and the FDIC or NCUA winding down a failed institution | Government use only. |

Most of our customers live in three rows: (a)(2), (a)(3)(A) and (a)(3)(F). Let's take those one at a time.

### Written instructions: the "they said yes" route

If the person gives you written permission, you have a permissible purpose. That's it. You don't need to be a lender, and they don't need to be applying for anything.

This is the route for the situations the law didn't really anticipate in 1970. A friend asks to borrow $4,000. Your nephew wants you to co-sign his first car loan. A guy you met at a trade show wants to open a landscaping company with you as a 50/50 partner. None of those are classic "credit applications," but all of them are fine if the person agrees in writing.

"Written" is broader than it sounds. A text reply, an email, an e-signature, a checkbox on a web form with clear wording next to it. What matters is that you can show it later.

### A credit transaction: they asked you for money or terms

If someone applies to borrow from you, finance through you, or buy on terms, you have a permissible purpose under (a)(3)(A). Same if they already owe you money and you're reviewing or collecting that account.

This covers more businesses than people expect. A lender, obviously. But also a contractor who lets a homeowner pay in installments, a supplier offering net-30 terms to a sole proprietor, a dealer arranging financing. If you're extending credit, you're in this bucket.

### Legitimate business need: they started a transaction with you

This is where landlords sit. A rental application isn't a loan, but the applicant started a business transaction with you, and their credit is relevant to it. Section 604(a)(3)(F)(i) covers that.

Two words in that section do a lot of work: "initiated by the consumer." The person has to come to you. Someone who filled out your rental application qualifies. Someone whose number you found on a flyer, or who called once to ask whether you allow dogs, doesn't. Not yet, anyway.

Our [landlord's guide to tenant credit checks](https://phonenumbercreditscore.com/blog/tenant-screening-credit-check-guide) goes deeper on the rental side, including what to do with the results.

## Situations people ask us about

A list only gets you so far. These are the cases that actually land in our inbox.

**A landlord pre-screening a showing request.** Someone texts about a two-bedroom and wants to see it Saturday. They haven't applied. If you'd like to check their credit before driving across town, ask: "Mind if I run a quick soft credit check before the showing? It won't affect your score." If they reply "sure," you have written consent. If they say no, you wait for the application.

**A loan broker with a stack of purchased leads.** The leads came from a form, and the form said nothing about credit. No permissible purpose. Screening cold lists without consent is exactly what the law is built to stop. If your intake form includes clear credit-check language that the person agreed to, that's a different story.

**A parent co-signing for an adult child.** The kid is the borrower. You're about to be on the hook for the debt. Ask them, get a yes in a text, and look. Most people in this spot are glad to show you, and if they aren't, that tells you something too. Look past the score to the payment history; our [FICO Score 4 explainer](https://phonenumbercreditscore.com/blog/fico-score-4-explained) covers what moves it.

**Checking an ex, a neighbor or a date.** No. Curiosity isn't on the list, and neither is "I just want to know." This is the case the penalties were written for.

**Hiring someone.** Employment is technically a permissible purpose, but it comes with extra steps under section 604(b): a standalone written disclosure, the candidate's written authorization, and a pre-adverse action process before you reject anyone. We don't support employment screening at all, so if you're hiring, you need a provider built for it.

![Two people reviewing printed paperwork with a pen at a round white table](https://phonenumbercreditscore.com/media/blog/01a1366f-bb10-7a87-b055-edea8956a18c-1200.webp)

## Soft pulls still need a reason

A common mix-up: "It's a soft pull, so I don't need permission." Not true.

A soft pull (a soft inquiry) means the check doesn't count against the person's score and other lenders don't see it. That's a big deal for the person being checked. But it's still a consumer report under the FCRA, so the permissible purpose rule applies in full. Every lookup we run is a soft pull, and every one still needs a valid reason. The [soft pull vs. hard pull](https://phonenumbercreditscore.com/blog/soft-pull-vs-hard-pull) post explains what each type actually does to a file.

## What happens if you get it wrong

Most of the FCRA's teeth are aimed at the person who pulled the report.

- **Civil liability for willful violations.** Under [section 616 (15 U.S.C. § 1681n)](https://www.law.cornell.edu/uscode/text/15/1681n), a person who obtains a report under false pretenses or knowingly without a permissible purpose owes the consumer their actual damages or $1,000, whichever is greater. Courts can add punitive damages and attorney's fees on top.
- **Negligent violations.** Section 617 lets the consumer recover actual damages and legal fees even when the mistake wasn't intentional.
- **Criminal exposure.** [Section 619 (15 U.S.C. § 1681q)](https://www.law.cornell.edu/uscode/text/15/1681q) makes it a federal crime to knowingly and willfully get information on a consumer from a reporting agency under false pretenses. The maximum is two years in prison.
- **Losing access.** Separately from the law, the provider can and will cut you off. We keep a record of every lookup and the reason given, and we may ask you to show it.

Pretexting deserves its own sentence. Lying about who you are, or about why you want the report, is never OK, even if the information would have been easy to get honestly. The fix is always to ask.

## The paper trail that protects you

One habit makes all of this easy. For every lookup, be able to answer two questions a year from now: what was the reason, and where's the proof?

For an application, the proof is the application itself. For consent, it's the text, email or form. Save it somewhere you'll find it again. A folder per applicant works. So does a note in your CRM with a screenshot attached.

Good consent language is short and specific. Something like:

> "I authorize [Your Name or Company] to obtain my credit report and score from TransUnion to review my rental application. I understand this is a soft inquiry and won't affect my credit score."

Name the bureau, name the reason, keep it in plain words. Then keep the reply.

One more piece of the trail: what you do with the report afterward. If you turn someone down, or offer worse terms, because of what you saw, the FCRA requires an adverse action notice. It names the bureau, says the bureau didn't make the decision, and tells the person how to get a free copy of their report. Our [compliance page](https://phonenumbercreditscore.com/compliance) has the plain-English version.

## What the person you checked is entitled to

It helps to know the other side of the table. Anyone can request a free copy of their file, dispute errors directly with the bureau, and learn who has pulled their report. The CFPB publishes the official [Summary of Your Rights Under the FCRA](https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf), and it's worth five minutes of your time. Soft inquiries show up in the person's own copy of their report, even though lenders can't see them. So assume that if you look someone up, they could eventually see that a check happened and ask about it.

That's another argument for the simplest route. If you asked first, the inquiry is no surprise.

## A quick gut check before every lookup

Run through these before you hit search. If you can't answer yes to the first one, stop.

1. Did this person apply to me, owe me, or tell me in writing that it's OK?
2. Can I show that proof to someone else, today?
3. Am I going to use what I learn only for the reason I just gave?
4. If I say no or change the terms, do I know how to send an adverse action notice?

Our [compliance page](https://phonenumbercreditscore.com/compliance) lays out the same rules in a shorter form, and the [FAQ](https://phonenumbercreditscore.com/faq) covers the questions people send us most. And if you're still not sure whether your situation fits, the safest move costs nothing: ask the person. "Mind if I check your credit?" is a perfectly normal question, and a yes in writing is a permissible purpose on its own.

Want to see how a phone-number lookup handles the rest, from matching the person to returning a score? Start with [how it works, step by step](https://phonenumbercreditscore.com/blog/how-phone-number-credit-score-works), and compare it with [what a plain reverse phone lookup shows](https://phonenumbercreditscore.com/blog/reverse-phone-lookup-what-it-shows).

## Frequently asked questions

### Is verbal permission enough to pull someone's credit?

The FCRA's consent route is written instructions from the person, so get it in writing. A text, an email, a checkbox on an online form or a signed paper form all work. A phone call where they say yes is a good start, but follow it with something you can save.

### Do I need a permissible purpose for a soft pull?

Yes. A soft pull changes how the inquiry is treated on the person's file and keeps their score untouched, but it's still a consumer report. You need a legitimate reason, like their written OK or an application they started with you.

### Can I check a tenant or borrower again later?

If they're an existing customer and you're reviewing whether they still meet the terms of the account, or collecting on it, the FCRA allows it. For a lease, that usually means a renewal or a collection question, not idle curiosity. When in doubt, ask again and save the reply.

### What happens if I pull someone's credit without a permissible purpose?

The person can sue you for actual damages or $1,000, whichever is greater, plus punitive damages and legal fees if it was willful. Getting a report under false pretenses can also be a federal crime. And the company you got it from can shut off your access.